{ "Event": { "published": true, "date": "2026-05-12", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-05-12", "timestamp": 1778630582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "0dc6a09d-e8d7-48fd-a3f7-f554afb8d1b3", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd359b3-4e39-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1778614348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614348, "uuid": "52f79660-b195-4e27-ae3b-0bff11f29046", "comment": "Malware payload (Gafgyt)", "value": "12f09ab1fafa6b7e1101e819f97cee25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614348, "uuid": "97005503-1858-4f3c-886e-e4f344d7aaf9", "comment": "Malware payload (Gafgyt)", "value": "00288755114d7eb2c1f7f40ad271d28714be5356a9c14e690d9c85cda4e10389", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614348, "uuid": "60d863a1-737c-47fd-964f-d45c4d52098e", "comment": "Malware payload (Gafgyt)", "value": "adfd45c1d58c35f4e265ccc45c53e776b967b1c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614348, "uuid": "d8f95d1a-242e-4082-9af2-280c42a87b56", "comment": "Malware payload (Gafgyt)", "value": "fc71fe5cc34d1c0731adb025937617c943fd8bed5a3669df9dbcb2b1998fa56c455b70906ba12b3d8caafbdc3f181d5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614348, "uuid": "6b3070bc-c0b7-469e-9d4a-2c7b78b9e27d", "value": "T15363027DD6DC2A1BDE31B03C061D038669614AB7F94BFA1F3BAAE6725D520D93883047", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614348, "uuid": "0b88de65-72b9-4c6c-a75e-0aabdcf1dece", "value": "1536:yGI2Yiioc3qAfVmd0DGqjrZosbhbRTgheOuXix/m2thWXx1hSVEWr:Igc300DGqjrZviRxukhaQVEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778614348, "uuid": "a4002a1d-0fd0-4d41-b4e0-c06879b1f89c", "value": 68356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778614348, "uuid": "ed1b67f5-79f1-447f-a31a-56169c550e30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614348, "uuid": "e22e636c-770a-4243-a104-e8504ad81ba4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b553a7b5-4e36-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1778613230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613230, "uuid": "34eaa779-c15f-41c1-ac64-e19b6bd25927", "comment": "Malware payload (Gafgyt)", "value": "c44386985f02e060e6da12e9560f4282", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613230, "uuid": "2aed092e-a131-4f5f-9cd2-649fda8f0dd2", "comment": "Malware payload (Gafgyt)", "value": "00749f5a02f88784dda862f0765b3369e49efd6cc9977f719424e7c39c630497", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613230, "uuid": "86ee04ec-e72a-4ff9-84f1-b5219caea259", "comment": "Malware payload (Gafgyt)", "value": "6690ab6f26a169fd1ceb91b5955c4dc8451ee1ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613230, "uuid": "17aae79c-ec83-4856-816e-99666985f748", "comment": "Malware payload (Gafgyt)", "value": "091107377554e7ef68633ab5b25cef3f60e55e6314138ca4da839f513e7b6bd4143ca8ffcace092607c61bfb40eec98d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613230, "uuid": "97fd6ac6-d357-41c8-80f9-08390fffbbe1", "value": "T122931A9BFA42CEB3C41310F112AA9F219D71F9FB4823D642E3646DB4DE154C25A16FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613230, "uuid": "a99e5b5b-ca65-4f51-953e-52bfe3bcd2ef", "value": "1536:WA+k82vFIl2qbZckmjWGw57fobEOQryVwCiUH1FVLx8rbrbUkmyukJ33xZTe0gw7:WAldFI2qbhpRfobEOLVBiUH1FVLx8rbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778613230, "uuid": "438a92af-535d-469a-bd89-10b3546a4956", "value": 91212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778613230, "uuid": "2902117c-2ac7-4040-8da3-c1626e2e57b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613230, "uuid": "1b7a91e7-dbd4-48f2-a93f-454b2ccd1ac7", "value": "FBI.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7511841d-4de6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778578762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578762, "uuid": "b6cb71ee-8de5-4461-896c-03221ea08a79", "comment": "Malware payload", "value": "502737c2aaeecfd85f8ee313f9a2937a", "object_relation": "md5", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578762, "uuid": "d3cdd916-abb4-412b-8207-f60e13cb132d", "comment": "Malware payload", "value": "00b6b59157aa87f181a6a8e2b21a84aed40f8c8343b39aff660afca6161492b6", "object_relation": "sha256", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578762, "uuid": "b3d00eb6-ea53-4024-913a-1d3315db58e7", "comment": "Malware payload", "value": "2105dbf774b77ef20d3bd9f4101c75ba09457d30", "object_relation": "sha1", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578762, "uuid": "15b52a45-f478-498c-94e6-8b7a0ad9a0cf", "comment": "Malware payload", "value": "039cf7d06342a3a1403ca07dcb179e59e886256395cfda124aac10f99656e13758d2bb2a2639d10b37823bbad12b9458", "object_relation": "sha3-384", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578762, "uuid": "93352695-2431-4be2-a2ee-de0f31a1364a", "value": "T114B7AD0773E60195E5B3D2388AAB5203D773B8275730CBDF319D06552FABAD09A7A720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578762, "uuid": "0b50b1b8-7364-4963-8746-a126f373c713", "value": "ba34afa88020d21a2d934a3cc5b3f45f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578762, "uuid": "db2e9702-8992-4316-b8d6-ab6a058cb5de", "value": "786432:/6ov53y1oHAPUGAfM0gU/Xj/jC12xOjMtFVJDyW1KE3k1h:/h3y1oHAPUGAfM0gUvLjCYgMfvp9kP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778578762, "uuid": "c84622aa-c675-41a4-a639-f69bb1a3fb2f", "value": 51926643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778578762, "uuid": "5a588ad2-762c-40dd-9794-6bfe0e7b9771", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578762, "uuid": "cf8ba993-c641-4346-84cc-b2226aeea6cc", "value": "00b6b59157aa87f181a6a8e2b21a84aed40f8c8343b39aff660afca6161492b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95515f7c-4e17-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778599862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599862, "uuid": "88e509ab-c66a-4603-b016-1aa88d947828", "comment": "Malware payload (Mirai)", "value": "ae85f607c583235da916dddc0cbcb481", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599862, "uuid": "d5370fda-2154-489e-a887-a36992a8b139", "comment": "Malware payload (Mirai)", "value": "02715ecd80e408570d11c385a2291cee9459f2c1fe02658f3127345da6eb5219", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599862, "uuid": "e12f57c8-fd93-4e7e-99f0-5ff7646968fe", "comment": "Malware payload (Mirai)", "value": "118429d69e350c980b960a8301b8f5bddd15a1d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599862, "uuid": "8d906626-38e4-43c1-9985-5c3681733161", "comment": "Malware payload (Mirai)", "value": "47b5b7e6b32b8a2c29e6d300d61690d4e3b319e8ced4972679f6e9fb57225f91147c0e9b1e44d7f99a8b50ed5b992038", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599862, "uuid": "e4af5813-6628-48f2-acaf-c650b4afc8a1", "value": "T1D925AE11BBF2052AE280933586A2D750B613DB9668D5030BCF618EEBEF571750F85CFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599862, "uuid": "4107bea0-05c4-4639-9413-4e1016a22d82", "value": "12288:FAu75hPWGAOxh86/Yu+AAqq8DPy6KNrraYn30wUQAbdhw5nZ95Z6:FFFhOhOj/xpqSdKN53H8Jmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599862, "uuid": "544987dd-3468-4118-8c02-964643f2b8cf", "value": 1057224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599862, "uuid": "43b620bc-4c5a-49bc-bfd0-1043b13b8b41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599862, "uuid": "50576351-5b45-4195-ba1f-cc57869a7886", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3400829-4e15-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778599133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599133, "uuid": "01dd11df-3b98-4d11-baf8-233d308b9a90", "comment": "Malware payload", "value": "d857405b7d0548e016d851e62e20855a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599133, "uuid": "e0258638-d7bd-4c2c-90c1-5d3d54e10d5d", "comment": "Malware payload", "value": "03924c350970b509b7b239fba8d53d730b15b10ffbd028e6f931ebee7b16b036", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599133, "uuid": "2f452845-fdd7-4dda-b092-e14b11d0c513", "comment": "Malware payload", "value": "86a437959b7933773bf7c958b0aa5bb93a9d74b4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599133, "uuid": "296cf11c-ee10-49cf-a54c-40123d2f1c3d", "comment": "Malware payload", "value": "f58be74f0c466c40c2f9edde7a346a81d9fef2546024a8b5871eef8cfbfe667a3503537945671fb6719e2c1e0058f809", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599133, "uuid": "1d81535e-b2bf-41b7-8f1b-903b4fb64e2f", "value": "T1F1926C0FB9554319D4C00434A1B2877BD6BA9876338454EFFBD88ACA1B782DAF83215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599133, "uuid": "39520b6f-63ec-4b64-a3cd-0a9c879419b5", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599133, "uuid": "a6e05034-83dd-4fa8-8f59-3954378d95bf", "value": "384:iIkj7VlvadxaizO5wxDSZvu98t2rFJ/Bwav8U9cpG:Cax3qAUG9o5a0UYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599133, "uuid": "b3d06dc0-5c5f-4945-9b55-b8c172441ae8", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599133, "uuid": "4490f62d-423a-4ea9-b404-1a3ceb135224", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599133, "uuid": "2db8fb4f-2bf6-4860-8684-183a54976505", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8ac241-4ddd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778575101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575101, "uuid": "27367938-549e-4137-bb82-7bf7d61a4fcc", "comment": "Malware payload", "value": "26a2abcd92a1fe2be7832c437103b170", "object_relation": "md5", "Tag": [ { "name": "17-0-18", "colour": "#2859F9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575101, "uuid": "e5a6f5c6-1743-4b8a-a51b-50ee50391b89", "comment": "Malware payload", "value": "04cb9f0bca6e0e4ed30bc92726590724bf60938440b3825252657d1b3af45495", "object_relation": "sha256", "Tag": [ { "name": "17-0-18", "colour": "#2859F9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575101, "uuid": "40f7139a-8abb-4749-9d33-3cff5d5cab01", "comment": "Malware payload", "value": "fd196b51871e6eb3e111e6ebbb0f8d34c575f5f0", "object_relation": "sha1", "Tag": [ { "name": "17-0-18", "colour": "#2859F9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575101, "uuid": "e0355e5b-78ec-44cd-a075-f8ccfc939ff8", "comment": "Malware payload", "value": "c633aa3ea39f3f59648498d99f005873fad90240f825c99165b2d63ea403cdedafc1c7f3c3d302f5990f5e2489ed6841", "object_relation": "sha3-384", "Tag": [ { "name": "17-0-18", "colour": "#2859F9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575101, "uuid": "6070e5f0-8288-4207-84bb-5e32317833cd", "value": "T1AF28331C3F3EB3FDC9AC81395B77A58A49A92F2D078400BB1DB1078D6B915A09CF855B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575101, "uuid": "bf3bf172-9d34-42b2-9e45-6fe2782fbafe", "value": "cebbab50025aad300d9290d50864f4ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575101, "uuid": "55dd4d1e-a839-4ff3-b165-ddae03631a6f", "value": "1572864:Vr2GnbVpRULAACaIPt8IrkUT2lfavGxKKAeqpqON88tcPmtZz8S9qFTJ1HloBWw5:YqbTdV7eIp2F6GohRtcuz9WTXFoVwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778575101, "uuid": "bb570bcb-7467-4ed8-847a-a1ef4722d2c8", "value": 101420032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778575101, "uuid": "120c8941-e5a5-4e04-93b4-08e21573f24c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575101, "uuid": "78f0b72f-7849-4b48-b661-64af806e22bc", "value": "JDownloader2Setup_windows-amd64_v17_0_18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bdb2f68-4dff-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1778589484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778589484, "uuid": "85cab8fd-53ae-46ae-9ca5-79320e734bcd", "comment": "Malware payload (SalatStealer)", "value": "1567c14983101053db61743775ca7753", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778589484, "uuid": "3c8cbda4-2afa-4d98-b2ac-d9f0275d1d75", "comment": "Malware payload (SalatStealer)", "value": "04cd5102f8dc1dcd747c46723dec6006ed247242d7d83d30e987874b03cb31d8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778589484, "uuid": "c6b761eb-cdab-4b39-a3ba-5a3790651b27", "comment": "Malware payload (SalatStealer)", "value": "2b1dca9262ec898cfefbdc9cdfacfaf81e8bfefd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778589484, "uuid": "4c9d7877-fbb2-4b3d-975a-0f30f58393c4", "comment": "Malware payload (SalatStealer)", "value": "302a2fe9dc381ece50c5739e5acaaceb20dec140410ac250538098f57a8187429075ea23aca0d900dd7f4b4eb3fb3084", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778589484, "uuid": "a7f3dd6d-2eae-4d30-bd70-abec46abfcfb", "value": "T13F568E033BFEB45EEAAB97B4957462418625FC374D91808931CD548B4F9B9007EBC3BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778589484, "uuid": "bd9fd0fc-a288-4d35-92cd-6b385e93e4dd", "value": "ccf1fd66015dc21ddcca35136ea0b0f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778589484, "uuid": "c06895f0-38e9-4bda-aaef-cf55c38d982e", "value": "98304:IbUB/V+bwrPFfcZIbmQEbWj4CXh+0MupcTbl0G1+mP5:yq/V3Ea6Qxj46OOU+Q5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778589484, "uuid": "eaae271d-d822-4cb7-b4c8-a0a046fc7855", "value": 5924352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778589484, "uuid": "ccbbdb07-0364-40e3-9cd5-ebe9838c9f08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778589484, "uuid": "5e4fbcd4-5860-4bfb-b6ee-a1ea633d5499", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a39340ad-4e32-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778611482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611482, "uuid": "8aa8be36-8add-4d63-9654-8c913a34a4e9", "comment": "Malware payload", "value": "290d859a4d81ecbf3ee3bd35d9e850a8", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611482, "uuid": "4504a367-29af-4147-a72a-10762f175528", "comment": "Malware payload", "value": "0638103d6b66528d7a28095d1bff546b52459c1a86049b417c94d8a93e6446c7", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611482, "uuid": "ed011244-a39c-4348-ae51-00215277e129", "comment": "Malware payload", "value": "6bd7e474a42447380ebb97ca7eaccb8ee66b4c5f", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611482, "uuid": "bbf26dcd-6bfd-452b-8d09-13c5267160c4", "comment": "Malware payload", "value": "bddbcaf42447746712895077a8765094ea85b207151b574043a258dd88b8908d2427a0cc8862dde22f490d59c1618e90", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611482, "uuid": "720e1e61-9eaa-4f6d-940d-c4936c19441d", "value": "T1C0E7AE3322A714F9F9BAA93485521906DE7A7457433587CB738C32752FAB6D08E3E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611482, "uuid": "3fe6ad62-c362-4963-997f-4e77e6bf0260", "value": "4d0fb8dc9ee470058274f448bebbb85f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611482, "uuid": "52a1b9d3-fd25-4a35-b3a6-acba063a29a3", "value": "393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfT:fMguj8Q4VfvgqFTrYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778611482, "uuid": "875b0b0a-2de6-4012-91c9-7405e014e5f8", "value": 65044515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778611482, "uuid": "7f95c926-3c87-4e52-9e68-1eb8b660e971", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611482, "uuid": "dc72fbdb-c579-409f-bc8b-1bd78d3b2a58", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c87fda27-4dec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778581479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581479, "uuid": "18a2f5e1-72ef-4bb1-bde6-f24108a67131", "comment": "Malware payload", "value": "33707504fef04d64accc74a48c1ff18c", "object_relation": "md5", "Tag": [ { "name": "jicinvestments-monster", "colour": "#D62FD4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581479, "uuid": "58988658-7b08-40b8-92a1-7ebdc8057cb4", "comment": "Malware payload", "value": "069a6681e08dbbc2ad30b5294d82d07a425af5f432d81278058cc5ab0a4a1750", "object_relation": "sha256", "Tag": [ { "name": "jicinvestments-monster", "colour": "#D62FD4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581479, "uuid": "34bdd55c-8fbe-4382-9b20-c6cc8a9b0d42", "comment": "Malware payload", "value": "b5b492a5d1b92d408d3fa9a17a3e6697bfeb1832", "object_relation": "sha1", "Tag": [ { "name": "jicinvestments-monster", "colour": "#D62FD4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581479, "uuid": "8cddd622-340f-42bd-a656-0eb2f86dc609", "comment": "Malware payload", "value": "4b5ecb3744bd5025e91b47930310b45bd5b6fba9b73ab8a3a8ffedf685bbbb7ff1422e7642e3dd2fb4b91ec7a84026ac", "object_relation": "sha3-384", "Tag": [ { "name": "jicinvestments-monster", "colour": "#D62FD4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581479, "uuid": "415cfb03-0e24-42cb-adac-4069b8aa50a9", "value": "T159417334F158F18183DFD4B7D2DCFD8BA16101E690EB6DE00768875226865EA9F04865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581479, "uuid": "0167e3f9-5d49-4adc-8d15-5479582fe2a9", "value": "48:V+1mtaF2s/NvmZW7GmaBngClb+0pIUV3vxPsNSJ+zVQz:VC3vxm0GmaBui4RVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778581479, "uuid": "50c45bac-d1df-4887-a99b-d8bb589556e1", "value": 2164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778581479, "uuid": "e5287e38-061f-4db6-acd1-51f9d70ed456", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581479, "uuid": "080bd03d-4692-47a3-8f8c-7f54aeb40a9f", "value": "069a6681e08dbbc2ad30b5294d82d07a425af5f432d81278058cc5ab0a4a1750.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad736eb2-4e36-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1778613217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613217, "uuid": "32d6fd24-ceba-478e-a176-f9031efc2fd7", "comment": "Malware payload (Gafgyt)", "value": "24a9c8293fa6558c011976c3b6a6f088", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613217, "uuid": "bacd318a-3a61-4448-951c-a78e57c0bbfc", "comment": "Malware payload (Gafgyt)", "value": "07f4e4c5d7056fd9a50fbca51754d5bf057f4af86f4cb428014b9f9aad11c1e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613217, "uuid": "9dcbbbe4-d9c0-4e79-b791-8db700cd3666", "comment": "Malware payload (Gafgyt)", "value": "f47f78af7caf39427dd1e744e973e1e458a76773", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613217, "uuid": "afe4379e-81a1-40c0-944f-c71d8a2837e6", "comment": "Malware payload (Gafgyt)", "value": "c51e5363a97d5fa30e3f1c9a15f9a5dbe2d207f589524f53194007c4f9fd1b77b0d9d0cbdd86aeb74c0b13d7c30097b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613217, "uuid": "a094dddf-51ab-4f4e-972b-b3964990b0ba", "value": "T155A32A26BD018F53C2C315F3BB9F47887B2667F9D2EF3203E925AFA027564D60926950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613217, "uuid": "abc4f0c4-9eb5-4cb5-894d-ff6cc0e90640", "value": "1536:LqusRrBLj9YwCFapnidqFR9K91fCL8r/OQ/WeUyNj4qG739y5hdppNq:Lqdf/99gYfY9e895d4XbM5hdppNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778613217, "uuid": "2f884503-2296-437f-8fe3-516d362bf1ca", "value": 104272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778613217, "uuid": "5810dfdb-1687-432e-a619-2ec94cc85d1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613217, "uuid": "b17e9fb6-532a-45fd-a2a6-4192b6a84890", "value": "FBI.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b1074e-4e2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778610039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778610039, "uuid": "c7199f45-d35e-4025-91ad-0f053bfb63e5", "comment": "Malware payload (Mirai)", "value": "7d461bd021d2a5e639ee376ce846491f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778610039, "uuid": "da4e8c99-7ed6-4575-95b0-b7b59536c8fe", "comment": "Malware payload (Mirai)", "value": "09dd1c0e40fab43fff040945e75987f4568dd44d4095441683ee6a1ae63b301d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778610039, "uuid": "8fb4e285-698c-4bde-8d6f-6b38967a8048", "comment": "Malware payload (Mirai)", "value": "9352928267db6b72e9251187c65d951daf917b76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778610039, "uuid": "e707f77e-53d2-4f25-8cde-241a4d8d5e48", "comment": "Malware payload (Mirai)", "value": "69bb17a71a2c968f48125ddcf14b9e08e36767cea8e776f9038a7a3ee1b68054437bc35c6ef0f3d3e7fc862c5e9d8e47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778610039, "uuid": "3212722f-eccf-44e6-811b-6cc2c9115dde", "value": "T16E730992FE81C941C5D529BBFA6F41CC338307ACC3DE72029E11AB3566DF55A4A7AE01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778610039, "uuid": "eaaf567e-36bf-40b7-931d-ba727a293bef", "value": "1536:yjLSrNjlUZa9ayN87002+iSFVj1LwiNLtCOr+0DoISa7:j0yaVgFvc1ki5tSxISa7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778610039, "uuid": "aa0bfe69-0f67-427e-83df-58a5db661b44", "value": 77412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778610039, "uuid": "8ce81488-e918-4f12-9ab6-653a897204d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778610039, "uuid": "b8ac8e2c-2b88-4bdd-8712-ff9234a00fda", "value": "bot.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ef7cae-4de4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778577722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577722, "uuid": "30722e69-1a3e-49e1-8eca-086862856757", "comment": "Malware payload", "value": "e2108782f2fe1125b0a6636627c2bd3c", "object_relation": "md5", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577722, "uuid": "961749f2-0140-4b59-996b-24b4a6536198", "comment": "Malware payload", "value": "0b06f2979b3c2dcc8aa67d40f70dbf9747ceffa37e4587e7d829764d8c13a6f2", "object_relation": "sha256", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577722, "uuid": "c9d47e85-bc3d-4373-b566-8c73aea0fc9b", "comment": "Malware payload", "value": "3b5e2b672c5de6dc299e478b681c1cf7a54dddfc", "object_relation": "sha1", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577722, "uuid": "b36cd686-55f1-418b-93c3-3d28eb2cccc1", "comment": "Malware payload", "value": "04481566638c14ce89d0b922e35106b5f0bc9860bf0b7b0e4663fc5229a960331a12c86c18c5e39b87261caaf4b1f1f7", "object_relation": "sha3-384", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577722, "uuid": "f9f85e8b-9df4-4ea3-b45e-d29b2efad3d4", "value": "T17D27230E81154E12E6CB6FFD62990227953CF0346D1E55BBEF70DFA018A36A256E3DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577722, "uuid": "3c7b43ba-099d-4a23-914d-458826fbcdea", "value": "393216:1I575UKV5EgPUMhGv6u+vV9r1bwAfXtXkG0ni3JSuR0seCo14r:1y75rV5XPUMhGv6XV95cA/tXkznicBsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778577722, "uuid": "56699901-e2ee-4007-9a37-8896db686ca6", "value": 20629836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778577722, "uuid": "e2196557-9986-40dd-96fc-db0b932741b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577722, "uuid": "3aa71128-1d01-46c3-b50b-724b48396d3f", "value": "DCM-T3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56180b4-4de5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778578414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578414, "uuid": "e3b91bc3-68dc-4d58-b72c-44a8c78e39da", "comment": "Malware payload", "value": "eb076537535114be2b511f7547eaaa67", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578414, "uuid": "7f69980f-b722-4354-ae5c-0558019753e2", "comment": "Malware payload", "value": "0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578414, "uuid": "b4e879e8-7f8b-4c59-97d7-ee63ded81333", "comment": "Malware payload", "value": "df75b9cb2f9e1ad059baa195a228f12e9a64d494", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578414, "uuid": "99377486-a330-4f22-be3d-d9d25e9af9ab", "comment": "Malware payload", "value": "a5ac48b06f2d710c391aa5e9ea28494e06ebaf183443d651002bba725e1b28d01c0f8376afc527e91fff6e8bcd3d150f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578414, "uuid": "36354b32-4485-496b-a16b-61c583440901", "value": "T17741621B600415F4C96DABB1CACE13437BAE92EF401A9C84705DD1A01F057AA8FFFB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578414, "uuid": "a0aa1d64-0989-48b1-b076-76e19758e800", "value": "48:RpbIQW3G6FL5lE3VVX5limkXeGNsp6/sK:RlIAc923dUap6/sK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778578414, "uuid": "b3b958e0-79d2-453c-9f14-bc30cd3f1532", "value": 1960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778578414, "uuid": "3beae830-6c56-4603-aabf-b7a9a7c4852a", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578414, "uuid": "6fc617b4-6316-4956-a66c-fcfe7bb964d2", "value": "0b6d995b8b6a76b0ea3eb334790ac6daf8fd9e1ae0c112f1ddf4e479c3927ee7.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf057db-4de4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778577727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577727, "uuid": "4e176420-dbc6-46d3-b697-a9bb0987a779", "comment": "Malware payload", "value": "46764041ebc69acd2527e58172f33fcd", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577727, "uuid": "62476462-78ce-4031-b029-d1164de9f551", "comment": "Malware payload", "value": "0de9cc3daa4dc11053c6b43635355c95b6f51f19f617764efb0e0f2729d01e91", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577727, "uuid": "55b4b98f-0f14-4945-86f4-78cba483b204", "comment": "Malware payload", "value": "a2138bd4e389c48cc9f863d29c325fd6196c4c6d", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577727, "uuid": "8f2f79ba-5729-48c5-aabc-cc1d0726d575", "comment": "Malware payload", "value": "4dbbcb8a28d3cc945a0296ca2a3ffc167923be03c197246726eb8ef1658b257e062ddcce27b94ecba61d949bd7e27f6a", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577727, "uuid": "d81554b8-6059-4732-9f95-15a08ff6d3d3", "value": "T14061F80433D650EFD80E8E71AED69FF075542C9E0E3C76C06F448E973B58115D897669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577727, "uuid": "d5629a02-b933-471e-9de9-b327a79b1baa", "value": "96:eIJ6vuTAytlItlItlItlItlItlItlItlItlItlItlItlItlItlItlItlItlItlI0:eXuM2l0l0l0l0l0l0l0l0l0l0l0l0l0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778577727, "uuid": "bf7c5294-e851-4052-9762-77fd79398296", "value": 3315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778577727, "uuid": "b37f3a88-7761-47d4-af83-0f79d66be16f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577727, "uuid": "44d12ca1-da07-4e4b-a527-d0962aa91a0e", "value": "IMG_1233060112026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a427ba1e-4dcf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778568963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778568963, "uuid": "6912db78-fda4-438e-abf3-9a2fc92cc5c7", "comment": "Malware payload", "value": "f5eb7475fe638f9c8d098a0c7be38a12", "object_relation": "md5", "Tag": [ { "name": "95-85-246-53", "colour": "#A58116", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "booking-static-assets-com", "colour": "#C3FF4E", "exportable": true, "hide_tag": false }, { "name": "img-pulse-cache-com", "colour": "#9E63C0", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778568963, "uuid": "efb264aa-3c3b-4014-8c4b-43ab1599bcb2", "comment": "Malware payload", "value": "0f090af0bc21075670ae8b7758c097f3fe87b00464d1b27b55282ab98ab05f67", "object_relation": "sha256", "Tag": [ { "name": "95-85-246-53", "colour": "#A58116", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "booking-static-assets-com", "colour": "#C3FF4E", "exportable": true, "hide_tag": false }, { "name": "img-pulse-cache-com", "colour": "#9E63C0", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778568963, "uuid": "4720f5d2-a8b8-497f-8598-1bd639152c81", "comment": "Malware payload", "value": "65303354ea34ee4c794a1f1964637434036cf944", "object_relation": "sha1", "Tag": [ { "name": "95-85-246-53", "colour": "#A58116", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "booking-static-assets-com", "colour": "#C3FF4E", "exportable": true, "hide_tag": false }, { "name": "img-pulse-cache-com", "colour": "#9E63C0", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778568963, "uuid": "7fbb13c9-b9ef-4b8b-8118-3b6ca6b3be4a", "comment": "Malware payload", "value": "dbe0b7c1a24840ae70601a24f85f1534215cede7dafd2cc4c1e8257a2e0f3ea3140da8f11209450c72080464ad9b1fb3", "object_relation": "sha3-384", "Tag": [ { "name": "95-85-246-53", "colour": "#A58116", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "booking-static-assets-com", "colour": "#C3FF4E", "exportable": true, "hide_tag": false }, { "name": "img-pulse-cache-com", "colour": "#9E63C0", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778568963, "uuid": "550ca0d3-f092-4860-88b3-d91d1f6ea53f", "value": "T1F5A0220020C882EA0330800C3BE00A0CC02088E008AE002883080888080C0802B83232", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778568963, "uuid": "def54ca8-2c03-40dc-992b-7f9b51ce7653", "value": "3:rhfzCDhzCcLVMQWkm:NfSLVwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778568963, "uuid": "d57aece7-3a33-44c0-acb5-4913f482271e", "value": 60, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778568963, "uuid": "4cd28288-e89e-4c22-bac9-a7e72803d30e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778568963, "uuid": "ba20bd02-971c-47cb-9b55-9d6eff5f032f", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f5a2c3-4df2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778583943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583943, "uuid": "a4f15a2c-b66d-42ab-aaf2-fd93c1afb340", "comment": "Malware payload", "value": "54a57a84410f26799feb8ebb6faaed85", "object_relation": "md5", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583943, "uuid": "2bf80eb8-e32a-4b98-afdf-45c48a3f941a", "comment": "Malware payload", "value": "0f35abda19fb69430c32228465396094b866d887427bf551e353ab31256a9dd6", "object_relation": "sha256", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583943, "uuid": "13b04b7c-ffad-4578-9b29-40da22360e27", "comment": "Malware payload", "value": "753ff456ab8ef34ecb34742522460599349a7fce", "object_relation": "sha1", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583943, "uuid": "6aad14dd-987c-4c49-9a52-df02fba8de7c", "comment": "Malware payload", "value": "d8ec1dffb74dd0bf5307f9633f20d72e470bb28f2f0c3021f866ccf48f0b3a48ae30155627d240cebaed8e7ac72c1f03", "object_relation": "sha3-384", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778583943, "uuid": "c8ba5796-9126-4e62-9340-3973169c4cb9", "value": "T1F1B2E164C566B80BCC5475750EBBCF9790AD0FA57113B3052E0870BFFDA0294DA23246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778583943, "uuid": "b4be143b-6c77-4ddb-bdad-212f46913d59", "value": "384:eG+6DLqBdntPsrRdTbG18raGFJQR8wdfF6z3VAa/vFLgmpUY/I9W7XedTUJgj3pr:Nhvqn+tY18rrPo1FMltgmpB/1beuKj3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778583943, "uuid": "df4887e9-b059-4160-abf1-1addc6ab8371", "value": 23385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778583943, "uuid": "856f98db-c63c-400b-ae5c-1866abf3cee6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778583943, "uuid": "c6172863-01c4-4d11-bd93-2b9fbb54d833", "value": "teampcp.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22ce65b-4e36-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1778613224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613224, "uuid": "af4d9bcc-5636-4991-a6d0-49a130c04c3f", "comment": "Malware payload (Gafgyt)", "value": "6673c5b41941fa02b5ee9fb9b40e75a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613224, "uuid": "05400675-73fd-4f56-8e21-390f29ac299d", "comment": "Malware payload (Gafgyt)", "value": "0fc4c95268fd72f369c5dc12123c86c0de92201bfad42be3213f9b5c127c51db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613224, "uuid": "b8a2f124-899b-4e2b-b22b-986b9d661309", "comment": "Malware payload (Gafgyt)", "value": "9fb70f34254191bdf5b9b9c15b5c6cc9e8273cbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613224, "uuid": "3a16f6ab-3e17-47cd-9b42-b3eaa6e9a3b0", "comment": "Malware payload (Gafgyt)", "value": "87c99279627c88fcc4326134c506196a55986f5dddf6fdb273a2d32c3e273d1bc57d86758c9a5adedbe5eba119dc6133", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613224, "uuid": "87da40ae-7097-43f5-9e5e-d3eba4f1994c", "value": "T132A35B03B6D18DFAC08BD1F047DF6A259D32F4FE166371A76394AD902E1CDD12A19E90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613224, "uuid": "d803119c-9793-4da1-8a88-e7fb8bde6ac0", "value": "3072:9DODZsEyGiQw2g2BkhP9HJkVX/9jJ3vQteQZCV:9DOnXfW2BkTpmBJ3vQtefV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778613224, "uuid": "2f371b8b-c856-49c5-9e03-cb37f7fd1558", "value": 100216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778613224, "uuid": "f7f4f612-e4e0-4700-bc7a-e014367a77be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613224, "uuid": "1485402a-2e62-4a30-8632-9ef117332ae1", "value": "FBI.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a88589-4de5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778578434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578434, "uuid": "3c608d3b-7b91-4cf4-9352-b6f2bd523d82", "comment": "Malware payload", "value": "4f1ced6ba089fa8018ff0f7382401b39", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578434, "uuid": "3c454f8c-5d81-44e0-b7e7-3b74f33e3011", "comment": "Malware payload", "value": "0ff23222657b4e03f33bc7257d336402756a9629f8914c34cfffcb81202ca392", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578434, "uuid": "faef9f13-f1e6-4dac-a206-8a3ab7084a5b", "comment": "Malware payload", "value": "21c5842ad70ba35c2dbfdf055eb32f461ed37408", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578434, "uuid": "93cc829c-c65d-435b-b9e8-54adf555bec7", "comment": "Malware payload", "value": "d0993839af69e134db783689cc9826388867a57e943f68ed89a57d481aa3599960eef6f2fad04cf900a87dd38c5bf992", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578434, "uuid": "2b018b5d-404b-47e3-bbc9-243a56906cfd", "value": "T101F1CB3FC532F890875E360457A41C5E22886AA7D3B34E6CDB082CFA7971795FF14A88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578434, "uuid": "0c465dc8-f36b-4cfb-9cd9-dbb4aa3fdc7c", "value": "192:plIPpCdnq3nfWKm26CP7245c52uDnD/dNIKRbwrRzPCKRVoD:pcGqX+KV64y4CZdNIowr/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778578434, "uuid": "ba26a2f1-853b-43a6-b3f9-b041a352e825", "value": 8060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778578434, "uuid": "827c333c-76a1-4365-8bd4-563eb1a05e30", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578434, "uuid": "a36f4d93-931c-4078-82bf-0332ca4bdacf", "value": "0ff23222657b4e03f33bc7257d336402756a9629f8914c34cfffcb81202ca392.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc042a1-4e48-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778620894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778620894, "uuid": "e16e5401-21e2-4b38-8be7-5f52a0ef0cea", "comment": "Malware payload (Mirai)", "value": "6b4f9a3606c389587582ea260936c2c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778620894, "uuid": "a05b24cb-25d7-4978-b51d-2082979ae69d", "comment": "Malware payload (Mirai)", "value": "10238735f24449fd4661ab7c4cf272ab43160477367c0ffb099db0070ecf985c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778620894, "uuid": "ef945cde-b567-414c-8f15-5173fc0bd86c", "comment": "Malware payload (Mirai)", "value": "aa8046c7618c6534c8e7b1512dace212c26e7223", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778620894, "uuid": "8c77e1b3-41c9-459f-bf75-fb8c3e205ddf", "comment": "Malware payload (Mirai)", "value": "45ac1bb70b2350018b3a1740e97dbea7d8680c41f28d5d06e49424ed1666f7f15ff646629543b7581b4f66660c515b5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778620894, "uuid": "f2144c29-fcb4-4ecb-837f-758603be1052", "value": "T1BC73E562FE81CD51C8D928BAF91F42D83383076CC3FE75029E159B3566DF59A4E3AA40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778620894, "uuid": "6d4c0715-5374-4c5f-88ea-95baa0eab196", "value": "1536:YuWrrNjNGwTV7dlYKpU+//ObQnCqvOHofkJFpocAkXhAc7:wPh7dNpUMqQnNmBl7AkRAc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778620894, "uuid": "e96562aa-f0c1-4018-890e-5362406db68d", "value": 79340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778620894, "uuid": "8c2d4d87-a1e2-47f3-8aa0-9a02470bebdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778620894, "uuid": "cd561c1e-8b91-4479-b420-a0b6bf42ed30", "value": "bot.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a0274a-4e07-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778593041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778593041, "uuid": "390e91b1-85f8-4a78-8dfd-1a4dbe118b8f", "comment": "Malware payload", "value": "3a5fb8701615caf127d057f07c7c8d8c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778593041, "uuid": "6f2fae13-b378-4b76-9114-b848dedf8c96", "comment": "Malware payload", "value": "1225160e92734f2d2c4f351bee0b7d6a8b7697cb754b21c598b2dd97757643eb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778593041, "uuid": "4caf6e59-873d-4429-9c55-2d7ee100aa54", "comment": "Malware payload", "value": "9ba314778639f660b7fab7ca8ba017e2712381c7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778593041, "uuid": "513f120f-1891-4265-879e-998da5ad40ca", "comment": "Malware payload", "value": "35500c4580b992a958fdb6bb5b71634a981372e49e0861fc69d380e54e9e4a0160dccc64a57eb1d834dfa26125f111af", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778593041, "uuid": "064a331a-bbde-4b9b-989e-8c19d67aaadf", "value": "T104137D6956857C24AE99883B1C7E2F0CB9A9C3E1310451EDBFCB3CF58C19A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778593041, "uuid": "80480e5f-90f7-4c13-ba1e-ba75414c3df0", "value": "768:bF+l9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnB:bF+2c8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778593041, "uuid": "8d2765f0-da61-4ba8-9cb7-efb84c936d04", "value": 45500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778593041, "uuid": "423d573d-3197-495f-8283-227956534a20", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778593041, "uuid": "37116b34-794c-41e2-98a4-97c9af614245", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef47e428-4df5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778585410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778585410, "uuid": "ed69ff89-a392-46c2-af26-d8b26bda3a8e", "comment": "Malware payload", "value": "2c69c352da9e28d8259e7a071d546e07", "object_relation": "md5", "Tag": [ { "name": "103-43-8-214", "colour": "#6EFBCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778585410, "uuid": "05d8d23f-f07b-46eb-a11b-9eb2adb2ce5c", "comment": "Malware payload", "value": "1289526913999167d2ad4bcd5e65dd1148f2be60ecf6a5831e4ea42cc40d956d", "object_relation": "sha256", "Tag": [ { "name": "103-43-8-214", "colour": "#6EFBCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778585410, "uuid": "3a979ef4-9f21-4710-84bf-5f8293e1cf47", "comment": "Malware payload", "value": "8ef78bdcd433c5ed6e414e0268758abef4e079a7", "object_relation": "sha1", "Tag": [ { "name": "103-43-8-214", "colour": "#6EFBCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778585410, "uuid": "3845589e-38b3-45d4-8358-5d16b824cc85", "comment": "Malware payload", "value": "abc18dbc7be331b3adb334a575a86562bcdf5d47714a9d9a9e7b48bace2effe0ded2eb20bc279da3c57927c2b6e7a38d", "object_relation": "sha3-384", "Tag": [ { "name": "103-43-8-214", "colour": "#6EFBCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778585410, "uuid": "54cb38b9-02d4-4d10-ac44-463f009c92a0", "value": "T10726F047B89000FAD5AAD2348A665662BB713CA50F2157D33B10B7F82F73BE85E39354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778585410, "uuid": "a22b4939-3a94-4eb4-9edd-2db7b163e93b", "value": "29c78be06b08f1034fb52a93199307ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778585410, "uuid": "d11de237-81db-48cb-b13a-e03d21a1bbaf", "value": "98304:mJ/QNLNChxk1EnGpqUeSMBk7ig9nzGqk/UxrstHgCi:meNLNek1VpqUesOYiqfxrstHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778585410, "uuid": "4903982d-d191-4f76-a5c1-b918b37ef1b3", "value": 4707840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778585410, "uuid": "a927b478-0252-471f-90ea-f72ab02a1c39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778585410, "uuid": "2b05d6bd-3b07-47d2-9f31-83de633fd534", "value": "1289526913999167d2ad4bcd5e65dd1148f2be60ecf6a5831e4ea42cc40d956d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b6489a-4dee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778582367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582367, "uuid": "a2b7e42c-6dc6-43ac-8bc9-6d28d02df05c", "comment": "Malware payload", "value": "6ad3b2da43b3bd9f101078d38f2c9a82", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582367, "uuid": "e3fa24d1-5b23-4c88-8964-3f880167c437", "comment": "Malware payload", "value": "167ca6da628a0c8b525935caf10e74f195a58c3ab2aee7acf68303fe6ec73602", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582367, "uuid": "9f520eb3-a450-463c-95c4-5f42fa6283c8", "comment": "Malware payload", "value": "8986eb1ca973089c2c63bb17515f0d758bb0b934", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582367, "uuid": "a93be34d-19f1-4d90-81ba-002fa3fd973a", "comment": "Malware payload", "value": "e6b11ad4ac7325b1683a4981a2b62c01ffc0c2f35c56c1f7224a16a8ad77ace3b515d8eb823a33ec34b9aa5f56a9b2ba", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582367, "uuid": "528c5dc3-ab6f-433b-a9b1-9d7f50e1b5e3", "value": "T1A22619447AE2305003437A7A7B1FA0C6F13D089B354C8C5AF65CF9D06F9562AE6F6A78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582367, "uuid": "d08e18cb-991f-4d5d-8442-9010f1309b7b", "value": "49152:P126CoQ9JTiMDR/mWcMAsiaFD0eppIbfgvL7PiN8vds8KnHqvJOQHu/toKg4ae1B:nOFH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778582367, "uuid": "ce696085-b1f7-474b-b950-7b8ff222c035", "value": 4577792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778582367, "uuid": "523c46a5-a885-45ef-b54d-c412bab59385", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582367, "uuid": "085a89c7-2147-4bed-ae69-a355f66a71fe", "value": "167ca6da628a0c8b525935caf10e74f195a58c3ab2aee7acf68303fe6ec73602.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a957fa54-4dcf-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1778568971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778568971, "uuid": "95d78f04-542e-434d-872e-d213fe21a1c5", "comment": "Malware payload (NetSupport)", "value": "4863608a254ac25e5536ac25d85b1752", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "95-85-246-53", "colour": "#A58116", "exportable": true, "hide_tag": false }, { "name": "img-pulse-cache-com", "colour": "#9E63C0", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pw-fantombot", "colour": "#498CF1", "exportable": true, "hide_tag": false }, { "name": "pwn-fantombot", "colour": "#BC6C16", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778568971, "uuid": "b435d6fd-db7a-4143-9e2d-ae56d0a72c75", "comment": "Malware payload (NetSupport)", "value": "17910461ed11ec3a0fe037403c0eb4fe536e11d803c227e083f15e4bb76e8669", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "95-85-246-53", "colour": "#A58116", "exportable": true, "hide_tag": false }, { "name": "img-pulse-cache-com", "colour": "#9E63C0", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pw-fantombot", "colour": "#498CF1", "exportable": true, "hide_tag": false }, { "name": "pwn-fantombot", "colour": "#BC6C16", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778568971, "uuid": "4e02a4c0-a1a0-48f3-b6a7-4552befed51c", "comment": "Malware payload (NetSupport)", "value": "42c368608db44a8053edaae6fcb0f5423b736c50", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "95-85-246-53", "colour": "#A58116", "exportable": true, "hide_tag": false }, { "name": "img-pulse-cache-com", "colour": "#9E63C0", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pw-fantombot", "colour": "#498CF1", "exportable": true, "hide_tag": false }, { "name": "pwn-fantombot", "colour": "#BC6C16", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778568971, "uuid": "1ef02c45-e832-47a8-b7d2-5fbbfc00c9d0", "comment": "Malware payload (NetSupport)", "value": "15d8db2729ec190f7f4811d322b471219a0103bc35ef4664c1ee465d4ead7883f0a2e8f55da2eb5c8181b2de9d9925b9", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "95-85-246-53", "colour": "#A58116", "exportable": true, "hide_tag": false }, { "name": "img-pulse-cache-com", "colour": "#9E63C0", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pw-fantombot", "colour": "#498CF1", "exportable": true, "hide_tag": false }, { "name": "pwn-fantombot", "colour": "#BC6C16", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778568971, "uuid": "d56f2661-cd52-4c1b-9f88-c9618b077bd9", "value": "T12165339EC21C8ECF4C68D8DE78776FBD80A81379E78DB274538C60B954E4281C6D961B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778568971, "uuid": "41eebf1a-1797-4383-97bf-50b0798be95a", "value": "24576:GeQ5C/CC8hwBBxFvoLrOmRyIrSt3bJGV50TuJsDH4P5KZKt7VeOpBgt8rkxd07++:A79hDOmRyH3bJG3yusFoNpBgCrGCi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778568971, "uuid": "7be5e77f-ba3f-4bc8-b4c7-2ff481e08b7b", "value": 1527136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778568971, "uuid": "7c74c4c9-813c-4e07-b070-6d530d8550d3", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778568971, "uuid": "2ab0bd88-639b-4812-9d25-c935c031689a", "value": "AltPayload.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2d2536-4e12-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778597697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778597697, "uuid": "92ce4927-2f7b-400e-9a43-2d7f2d7ba7b6", "comment": "Malware payload", "value": "9a27e0f767f9bf89202f2f70ebfc8e38", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778597697, "uuid": "4e62ce45-2418-4533-afd8-3ffb08534125", "comment": "Malware payload", "value": "17c9ce8919ff1a55a0ad648071042abaa7c6b7b6d4672efedccb97c257d3ef81", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778597697, "uuid": "da646023-8282-44ac-be69-7602578cb280", "comment": "Malware payload", "value": "83e92fb3d396e0fe642f2c8d42b38b3efe5fc8ef", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778597697, "uuid": "cae32eb6-1bcc-4a3c-819f-236de53e8652", "comment": "Malware payload", "value": "bceba5746d7a3aa38a7f26cb336099be1a05ae97d4e73a539d459b034d8c106c1b90b17d8777f4a3b4c294e39cdf6a44", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778597697, "uuid": "17cf8c30-d2f2-48b9-b58c-f7d5ccb5a790", "value": "T1E941461236EA6A6140C74A82D0539D419617618F284B9E08B1BCD747BFF3B7DCB241E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778597697, "uuid": "41f1fcd1-e2ad-461b-9c72-a21b6f4f8d78", "value": "48:ocQ1j+ioj4DDrch6iM+qul/n7yt6rmlQ9gIfAv3S7XS7BrCuV:ocQ1SL8D26I5nA6C1hCud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778597697, "uuid": "d31b07e8-dda8-4dd5-b2fc-97c0691790a1", "value": 1918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778597697, "uuid": "403acdd9-460e-4798-b794-3132ec0f5cf6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778597697, "uuid": "40e9429c-2448-44a0-9b48-8415f7526990", "value": "clickfix1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3350db97-4e43-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1778618595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618595, "uuid": "4a32c131-5ae1-40a8-9954-4d5dc5a299e4", "comment": "Malware payload (ConnectWise)", "value": "1f009ff5b5932341862185f87f345f48", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618595, "uuid": "2e2706f4-a46a-4646-b13f-673e10713c5f", "comment": "Malware payload (ConnectWise)", "value": "19a515c467b15c845fde5916ef0d37052b92a31f8e495692cf3bb32dc13116d2", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618595, "uuid": "7dc9287b-d026-45fb-8f56-db9c01b189f8", "comment": "Malware payload (ConnectWise)", "value": "ef7dd8fc4f8749616ae3ecb59bf6b110a366c66f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618595, "uuid": "874dcd92-346a-4bde-9229-33437b7a1ce5", "comment": "Malware payload (ConnectWise)", "value": "fcdb762a64cfbb9c88e56eae2624df991a47c194cc1a12aa2b69a5f3f2f16d1270dcc74f8e89b7da6c1cd17866eb5459", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618595, "uuid": "818e23b3-f720-4b80-9fce-d0ce4149f463", "value": "T1DAA623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618595, "uuid": "1cb0dd92-3e36-48be-b731-224097722fc1", "value": "196608:LnCtVYqI5MvbWEpKkqeIJqKInCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkq6nCtO:TCXvI5MvHx6JeCXvI5MvHx6CXvI5MvH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778618595, "uuid": "21afc772-1548-44a8-a6c1-56afc22b459e", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778618595, "uuid": "8f2fadca-0b02-4141-814e-fc401e3841e8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618595, "uuid": "d02fe46f-4031-492c-bb87-c0d4d2c5d6fa", "value": "ScreenConnect.ClientSetup3.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff1958f-4de4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778577734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577734, "uuid": "4c8dfd97-4806-423a-bbbf-191634b5dc21", "comment": "Malware payload", "value": "c801a63a7c52cadfce98a1149a6d99b0", "object_relation": "md5", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577734, "uuid": "b7c8b41d-c73d-40d5-8f8e-ec7a53aeea55", "comment": "Malware payload", "value": "19bfff0d3fca8d1dae1874b2dc1cec0aebeca5c4b648422dd9b61e4ff2ff22a7", "object_relation": "sha256", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577734, "uuid": "75f45a03-94cd-4e21-aec6-7cb6a7a4b41b", "comment": "Malware payload", "value": "f34b93bf6111540232356b9e0b873d8eccc4b283", "object_relation": "sha1", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577734, "uuid": "9756a137-a5bf-4946-95bb-560038d0b84b", "comment": "Malware payload", "value": "0b8528236aa4541c491ab48ac05fae5e976489dc972ff272002f8a283fecdaaaf37d8d57149d1cd6cb66be390747c463", "object_relation": "sha3-384", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577734, "uuid": "d3ec6b01-f997-4c0d-8f6f-2cd55a3e4628", "value": "T1C227230E81154E52E6CBAFFD62992137513CF0342D1E54BBEF70DFA018A36A616A3DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577734, "uuid": "5d0e32b6-98e9-4891-bbef-180cb41918f5", "value": "393216:vM3TwH6u+vV9r1sCutXr/yG0wylSPAUaseCo14FI575UKV5EgPB:vMDwH6XV95pudr/yzwguWsG14Fy75rVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778577734, "uuid": "2e84b81f-8486-401c-b728-7f1bc7573423", "value": 20629873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778577734, "uuid": "d3627a67-b6f3-4939-8845-827810cac52e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577734, "uuid": "09da533b-80be-43b0-8c13-c3615c617655", "value": "DCM-T2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e21d68-4e17-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778599859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599859, "uuid": "93a176fc-7aca-4203-b35e-64bb6dbe1be7", "comment": "Malware payload (Mirai)", "value": "4c39b616efef54a0a0aa81e53e53fc0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599859, "uuid": "f4bd96b3-e5dc-42a6-a2d9-b32a28d14f3d", "comment": "Malware payload (Mirai)", "value": "19f66165fe621c3b813c57f18364e52d39c236d2c12a61c94c511744725001ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599859, "uuid": "2164e745-0e1e-4253-a12b-332d87cd2151", "comment": "Malware payload (Mirai)", "value": "0bd688d9ac99eb0dd4280c68e197fe41b4533279", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599859, "uuid": "fc4ee3d9-685c-4ea4-a586-e544b3c65514", "comment": "Malware payload (Mirai)", "value": "ca30b4eca78dc07b0ca884b171f6205829a9a1eefb7ed48583ca57bf8579e9e78c9ab31f14f02025a4b8016223f42b3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599859, "uuid": "28441380-6398-4767-b1f9-619467a0c1c7", "value": "T12BF47C46EF850FEBC4AFCD30452E834705ED999706C1A63861FC4D8CBA9D6A94FD3988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599859, "uuid": "f82cde98-f998-45fa-bf3d-f71d6c0e728f", "value": "12288:x1b1gSF8F0DZp5D7M0Gkvz/eV+44KAjrJQMbj4YmlqCb5XjHUW5MNjVRnxJLKQFy:avW4RTuhj0D5sfk3o6PdPIDX+gYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599859, "uuid": "8301a1e5-47ad-44c4-bb18-da09909338e1", "value": 729928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599859, "uuid": "d53d0802-5ec0-4085-be7a-6bb679cdf54b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599859, "uuid": "e92e6da9-9edc-4863-82f4-d2d18e012ebf", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d97674-4df0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778583033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583033, "uuid": "7dd49ba7-9525-444f-9e81-501f68650195", "comment": "Malware payload", "value": "bab4c0c5ffd26481d54ae3c242bf8a0d", "object_relation": "md5", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583033, "uuid": "50531d9d-59db-45a7-8759-08ff4127b0ca", "comment": "Malware payload", "value": "1a5312e2d4430ebc94f4489f3aeac0aa7c9604c4af6a7cbd06e1627eb02679dc", "object_relation": "sha256", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583033, "uuid": "c2922f04-95be-46e8-a7ce-0855c0beb68b", "comment": "Malware payload", "value": "1705e5da8bc79d784633db0078bad61adf8f4bf6", "object_relation": "sha1", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583033, "uuid": "0c53cdad-ee4f-4d62-aacf-30cf73ba8662", "comment": "Malware payload", "value": "e0839bdc1ac66c0b771ad697b1a5b13b606ff09a648a6f23f886fde6a30007231bfb6f860faec4316af1ed31654faea9", "object_relation": "sha3-384", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778583033, "uuid": "f8453b61-7fb9-4d5a-866a-17a63bf45188", "value": "T1FB117984318E4D07EABFA77817652A43186595B73CC145D61E5C09C019C71685F9BF4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778583033, "uuid": "b549800c-3b75-416b-abcb-df2ad6f66765", "value": "24:98a6R9Jpy4M3nX7ydxNweuOJhM/ggEa7Hpi9PFR9vn:9z284UXmDHa7Un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778583033, "uuid": "7e9accbd-04c7-4d5a-93f3-c96442bbabac", "value": 1065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778583033, "uuid": "197ad2c2-5574-4f06-af46-500c530acd7f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778583033, "uuid": "3d5499f7-149e-4eb0-80e1-f9c900557261", "value": "714152c0489c3d8d9196305efa12a6850e5d460ab62ff3be91caf3fb852ec793.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790b4b24-4df8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778586500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778586500, "uuid": "f882030f-d705-4c2f-a004-6e06ce6ae3a7", "comment": "Malware payload", "value": "fd98c91ec367ab933d71758aa1178230", "object_relation": "md5", "Tag": [ { "name": "84-32-22-130", "colour": "#27840B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778586500, "uuid": "0280958b-0217-4946-b40f-81407307a7b1", "comment": "Malware payload", "value": "1adb2edba3db414905d446d8a8d845745ce3c649e269d08957db7d957a0c2526", "object_relation": "sha256", "Tag": [ { "name": "84-32-22-130", "colour": "#27840B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778586500, "uuid": "01381ff6-4695-45fd-95b8-04063999c743", "comment": "Malware payload", "value": "7b7c0d27e6f8317e80f3460338dab9ccb4e5ada8", "object_relation": "sha1", "Tag": [ { "name": "84-32-22-130", "colour": "#27840B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778586500, "uuid": "af0de1f0-65f3-485e-ae9e-d456b465ba1b", "comment": "Malware payload", "value": "44056f50b37deb2fdb83f6c9828c451a42e119e42c0ea0942241b33175f0622d24b9208086160ff60948262d7e063b71", "object_relation": "sha3-384", "Tag": [ { "name": "84-32-22-130", "colour": "#27840B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778586500, "uuid": "ae249bfb-84b3-4007-bce2-236d7d63134e", "value": "T1FC123147A2D0CE3FC8D953384467122472B794BEDF629713064815B53F427E81E6EB8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778586500, "uuid": "57d5c1d1-b504-4654-9003-b7c94011ba19", "value": "192:GqnWWHFZMWT1Ymb7hrsnurfjTr8sbnsl:5WWF1YmX8Oe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778586500, "uuid": "9702f555-bf73-4dec-ab08-0ef0ef97376c", "value": 9800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778586500, "uuid": "0c348c89-1c56-496c-aa16-1f6e52f271f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778586500, "uuid": "b82cb9dd-5751-4f85-a137-958ee30fa214", "value": "1adb2edba3db414905d446d8a8d845745ce3c649e269d08957db7d957a0c2526", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a1cb78-4de6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778578842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578842, "uuid": "d4d2c862-1152-4761-9602-b6c2326eaf47", "comment": "Malware payload", "value": "18d15079078b543d792973f4f2bdc897", "object_relation": "md5", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578842, "uuid": "4234079e-4cf5-4de7-8e78-a4007f343051", "comment": "Malware payload", "value": "1b64d83bf86db293ea1204ee7fad62784858b537ec9ba7baff792926cb687033", "object_relation": "sha256", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578842, "uuid": "98dabaad-1130-4982-98e9-dbff35c8416d", "comment": "Malware payload", "value": "3d771feffa20cb1fd725a4068b990aeb9e9b3673", "object_relation": "sha1", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578842, "uuid": "0214c989-dec5-4209-a847-4b4142ee4055", "comment": "Malware payload", "value": "9fce0147715af303400696818816b68812a24a67605cf679c6d7615b4e50ec7998346c9773d7d7cf4309066caafa2ef5", "object_relation": "sha3-384", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578842, "uuid": "b331f567-3720-404e-be28-b48c7cbf17e9", "value": "T1ECB7AD0773E60195E5B3D2388AAB5203D773B8275730CBDF319D06552FABAD09A7A720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578842, "uuid": "cca98110-08f3-48dc-8dd4-a06b1723383d", "value": "ba34afa88020d21a2d934a3cc5b3f45f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578842, "uuid": "1be1217a-14ef-47e4-bd24-b2da55bb3328", "value": "786432:/6ov53y1oHAPUGAfM0gU/Xj/RC12xOjMtBLiVJDyW1KE3k1W:/h3y1oHAPUGAfM0gUvLRCYgMnivp9kE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778578842, "uuid": "6fd50b86-43d3-455e-80d2-055e876e8936", "value": 52010183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778578842, "uuid": "2a1580f9-f0ff-4cf7-884b-009ec6f3bdb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578842, "uuid": "0254c318-dd30-4b95-91f0-a64c7a57e925", "value": "1b64d83bf86db293ea1204ee7fad62784858b537ec9ba7baff792926cb687033", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c8139c-4df0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778582974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582974, "uuid": "76c250e3-2efa-4221-8ee8-be3e494ffa0c", "comment": "Malware payload", "value": "42627e8c8aabec5357ab38634402ccce", "object_relation": "md5", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582974, "uuid": "088e06e0-f802-457f-a17b-9016f03c8c80", "comment": "Malware payload", "value": "1bdb2c7fa87fbaeb40547e705c1e643e2c30b99b4ba1872b43ac88d5c6f8e5ad", "object_relation": "sha256", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582974, "uuid": "63d2f239-ec21-4535-8137-421f0f1670b1", "comment": "Malware payload", "value": "f907d65974267666b6d0781897066b79cea7602e", "object_relation": "sha1", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582974, "uuid": "55a44ede-a04d-42d8-8abe-f9a20e9ad745", "comment": "Malware payload", "value": "29f383bf0bb71b3de0d17c39b3bb0b59cdb9496f3dfd2e814d4bae11618bf416a59b240c80975a07280fa8809be0a920", "object_relation": "sha3-384", "Tag": [ { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582974, "uuid": "aec4d7d5-20e8-4122-86a2-064dc4a8684c", "value": "T1D425A01ABA2C4E21CEAA4B7DE351F73911392DD16F2AB015BB7437DD2D512C8C32528E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582974, "uuid": "01232501-0c71-4ffc-b602-79ccbaf9bb00", "value": "24576:6EMfSR20LP6ANEroF6tr1tLwnfM2L5UGAPZbJY1LUVz:xVRPlNKZ9wfbJUVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778582974, "uuid": "3bff63e2-be2b-4fce-a643-14e2ff4d9f15", "value": 996326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778582974, "uuid": "d315b094-3183-4a12-b2fe-0c4c265e1d54", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582974, "uuid": "053fa6e7-40c6-4f82-ad8d-a5a0dccc2efc", "value": "1bdb2c7fa87fbaeb40547e705c1e643e2c30b99b4ba1872b43ac88d5c6f8e5ad.whl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaee0162-4de6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778578960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578960, "uuid": "4173a55e-006b-4373-a8f2-dcec2f3dc173", "comment": "Malware payload", "value": "c7ce9a7e8827f3395881cc2392b0a9c3", "object_relation": "md5", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578960, "uuid": "2611bbe0-4ec4-416e-aa32-e6fb195f3a48", "comment": "Malware payload", "value": "1d0ec3cd5f2d9498c5520de38fba203b867fc53ae1e0f9935cd4df858a7f8769", "object_relation": "sha256", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578960, "uuid": "3caa42bc-0c2f-4bda-86fa-7fd4b312cf32", "comment": "Malware payload", "value": "edf91e0cfdc42d0dfe4eaac7dcd6ee2c8fee1d5b", "object_relation": "sha1", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578960, "uuid": "867f796e-1add-4b31-a861-e5bc3cb02e56", "comment": "Malware payload", "value": "054bd87e1b6067567ab6a7196165cfbb814028b674d9d00fd649c354daafed481ca6b9e35b15067fe84223d9f638352e", "object_relation": "sha3-384", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578960, "uuid": "51215da8-ae65-44d7-89b5-2840d3610b05", "value": "T10663E89439D63111CA77B1B4C68F62C1A529C01B211FD99CB49DE3B42FC49E9837AFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578960, "uuid": "8dfc5cb1-e4d7-4688-b821-6b8e1bb22a23", "value": "1536:HVbDqbBfgBKvAd2EPppfHORdVW0zH0ZdjxhWZy3EFnUQVXHXgfY33gdAey1K:AbWBKYwEPppfHOE0zUZfZEFnUN5d5y1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778578960, "uuid": "be8efe0c-7f08-41b7-9284-37de7deed09e", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778578960, "uuid": "d1e64c49-0f72-4316-abea-1be42882f6cc", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578960, "uuid": "a24b50ab-a27f-40ec-becf-7dc02aa4b718", "value": "e40d228bce67e2dd514b3cbebd49f42eb6609d5b247e7cc4c2473febdd471f02.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d470464-4e24-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778605297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778605297, "uuid": "8c5d9f8f-30dc-4dfa-b63f-b0ed9a3dfc25", "comment": "Malware payload", "value": "b6ed3e5a2d974c3d60f467e2304b6a5c", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778605297, "uuid": "a3c0afb0-f53f-4df2-b7e0-8b5fdaaabb92", "comment": "Malware payload", "value": "1df899c1c8802970678b687af5270a3dd7ebab24e1a89c8b09bf06e48c83ddc1", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778605297, "uuid": "26ddd840-3d76-490c-a95b-7c6d3cdb9769", "comment": "Malware payload", "value": "f01e46a02bef9f2b98336485cf2d26cfc9d41a9d", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778605297, "uuid": "9ccb7c80-a52d-4007-948d-4c98f430289e", "comment": "Malware payload", "value": "f856f05be218b101d312c314d3c4e9ad111dbc456fac98694d385dc49afd747d3be69c682dfac194296fbd03c019c6b1", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778605297, "uuid": "188f7d7c-239e-4326-812e-ed373cf36b50", "value": "T12FF4E18927E667D7C41E0DB2C53708DDA6F5C1B2C784CCBB3449512896A7FFA4C9B20A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778605297, "uuid": "f727672f-551b-4476-831b-1aeacc5bf022", "value": "2579ed69c926816c41b06d776353e23e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778605297, "uuid": "fc72e319-6fa5-41ae-b3a5-d105d7c162db", "value": "12288:pfGfpuiX1PhfSkR4YZTS312OhFcuffl8hYybAeUmIcO210weZqFM+:pfmPFiISFdTZfl4bAeUmB0NL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778605297, "uuid": "2b2a4a44-0eea-4214-8927-edd2808e2523", "value": 733696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778605297, "uuid": "75ef0850-6d1e-4d1a-81dd-0bbb723f423b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778605297, "uuid": "67e551a6-4932-4805-b083-30b8d79e38a8", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38fc98dd-4dec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778581238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581238, "uuid": "9eec645f-048e-4229-b321-6403c498f1f9", "comment": "Malware payload", "value": "8d254c5167bef16afd473854be5efde0", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "WebSocket-backdoors", "colour": "#D9D734", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581238, "uuid": "b12ef9e2-ff92-4507-ae65-1859df925729", "comment": "Malware payload", "value": "1e73dcc941fb0cd2fc3f4d05cda708eb8db3c03c4de23a2e13918877b81bb1c8", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "WebSocket-backdoors", "colour": "#D9D734", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581238, "uuid": "b411f6f7-23e7-4d7f-a5a3-b3546407583e", "comment": "Malware payload", "value": "25ea48f650d9819a86e3f8f869be7bf84b3895c0", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "WebSocket-backdoors", "colour": "#D9D734", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581238, "uuid": "b75e49fb-7b2e-423d-9a8f-e5e40c41f72f", "comment": "Malware payload", "value": "08c109d8b4f5d1889be0d2bc6f61daeff6817662837ca5c7551e547b3ded0f7354886b2672a0ebc79fca9c0b5bfd2220", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "WebSocket-backdoors", "colour": "#D9D734", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581238, "uuid": "aafccc84-b461-4510-b9c3-ec00bc9c0a3d", "value": "T178745C72D2741C38293B668ADC44BBDCB502AD03FA567574F2AC196CB7D2AF1113329E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581238, "uuid": "f68890ce-759f-4906-a30a-b537699e58bc", "value": "6144:kI9JSg9JB9TNHj+ZZTNmc5sVW+/0XErb5l:ktRCLMGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778581238, "uuid": "8ca436e8-b118-4fe9-83dc-65970eb1d24a", "value": 338354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778581238, "uuid": "0a4bf1e4-57f2-424e-8f55-dbfc64f8c7a0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581238, "uuid": "a775e0c2-4f3c-4d90-b71f-9d15e6bff539", "value": "1e73dcc941fb0cd2fc3f4d05cda708eb8db3c03c4de23a2e13918877b81bb1c8.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f25c10-4de3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778577665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577665, "uuid": "b01cfe8c-769c-46f7-a31d-3367078883ad", "comment": "Malware payload", "value": "1b30fb2a2c7c36a051784316a5cb49cc", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577665, "uuid": "2f0a5a36-f756-4168-b74e-697f15dbe3de", "comment": "Malware payload", "value": "1f1fa8037ced5faf824d59934d91ba2da14e54e0aa6618c5897234e7434f09f9", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577665, "uuid": "90bbd764-01d2-4aa2-86a8-5b6f4bffac88", "comment": "Malware payload", "value": "8cf34913d52c4255cb932d24106ffc4990e184eb", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577665, "uuid": "489bf9ba-bc3d-4500-8bb1-347eb4d78077", "comment": "Malware payload", "value": "666a99587b7dcbd2be40180a55d292a878e6af5347b12aa8a8732e507a2596152ec4329ea7af610715534a02014e39ec", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577665, "uuid": "803c8f21-f38e-4b23-8ec6-f76e47e9be91", "value": "T13825F165CB3B3FAD7C2D488D49BD6A4A498C1D332E21C4F2DDD7144B8228BDA5B7241B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577665, "uuid": "8041704f-395b-4e24-9989-fb960cf61916", "value": "24576:c37ikgocw3dFb3o3o3o3C3437ikG37ikgocw3dF33437ik/:gomLYYYSUiomHUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778577665, "uuid": "f55720d4-3855-41b5-80f3-b97daadad6a2", "value": 999430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778577665, "uuid": "62d70215-1391-4e7d-aeac-8c4c7cf8fb2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577665, "uuid": "4c377428-412e-49ea-bb20-af8e4f870943", "value": "up-t1.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e4a78b-4e33-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778611702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611702, "uuid": "2ee56ef0-789d-4d4c-b725-7e5c470649ad", "comment": "Malware payload", "value": "9ba82c8d6b63249fdb67a7551de6f4c9", "object_relation": "md5", "Tag": [ { "name": "CorebotStealer", "colour": "#EBCE56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611702, "uuid": "366c38a6-b65d-489d-882d-077ef474349b", "comment": "Malware payload", "value": "20b37966700cfadc72313c7703d230782da9ee3f2b95ac03dc48df101f9bfeea", "object_relation": "sha256", "Tag": [ { "name": "CorebotStealer", "colour": "#EBCE56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611702, "uuid": "022120f3-6f73-4087-be7a-c2d488ccca8d", "comment": "Malware payload", "value": "e30cc7b83cab4377f1833338026f05c7a5025ba8", "object_relation": "sha1", "Tag": [ { "name": "CorebotStealer", "colour": "#EBCE56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611702, "uuid": "961333b2-72ab-43bc-a756-942952ea9dbe", "comment": "Malware payload", "value": "305f7b3bd0be1b935d3d08d54adb083bbbbefbc718b03f4d32ba2b944f3ca96caa5a9f8b395f64c81320685b23f23170", "object_relation": "sha3-384", "Tag": [ { "name": "CorebotStealer", "colour": "#EBCE56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611702, "uuid": "22c55fca-6bfe-4422-a976-bee31250c63c", "value": "T1A513D716DE2790AFC35A9EB4D5030905DF72BCC2CBD1B6CFA7805CE60D65A94AB3E601", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611702, "uuid": "4fd7a865-775b-4b9b-bd56-2dbb46261df1", "value": "937fc9d53061b053c4a26e2db6319101", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611702, "uuid": "6b33e05d-5c83-4bba-8b48-50f6265dfddb", "value": "768:BMbvKSysbdowdl5kEpzBncbWaTLRKsBT3Ilp:SbvKSbp5zeBUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778611702, "uuid": "acba5622-47b8-4feb-85eb-7bff83eeaf54", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778611702, "uuid": "4146fb82-2ef4-4a00-bcce-62dad3f79caa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611702, "uuid": "28aff568-e532-4625-b8e9-dc70ee4e08ee", "value": "20b37966700cfadc72313c7703d230782da9ee3f2b95ac03dc48df101f9bfeea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44eae26a-4e3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778616477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778616477, "uuid": "69c5174e-e873-4cc4-90fa-29fdd0b8b34b", "comment": "Malware payload (Mirai)", "value": "7486607b38975033fc26dd1a394a9b6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778616477, "uuid": "cbbac114-3717-4677-975f-ee237baa2830", "comment": "Malware payload (Mirai)", "value": "213c705e9742072ffb93d7bdbe277450d8f191724939f166c15586c3a886c17f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778616477, "uuid": "cb2ebe11-2460-4002-a7b6-3dcc418f7ff2", "comment": "Malware payload (Mirai)", "value": "6fa8fea382ed225ed10ff736fae97b4f5150a7b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778616477, "uuid": "8f0314cd-946c-41e5-be96-99a04b4bcc9e", "comment": "Malware payload (Mirai)", "value": "6653cb9601e0971b332977deaf279be68e57bc23cb882e5ca920c339199966b5f5f6c3c0aa65c2c14c5d9bc00e90e4f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778616477, "uuid": "dbbfd794-0ae7-4673-a128-6c5d88f8866d", "value": "T17C549D57EB098CA6C19606F84ECB07481773C0004F1BDBDB7A2C76386EA7ADE9D56781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778616477, "uuid": "06f761f9-78fc-42a2-bc3f-55324bad39f2", "value": "6144:WeAhgDex5MFesyfIz42hCt2CWdqQrUfsI+wKrmOO4+:wIgBo42YYdhqKrmOO4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778616477, "uuid": "5fb53fca-d279-40b0-b210-ececb2f4d196", "value": 295284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778616477, "uuid": "76b9fd45-8cf3-4158-9d16-877906ae4c1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778616477, "uuid": "9e2a8bdb-53c3-4402-8a53-118dd6f26f33", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ced5f1d-4e43-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1778618611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618611, "uuid": "535e57f5-ee2e-4983-b48f-881bed1cb6c8", "comment": "Malware payload (ConnectWise)", "value": "9b0e1b43228ab916ce06620ebe8557ee", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618611, "uuid": "e893891b-e9e8-4980-aa5d-3e51ddc39ffd", "comment": "Malware payload (ConnectWise)", "value": "220fdadd79d2f19c296eda277619b55d89ffab34240f4cb820946f368552ea7b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618611, "uuid": "2b15e016-7758-4b1b-8750-a9caf73b5e28", "comment": "Malware payload (ConnectWise)", "value": "f617a038ec95c969f823b63e7647c2f2902efd60", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618611, "uuid": "3c47eee0-df15-43af-a9c0-29ab50ca4a04", "comment": "Malware payload (ConnectWise)", "value": "f01a31a7e1364fe17a04c4a139744f8ccda016e183340a3c785b8cc47312bc1bd272730c5d7efe452c5616fc5f684937", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618611, "uuid": "537155ff-dce0-4326-b76b-7c2bd6a3fb4e", "value": "T154A623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618611, "uuid": "6e6c4ba5-bcaa-4017-99bb-9351190a04e3", "value": "196608:pnCtVYqI5MvbWEpKkqUIJqKpnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqwnCtO:RCXvI5MvHxsJ/CXvI5MvHx6CXvI5MvHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778618611, "uuid": "c930665b-33c1-4d9d-97c1-422f16935d24", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778618611, "uuid": "264a537a-aab8-47be-baa6-e0b14ffadf48", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618611, "uuid": "6326935d-934b-4dda-b6c8-a064f6b6e134", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5208c0-4e17-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778599845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599845, "uuid": "37291613-cb9e-4953-ae30-747051ecfe47", "comment": "Malware payload (Mirai)", "value": "10e21933856a78220ca236c70e75e8d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599845, "uuid": "cb4965fa-4c76-4921-bdc2-df421b8cb78c", "comment": "Malware payload (Mirai)", "value": "226e679dd5c7b0c63d66afa5bd3d515f7d709d1d27bbbf180c021c987b387b65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599845, "uuid": "9c8bd531-bcf1-4069-b274-585a4c584e6e", "comment": "Malware payload (Mirai)", "value": "4b04658971d02e6459be05eaf18c75a0d21c0272", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599845, "uuid": "ceac9565-e4eb-4f7b-a042-bb48f2de2197", "comment": "Malware payload (Mirai)", "value": "b6ef12d508329691701966bafc94389f4ff65af92240343f43947d3bb8b3ab9817b23a8c774f11d085e35eaf537b97f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599845, "uuid": "5586bccf-54fb-4aa9-b055-5aa2d1c2ead3", "value": "T10B94E156F2472E43C9DBD5361446C2859B96FA6B33E383063B46957B382D33B4F29388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599845, "uuid": "f773dfb8-8b7d-400b-895f-59bd9d410ab6", "value": "6144:C3BoySQmav2tOLrO6bLzGuLsn1aNIm8hyomyyaL9m8M3N98p1ER3:TymYL6SLqrc+noO5m8M3j8p1ER3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599845, "uuid": "0dc8c113-88ff-410a-8494-075af5cea71e", "value": 424328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599845, "uuid": "c4169035-b4d6-4dd0-b144-2a33214f0b98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599845, "uuid": "aa18dc3b-ba4a-45d1-9d54-e7c16903055b", "value": "3atoNational.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a4bb2d-4dd1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778569772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778569772, "uuid": "b7ddb708-183c-4a44-8af9-f11381c7f12d", "comment": "Malware payload", "value": "fe98da5541f785cae898371cfb962246", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-apartuk-info", "colour": "#4E5A4A", "exportable": true, "hide_tag": false }, { "name": "XLoader-v0-6-8", "colour": "#0B1578", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778569772, "uuid": "3858a248-95db-4b72-a403-f6648b8580df", "comment": "Malware payload", "value": "232d219f26d5927f57edf90305f0c570d31a4494b76b5c6632eb863a112d0361", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-apartuk-info", "colour": "#4E5A4A", "exportable": true, "hide_tag": false }, { "name": "XLoader-v0-6-8", "colour": "#0B1578", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778569772, "uuid": "5d2c6237-b1f9-49fb-998e-b96b70db1ddb", "comment": "Malware payload", "value": "11c70c6a6532bcbfa0856a3e6ded4980d2c4c886", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-apartuk-info", "colour": "#4E5A4A", "exportable": true, "hide_tag": false }, { "name": "XLoader-v0-6-8", "colour": "#0B1578", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778569772, "uuid": "2c28444e-b818-4a8f-819c-9fd2a096b602", "comment": "Malware payload", "value": "9f1fbcee43a38925f7da9528ec882c188e6ea5f875f51de45c4ac053ac37c21d5931bd4636eb0de25ff3a4b9661538ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-apartuk-info", "colour": "#4E5A4A", "exportable": true, "hide_tag": false }, { "name": "XLoader-v0-6-8", "colour": "#0B1578", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778569772, "uuid": "9cd94096-979e-45a4-a31f-3af9b0cbd086", "value": "T1890502687266D90BC6A447B44870F5B943B86E9EB410C3968FDABCEF7AF6B044D10347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778569772, "uuid": "855e2e02-9981-4b7e-aa81-0908da86604d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778569772, "uuid": "03beaa3b-2e2c-4e46-8c49-5f28862043c8", "value": "12288:k0Up1ZIrKyVVeBHuP/Dg63fvMx+acCQNTmCTfE+/q0pvVGlEJpuQx7s31D:dU1Iex2MqMpcp7/mEJpuQx7s31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778569772, "uuid": "15df3389-b456-499b-88c1-f4e541852d7c", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778569772, "uuid": "12615a34-b4cb-4c2b-819d-589e4df97a42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778569772, "uuid": "b798f522-8116-4fc9-9a7b-5da6a01c3255", "value": "Quotation#21567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45eb8614-4df6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778585555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778585555, "uuid": "8c9b9c34-41bd-46ed-be7a-a3b54c9353bf", "comment": "Malware payload", "value": "2f01946138fc2e74e00d0892d86de060", "object_relation": "md5", "Tag": [ { "name": "103-43-8-214", "colour": "#6EFBCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778585555, "uuid": "8eb4f490-a4a5-43ad-99cf-ab37b4405beb", "comment": "Malware payload", "value": "23b7146762c3f3bf51af1feb5fa17b33e89bb51919ff1108717879a9e7283556", "object_relation": "sha256", "Tag": [ { "name": "103-43-8-214", "colour": "#6EFBCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778585555, "uuid": "60ac8635-802a-48cc-8fe6-160882e904aa", "comment": "Malware payload", "value": "70da1ef9794b00a5e72ee706174a08088ff185f7", "object_relation": "sha1", "Tag": [ { "name": "103-43-8-214", "colour": "#6EFBCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778585555, "uuid": "dd19256b-1a7a-4e3b-b917-2db2640887ab", "comment": "Malware payload", "value": "6f82eeb334eebaf71d17cfb03b8b04fd86f995b35db7595b500139b840e3ce6ab71e29f254d282e9618fe4f71b64bf1f", "object_relation": "sha3-384", "Tag": [ { "name": "103-43-8-214", "colour": "#6EFBCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778585555, "uuid": "09742682-a876-4197-982a-cdb70d49d38f", "value": "T199862807F85151A8E0EED234C6269652BA713C894B3023D72F50F7B82F36FD46A79366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778585555, "uuid": "836470a3-61f9-4567-833b-0c52d045c4a9", "value": "49152:tvMfhaIdcrb/TmvO90d7HjmAFd4A64nsfJ/0YMP1sxvUEfH1C9Myq1Pe1CvcpTXV:t0dpJIH18MlYCi+HEAZBRA98kF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778585555, "uuid": "2dbfab22-5543-410d-9308-3ba1eb97cdab", "value": 8138812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778585555, "uuid": "8c08813d-d7df-497d-b3ab-1d5cc9eb155b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778585555, "uuid": "dfb22c7d-2b9b-4189-9e90-904b02ed269d", "value": "23b7146762c3f3bf51af1feb5fa17b33e89bb51919ff1108717879a9e7283556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd9bf63-4e33-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778611711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611711, "uuid": "5d28587d-3a23-46c7-b04c-a4516bda4e2e", "comment": "Malware payload", "value": "28455cd27e1545727984df6a2dec87d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Windows12Ransomware", "colour": "#B24178", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611711, "uuid": "213c17bf-49d4-4f7e-8223-644fd93a55d2", "comment": "Malware payload", "value": "240c9fb3d208c27d4422f1b1cbe30ff705b05644f63909b9ef57ae27832d9ffc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Windows12Ransomware", "colour": "#B24178", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611711, "uuid": "818c7aa9-a92c-4e6e-b31b-08c65bc6ed6d", "comment": "Malware payload", "value": "c01ea0aaeb78c89d2ca660640184782039cf036b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Windows12Ransomware", "colour": "#B24178", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611711, "uuid": "a8027ca6-1d41-4d93-9ca4-2cc48044d9a7", "comment": "Malware payload", "value": "3181cfd682cc63f60d4242fb81aa80c6ca5d718150c126ed792b57bc2d07471c2175740cabb1312f557f878984b89a80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Windows12Ransomware", "colour": "#B24178", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611711, "uuid": "1c50ce52-a0bf-4bdc-bbca-56b5c939c59b", "value": "T1CD93B51B77A820E7E5B2C1399DAA1256BA73702013315BCF450C0A79DFB27D87D78B86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611711, "uuid": "f5f44bbd-5867-44e1-ac62-eb92dbd10650", "value": "e09a3154c0727084397aef5994899949", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611711, "uuid": "f957e81b-3243-4310-90de-f3ce8c310c9d", "value": "768:YKSfGkiwO9tcPr0mI51yHZd5GNRV8RM+XemLxBPOtJfUVAH:NSHi4PrfqIBGNRVYBoJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778611711, "uuid": "79b70c45-0084-443d-85ea-03106144a534", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778611711, "uuid": "d18e9c15-6c99-43b6-8846-9748e2ac37af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611711, "uuid": "d16fb38c-1452-4450-add2-e35006868e33", "value": "240c9fb3d208c27d4422f1b1cbe30ff705b05644f63909b9ef57ae27832d9ffc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a06330f-4dff-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1778589401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778589401, "uuid": "ac6b70db-d6e6-47a3-9594-a2c678253107", "comment": "Malware payload (ValleyRAT)", "value": "bf24145678e2212e644837d407427328", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778589401, "uuid": "cf1aa1b4-7c40-4e14-884f-eeb976ebce1f", "comment": "Malware payload (ValleyRAT)", "value": "26b834e05be5c769fbaff016f9a72bde7df32b83bc10116db42838a4792b1726", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778589401, "uuid": "2872f06e-0885-49a0-ba0b-2158630faa9e", "comment": "Malware payload (ValleyRAT)", "value": "93ab674ffd7967b21d49a8608e5c93e282445eaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778589401, "uuid": "74a0c14d-dcf0-4a08-a80a-d2995d59b20a", "comment": "Malware payload (ValleyRAT)", "value": "c15108166c80c767cffddbc8b395c7ac44b928b9fae5ec5e59a61177ebfb433531f5c1aa24ce00aa157d65592bc91a1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778589401, "uuid": "a105b4bb-c843-4019-b8c3-e8f0d831758e", "value": "T1AD150816F735E0A5E26BC0B4A2635B72B6347C0C6128A333CB99F7617731B189DAE711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778589401, "uuid": "5095baf5-17d4-4ef0-9bc3-74d90890a1cc", "value": "88964abb1ae69d582d0f0b22d62fa582", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778589401, "uuid": "19ce0e72-cba3-40f3-a359-3076db0379e6", "value": "12288:WstN1rAWhdncY2LtJw9RPbs18/kdkt3n3njjjjjjjjvv3netg:W0dncY2LtmsWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778589401, "uuid": "800d7937-c915-426a-aa4c-63a904797fdf", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778589401, "uuid": "4f06b44c-0d2f-4f8e-a797-5c335c019fe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778589401, "uuid": "d52443c1-6bea-443c-b33d-b65919b478ba", "value": "2026\u7b2c\u4e00\u6279\u4eba\u5458\u4fe1\u606fpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c19684c-4e39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778614422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614422, "uuid": "261d94fe-461c-43f8-8b6d-20e74dbd88c8", "comment": "Malware payload", "value": "b9e2fa8c6244887876c7a5aa4ddbdfc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614422, "uuid": "5a40f75d-3ecb-4aff-8ecb-955c9afff236", "comment": "Malware payload", "value": "27d131c85d9f3ee3c0105aa1e633f7aab108f570a22e4b9d3f9810ca8845abf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614422, "uuid": "16425c09-f04b-4aba-bc6d-e12ca6b6a6e6", "comment": "Malware payload", "value": "1bd55f582c989afc53b6de51437b40ced9432866", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614422, "uuid": "113c92f5-3e07-4006-a9a3-703534d462bd", "comment": "Malware payload", "value": "f540931580881c3ff8d4d5f32dc033638f5e24be43b6ace878e9dc0cb71e9a55b5dab69a24076880f678679f278db3e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614422, "uuid": "adec9efb-2b43-41a0-b57f-b7e9ad7c3b09", "value": "T1AEF31985FD419F22C6D6227BFB4E428D372A1768D3EE720389255F24378A95B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614422, "uuid": "9917d026-7f64-41b7-b019-32f7eebbfe5f", "value": "3072:oje6vYteEM3jO6yjpvB/AANEhA4Z01s+Vwf942FdzH:ojfYtfMfQwA4v+V44MNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778614422, "uuid": "9b69d121-65a1-4c1f-95f4-efc4cdaee159", "value": 162736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778614422, "uuid": "5ffc75ee-eec0-4576-be15-8113a1d04985", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614422, "uuid": "3caf5ea5-b58a-46ee-ab24-d4aa92fd0c18", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e6e759a-4e39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778614346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614346, "uuid": "8dc5e8bc-6d20-48eb-a213-d7c13ae883c2", "comment": "Malware payload", "value": "959d1327b22beb1ca03720895afd1bc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614346, "uuid": "133c997a-2481-4451-ac58-c536a6f1472f", "comment": "Malware payload", "value": "294fc9cb44916b1b3a7619c57215f2db8ab28d55bad1ef653dd40d0ad5af120f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614346, "uuid": "2b25177d-c01c-49a9-b648-daeb77776bd1", "comment": "Malware payload", "value": "1049bf9fcca48625db5a5a4870976021837cb668", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614346, "uuid": "75c7c58e-1fb9-4e3b-a2a1-139eab84498d", "comment": "Malware payload", "value": "4768788cc604862e1b08e64bd14170c1ef926add5b24eeac6ed3f3373960cfadac23cb7b1fd5091ca999e44364dd9d15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614346, "uuid": "35ca2d0f-4deb-4136-904b-cc3032acee44", "value": "T1004302E010EB441AB9799E76787E47913D888920F26FF0673B499BE45FC0046976F21C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614346, "uuid": "6d0d078e-bf54-426d-890c-9d41610ad6c2", "value": "1536:Y2hfJN7UpZMNNiFlj9TLniX1locY1XRkJPUqI5:B5r72GN0RpiX1ylRbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778614346, "uuid": "3820d823-acbb-42b0-97dc-df7f31f291ea", "value": 59700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778614346, "uuid": "32152e2e-30b9-432f-9a78-9c078be2c62b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614346, "uuid": "3afe5972-a6ac-43d5-944a-06a528fb684e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d896e9-4e33-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778611696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611696, "uuid": "173e03c7-19cf-48d5-8106-a6247c6ce785", "comment": "Malware payload", "value": "2993afc160cf0aa1f91dc65acf8dbd9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WoolexaStealer", "colour": "#62B215", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611696, "uuid": "089848e5-39a8-46d6-bf07-cd86421d0819", "comment": "Malware payload", "value": "2a20b17d8ef5965e1a7d841146f95aa912828164857b082e8f59c1d1700612e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WoolexaStealer", "colour": "#62B215", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611696, "uuid": "d927a3c5-456c-40db-bb45-e41563506761", "comment": "Malware payload", "value": "b806fb85f5bf2d491175968d4202d25cc33a2926", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WoolexaStealer", "colour": "#62B215", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611696, "uuid": "8b60a6dc-ed90-4fcb-9ada-95ee20cd5f63", "comment": "Malware payload", "value": "55f7a49d62e3b61f10f42326f16982ca0605ea6b10470c2dad5b2c766db0af80baedc1a6a27a5635b300434e16be29de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WoolexaStealer", "colour": "#62B215", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611696, "uuid": "8960ca6f-728a-4306-a394-064a34553ffd", "value": "T18EF32750B7FA1402F5FF6FB9A9B216148B36B8679931DB0D0D8650CD0A72BD0A912F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611696, "uuid": "4b688675-b2f3-44f0-9501-1fc686db484e", "value": "3072:E/c/Hykx0CFL/ZIN4jGeP432BnM2Nji8VhQ4bZA36MtMf:EuHy5xNwV6iQwZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778611696, "uuid": "51880347-d98f-438f-9786-cac0755e782d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778611696, "uuid": "6698ee2a-69ef-4043-91cd-dfb144bc8e67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611696, "uuid": "578d41a2-2c82-4eb3-a198-3f161c2db228", "value": "2a20b17d8ef5965e1a7d841146f95aa912828164857b082e8f59c1d1700612e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b7af3b-4df0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778583085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583085, "uuid": "cade8735-a0b0-4207-b3ae-b25cb5e13c8a", "comment": "Malware payload", "value": "bb53981a50b3159314fe332788383bf5", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583085, "uuid": "f77261c9-d1d4-4499-8124-02ce0f4cb0f6", "comment": "Malware payload", "value": "2a314ea8be337e1ca9ec833ed13ed854d9fd38bce0a519cf288f3bec8d9e6f30", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583085, "uuid": "7df54bb4-b606-4cec-9073-e34bfd1b2e74", "comment": "Malware payload", "value": "86ac0619528c02e87f0e60d362992aa6b955d2fa", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583085, "uuid": "922a5c20-9d4e-4d3f-9946-6b26c279c555", "comment": "Malware payload", "value": "50607f9b2862551f118ebc2565de13c48e12704ebaa8caf10f9feb52f618eb9c665624bb5d1c59dc5386bd7196aa33a2", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778583085, "uuid": "9d80d7c4-c04d-4792-81bc-160bb77981ce", "value": "T1F821122909106932818B87F1719491B0277B9A071E5378A4F3BD6978CF9B69C55B873C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778583085, "uuid": "c0d4c356-1ea8-46bf-a8b0-20d7cb7c5812", "value": "24:jjtpzHU+XZlNffm6Zl9iArR4UnLl3PyFAc0hutue21q:FpxXZlNffm6Zl9iA99LYFP0QYFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778583085, "uuid": "a7fc1826-473a-4e4d-bf55-1f3dd691fb0b", "value": 1206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778583085, "uuid": "9405acaa-3d5c-4898-ba5e-5c1d6d14a405", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778583085, "uuid": "bb8c6d22-9355-4ddf-8e3e-199571af9f28", "value": "__init__.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db07e7f2-4ddc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778574638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778574638, "uuid": "a06a2892-69e8-4a4e-8c40-bee098bcb8fd", "comment": "Malware payload", "value": "790ddb0fa1ea232f695082feb15be8a7", "object_relation": "md5", "Tag": [ { "name": "172-96-172-91", "colour": "#24B0B4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778574638, "uuid": "af1b98ae-32cc-45d3-bc20-db62e2fff251", "comment": "Malware payload", "value": "2b898db93c737c39d2fd6f5e19c93d536a1fa320af24c952501c3cb1b95209a0", "object_relation": "sha256", "Tag": [ { "name": "172-96-172-91", "colour": "#24B0B4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778574638, "uuid": "111a0872-ad2a-4084-a9c5-6ec962d75a27", "comment": "Malware payload", "value": "cbaef424c44c67359fadbc35f9fdcc31f0434d05", "object_relation": "sha1", "Tag": [ { "name": "172-96-172-91", "colour": "#24B0B4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778574638, "uuid": "dda0697f-e8d4-4544-92fb-c9e0ce7daf4c", "comment": "Malware payload", "value": "c4020d4a0c709421f36a17297e49032f362f100ecb849846ad107f70016a7c0a6bab37cfefd7454f3aa4f2cfeab0748f", "object_relation": "sha3-384", "Tag": [ { "name": "172-96-172-91", "colour": "#24B0B4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778574638, "uuid": "f4f81c24-531c-4f7d-bffa-01006c6a348b", "value": "T159532B9F7710746586BB15E5A30F520ED037681AF10284B278ACD4D856F5FC822EBFEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778574638, "uuid": "f3dc7982-7519-4618-88e8-d924903a7ea9", "value": "1536:3NZG0dZ7/uuNDqJtygSFGnZ63Lwf49iFP:dZDdZ7/uADqJAGnZ2xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778574638, "uuid": "a9681fc1-e77e-47cb-81c4-b07ab9e2f47b", "value": 65585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778574638, "uuid": "64871082-6f15-421c-9582-b43ff65d3e95", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778574638, "uuid": "9d8e1f87-5e4a-4011-b8e8-fc35e51e8f71", "value": "2b898db93c737c39d2fd6f5e19c93d536a1fa320af24c952501c3cb1b95209a0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e16114-4dee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778582169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582169, "uuid": "eababd8a-9660-44a5-b4be-8676794f1480", "comment": "Malware payload", "value": "b82e54923f7e440664d2d75bd31588ca", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582169, "uuid": "5ac66f56-db39-4ebd-822f-7f6a9dcdba4d", "comment": "Malware payload", "value": "2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582169, "uuid": "c9145f5c-cfce-454f-a470-4c5bf8b9daa0", "comment": "Malware payload", "value": "e7d582b98ca80690883175470e96f703ef6dc497", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582169, "uuid": "d7232f0b-9418-4e26-8714-ed377cb5909a", "comment": "Malware payload", "value": "643706c52d0ddfd6a538d7f5f9f378f8dc4496c104b1747dd8ce59f444fa3e7b9bbdb97d933bc83f5a1ad1553779b42b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582169, "uuid": "afd684d1-f3c0-4087-946a-ad4746c78e79", "value": "T1BBB5718472C078901347AFBB772FB0D6E52E09E939880C4BD218FDD0B5A5617EAF6935", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582169, "uuid": "04c5e700-302f-4cd5-9961-ec1eceb134bf", "value": "49152:e126CoQ9JTiMDR/mWcMAsiaFD0eppIbfgvL7PiN8vds8KnHqvJOQHu/toKg4ae1X:Mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778582169, "uuid": "be837bdc-26b3-4cb1-bb16-59bfd08a5256", "value": 2339346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778582169, "uuid": "6dbbb633-e31d-4801-b7f5-750deead3e91", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582169, "uuid": "edc0c036-aa6a-4098-b1b0-92a9639443e0", "value": "package-router_init.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e414fa-4e3a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778614709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614709, "uuid": "13ad6476-419e-4d3a-a08e-817dfce42d8f", "comment": "Malware payload (Mirai)", "value": "29ce355952d66b8c6a06c6ee3d1b5e00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614709, "uuid": "4bd6f365-5c15-4a2b-a6ba-0849e08ace85", "comment": "Malware payload (Mirai)", "value": "2f097c40a96d0c4e9eda07767ed6df6ec1d00c8df7123ec4715df6932031dba0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614709, "uuid": "6e1c4c2e-6185-47d5-be14-0a7af046c66e", "comment": "Malware payload (Mirai)", "value": "cabdca0f467929e1567f6b742fb277baf9fa553b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614709, "uuid": "e57a1849-3a0c-4d95-a102-e184c5659789", "comment": "Malware payload (Mirai)", "value": "5b9dea787abc369a62950e585d15467be40718851723f8eb8f918d186154888dde38a9fe03e1df0cbb0747c5e46b0915", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614709, "uuid": "166c8128-7f2f-4d9d-9c52-a7aa57a28ece", "value": "T1A4D37C33C8296F58C555D578B0308F792B23A5A192471FBE5AA7C2B58087ECCF905BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614709, "uuid": "b1a3e08c-15f9-44d2-9bff-c37354abd378", "value": "1536:D/ENjzMBCVUvbJChQrx2sPBvTJj9uXtm+LCjUKv1ObVdPSSfo9KWMCfpaY6hV:DsRABhJEwx22Tqg+LGbvGPStUWNfpWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778614709, "uuid": "b5a8802a-e15c-4e94-9b0c-8b25c9f13f31", "value": 142144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778614709, "uuid": "5323a2de-c061-4f18-9973-8f2c4b53831f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614709, "uuid": "944e95e0-21c0-4d8e-84f7-dfc40ef10430", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a66856d8-4dca-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1778566819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778566819, "uuid": "94fb4972-dfb9-4973-9bda-0a6fa4fe82e5", "comment": "Malware payload (NetSupport)", "value": "535c6655c8b796410e1426a0f929044a", "object_relation": "md5", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "jpgomd-com", "colour": "#EF52AD", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pgrsv-com", "colour": "#2ADE9E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778566819, "uuid": "13b40457-27de-4296-a4f3-36f7c372466f", "comment": "Malware payload (NetSupport)", "value": "314555fa0e1f2a14f835e7836edd88da9b518ac4149615e764bd08d952fd5d7b", "object_relation": "sha256", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "jpgomd-com", "colour": "#EF52AD", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pgrsv-com", "colour": "#2ADE9E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778566819, "uuid": "121c6287-cb57-46e0-b454-6c6cfcbc6156", "comment": "Malware payload (NetSupport)", "value": "ca658edf454c927ec56e091ac977a00f44978deb", "object_relation": "sha1", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "jpgomd-com", "colour": "#EF52AD", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pgrsv-com", "colour": "#2ADE9E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778566819, "uuid": "c83e870b-7b7b-4c0d-9dd5-609930b8e482", "comment": "Malware payload (NetSupport)", "value": "7423a95171f2cc27f123ec3657dc008243412ca9422763651d347c4e224d274999c3a5b5d1dc85dc4867dd3442e9f9bf", "object_relation": "sha3-384", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "jpgomd-com", "colour": "#EF52AD", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pgrsv-com", "colour": "#2ADE9E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778566819, "uuid": "85e70066-179d-4e29-a125-5fc009e66d40", "value": "T1CBA5339A9A0988DFC95B4F74C10B5E2AD33E3A41F1AA7080F6724252CC89BDF57B471D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778566819, "uuid": "dd276c3d-fef8-498b-b282-81c5369a0107", "value": "49152:JmWKcquaZYrp7FnOVnJTmm3F+WVcBdj3b2+3bw/0JBAThAnP1N9V:JZqu+SBO/VYj3b2+30/wB9VV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778566819, "uuid": "7732e622-e378-461a-8602-717c5bcd6fd5", "value": 2202137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778566819, "uuid": "d0c4f600-2ba9-43d1-8971-8138516bee18", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778566819, "uuid": "bba1ebda-4485-420a-9ecc-7b4590837bae", "value": "AltPayload pw fantombot.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a95da2-4de1-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1778576745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778576745, "uuid": "c4f94f98-12ce-418a-b0c0-6bc07981fb0a", "comment": "Malware payload (QuasarRAT)", "value": "42d131bec2ca2d47954c4d56771124d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778576745, "uuid": "6ca618a4-e4ab-48c9-bd96-d6ce4312804a", "comment": "Malware payload (QuasarRAT)", "value": "322f1fd8fe7bd2e929bd8ed40194d7ea64a13747cbb16060cfd848f7023c6a16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778576745, "uuid": "78d586e3-f166-40cf-b54a-169f73600ddb", "comment": "Malware payload (QuasarRAT)", "value": "e9aa36fa4acd62e01f74e0c27309cb4a7690fca3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778576745, "uuid": "f2d644ff-86f1-45e8-9804-57b5438eb1c2", "comment": "Malware payload (QuasarRAT)", "value": "a551a45d74e27c040b6a1366300123404b841bdd9f67ba4edd2d7d38bcc1809685ac0b388036b9bd49889180e837935c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778576745, "uuid": "15212c3e-7ccd-49bb-8c9d-0a81984fe611", "value": "T180E55A143BF85E63E16AD773DAB0501663F1FC2AB363EB0B6191677E1C53B4058026AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778576745, "uuid": "abce2fe8-532a-4969-9398-e14cf83725e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778576745, "uuid": "b5fac000-0e91-45d5-94bc-8f4f846de658", "value": "49152:ovDhH2yMaO9FiPdl63sDhaBsAYmuBcPMftBoGdFTHHB72eh2NT:ovVH2yMaO9FiPdl63sFaBsAYmuBci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778576745, "uuid": "79e5d9e6-e197-47a0-9065-a76f5bc4aacf", "value": 3295744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778576745, "uuid": "e71d8c6d-6008-4f61-bfa4-771ed90426bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778576745, "uuid": "f0ba0a14-2c03-4801-9e7e-172b7841365d", "value": "322f1fd8fe7bd2e929bd8ed40194d7ea64a13747cbb16060cfd848f7023c6a16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e90d1ca9-4e15-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778599143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599143, "uuid": "b98e5630-558f-404e-a542-5ab686895251", "comment": "Malware payload", "value": "c9184c82c3af20da6ce4ceb22cd149c5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599143, "uuid": "5c30f869-354b-40db-ac8b-b6450a0d9949", "comment": "Malware payload", "value": "33216d5deaf169263ff67c9e2f6cf1c3ced380f8a03c01c403e685c227659a5b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599143, "uuid": "68625401-d79f-49c4-8701-9505baf46241", "comment": "Malware payload", "value": "aefb61951aa45792126cd5cebf9cba37fee5f45a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599143, "uuid": "1643e15d-a3d8-4f1e-83da-851cf7bc9126", "comment": "Malware payload", "value": "a9b10f72290818bd02b9c5eb1a3c8a3a19b41ebc91e3d50060f89f8e92de7241f4dea00b30bbd476af9131908e837ffe", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599143, "uuid": "8783b681-8fc0-4b03-a5be-9050c95b4c5c", "value": "T143926C0FB9518315D5C00474A5B2873FD6BA9476338454EFFBD88ACA1B682EAF83215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599143, "uuid": "4be0ffdc-f5b1-4330-acf6-b008ecfbdf73", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599143, "uuid": "3b368ad6-9f28-4a34-8d0e-14dbcf53500d", "value": "384:iIkjLVlvadxqSDO5wZT0vu98t2rFJ/Bgav8U9ctG:Cqx3640G9oJa0UsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599143, "uuid": "5ae5069f-bef3-4139-9f31-cb438d7d91e2", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599143, "uuid": "302302af-c620-4aec-944d-9cf34f1f0438", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599143, "uuid": "9875c269-a6b3-4c9a-b57b-f0cd5bc254f1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8baa5831-4e34-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778612301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778612301, "uuid": "0718bda4-eaf2-4092-8592-7907e524e1fa", "comment": "Malware payload (Mirai)", "value": "3d58c65701115703af29e92f3afd95d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778612301, "uuid": "0bbba146-f0e7-4809-9bd5-7dd0f5d40484", "comment": "Malware payload (Mirai)", "value": "333603e5d95ba99f9c142fce3312c71ae1e44eb179b70a25af744b72c162ed0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778612301, "uuid": "ce92f93c-0172-4507-bf57-96c7109e723b", "comment": "Malware payload (Mirai)", "value": "08658f88b545816f9a5d979eaf3e6e6b3966c114", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778612301, "uuid": "fc87dd92-6c15-4860-9653-ec221cced2b8", "comment": "Malware payload (Mirai)", "value": "f6343c4f807032da4342386887c35acc03e8c1523105d1f466f9b09f1cf86723a759d34cdd02b670e15a7abc55a6dc94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778612301, "uuid": "56c63c91-c4e3-4ee2-a397-82ea1c38e42a", "value": "T12AF31941FC514B23CAD612BBFB5E428D3B2A17E9D2EB72039D216F21378695B0D37642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778612301, "uuid": "8e9dc50d-3965-43a8-8efb-3a411880b622", "value": "3072:Qqpwv+ATwuDLAQhlJk38faD45wmVP70KJyA/jyvCln:QqpwGQlJIZD45ZVPIKJ17WCln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778612301, "uuid": "c0a151f8-bb70-4bcf-be02-74f3e6d031d8", "value": 158496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778612301, "uuid": "73926bd3-cc6e-48dd-842f-54703a902bd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778612301, "uuid": "a9302934-001f-41fd-aca6-7d4175d5c7c8", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1609739-4e36-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1778613223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613223, "uuid": "403d52f1-6d97-4a4b-b135-c9c720e12326", "comment": "Malware payload (Gafgyt)", "value": "3cb371354f10e99bf4bfcf76d3c48307", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613223, "uuid": "fdc0a3f7-e8bc-4334-bd82-8048e2a3b38b", "comment": "Malware payload (Gafgyt)", "value": "35013d6c539890686e65ba7d93917588976dff97be35f44b876d8733e8a06ace", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613223, "uuid": "2235ade9-11b4-41bd-9b8a-080c9d31bb89", "comment": "Malware payload (Gafgyt)", "value": "6e81b63270afdafa7386d050374102494cb7d6a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613223, "uuid": "1fdde0b9-0129-4bda-a0b4-863e8d89e4d9", "comment": "Malware payload (Gafgyt)", "value": "f62befd67771390c999d35814cb39289587de51c02a8e0009c47994e2fe9caa773848dbc11c93e564db1bc4c45b3ee06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613223, "uuid": "0d34329b-dad7-4473-925d-10e691a1c157", "value": "T1E3B32A17B9528B02C1C215B6FB4E564976136BFCE3EF3212C9249F603B874DB0E2AD51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613223, "uuid": "6a664740-3f0f-4374-afc4-30c9b1963563", "value": "1536:KLnB+r4MiIGsp8jUQh5sl+aranNTffIpP1MfirfA6RJZPHjRS5SY45h0pQBAr:htJpEr7GaNz6fA6RJZPHjwwN5h0pQCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778613223, "uuid": "12ba3bbd-8a4d-4a82-8d97-a7756bee2bb7", "value": 116124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778613223, "uuid": "0984ec5e-1550-4305-b493-1ae4da1fb70d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613223, "uuid": "e69f5bfd-8d13-49f1-9cb3-5b261d1ba28a", "value": "FBI.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c6b6d0-4e36-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1778613227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613227, "uuid": "46901250-725f-4035-a7bc-1a706ececd78", "comment": "Malware payload (Gafgyt)", "value": "5f8cb5737c4a5b51ad4ae995ae5b07f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613227, "uuid": "3c41896e-da74-40b9-a6db-2c8090d78da2", "comment": "Malware payload (Gafgyt)", "value": "3526ab4b9b4a61adb8e8fecc11d9a15f50447042e5b8efe1e5ed57af16cd7a1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613227, "uuid": "eee10f44-786b-4e1f-ac5a-cba9d7b46a91", "comment": "Malware payload (Gafgyt)", "value": "713eb42bbb31594e9a8f952a33e24eed0bcfbc6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613227, "uuid": "57ddbd53-c408-4aee-8e95-1527f29ff0cd", "comment": "Malware payload (Gafgyt)", "value": "b79cfe7480a969bec73337d05343fb398dccdf7956d4073659a4bbf295734a69ac1a567dbed4e6648a6e1abfe2f62318", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613227, "uuid": "5d2a9f9c-c41a-4f11-a0d4-3619be05eb3a", "value": "T1E4E3871E7E21DF7EF559823047B38E30969836E636E18585F26CE6481E7138E241FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613227, "uuid": "e852b978-baa2-40f7-8524-70ef49bbb9e4", "value": "3072:z7ip4E6s1gSpuIgQiRxaukCEAweIcqs8Ek32o4KqKf5hspYt:z7iV6s1gSpuIgQiRxarOCZHBb7qi5h3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778613227, "uuid": "c9f5d925-b732-405d-9446-b82016186c82", "value": 148064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778613227, "uuid": "f6ca2d2b-b993-4eaf-b304-9a9e827d4008", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613227, "uuid": "92628a00-4021-41a9-b932-e84f8325d260", "value": "FBI.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d65a9b4-4e33-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778611713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611713, "uuid": "252e3370-1c9a-4875-be45-859d555e7441", "comment": "Malware payload", "value": "93088380940f6812fc2721f9540e1b10", "object_relation": "md5", "Tag": [ { "name": "BallerWareRansomware", "colour": "#3F1614", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611713, "uuid": "d0a200ad-2f2d-4828-836f-07a799cf7978", "comment": "Malware payload", "value": "3537c553e7adcb6731c775edb9f64b1e9a342e96ef1714bf1235f6ac1a150795", "object_relation": "sha256", "Tag": [ { "name": "BallerWareRansomware", "colour": "#3F1614", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611713, "uuid": "6042ba20-4c2c-45da-9d41-c835097e2ee8", "comment": "Malware payload", "value": "23b4b0e6c81e6ec04da72aded5d490660c600175", "object_relation": "sha1", "Tag": [ { "name": "BallerWareRansomware", "colour": "#3F1614", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611713, "uuid": "f0d88df6-d66e-4806-b9e6-33fc61579863", "comment": "Malware payload", "value": "b90ca797e5cc0ca8551d79ae423fd4add2b75cefdd95acfa50aff2a1936bec0f7552ce26a58311397511ae2126ae4dfc", "object_relation": "sha3-384", "Tag": [ { "name": "BallerWareRansomware", "colour": "#3F1614", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611713, "uuid": "496a1d20-b021-4e20-bdc4-06faecfb34ee", "value": "T166A4F9932ACF4CF6EDC22B3879C75239973AFDA4CF694B5B8544D1302843AC46D6A781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611713, "uuid": "eca9b1c6-966b-41ab-9526-a9f410a47b6b", "value": "82ba05beab8826c673d9acbdaf9e7b68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611713, "uuid": "21486924-e275-478d-ba6d-d9ada6eb5af9", "value": "12288:lpBgd9d4dSdSXEiDxHPB4w6IXSuw9R1Vi:lpBgd9d4dSdnZR1Vi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778611713, "uuid": "bf6eff21-e37a-47e7-a939-77b4586d5aa4", "value": 478105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778611713, "uuid": "10836865-800b-4093-895f-e68e49f212c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611713, "uuid": "c27b82ee-14a8-4b13-a6fc-48c26afd9537", "value": "3537c553e7adcb6731c775edb9f64b1e9a342e96ef1714bf1235f6ac1a150795", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0e4e70-4e20-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778603764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778603764, "uuid": "55000d12-b37a-45ef-b3ae-a5fd2c53b048", "comment": "Malware payload", "value": "5c715b1413f1ea0f32877bce1fcecad9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778603764, "uuid": "a2c4de4b-fa59-4791-a7e2-68ed2c94c66b", "comment": "Malware payload", "value": "3659ee43d9527f83e7631377e95d9a4e1c9d85dad445ba3bdbaf260b4f65bfd6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778603764, "uuid": "862628b8-9ab6-4895-9d8d-7b202cc965b2", "comment": "Malware payload", "value": "334d8bf6417698071106cd6b9ef755eff6a500ac", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778603764, "uuid": "ca1eaf53-e713-403c-8289-175821c7139c", "comment": "Malware payload", "value": "054bff6cd4ab0f82dfb6c7ba7bb050802d0a457482ada2ba1f9996a91a6048bd386e5bbf89a6d59e8f512d1338d68a5b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778603764, "uuid": "92d3979e-3766-4997-ae5b-890572cd5e33", "value": "T16FA66C13AD6101F9D2EA5635C86762537F20B88C9B3473E31E90AD702F367E1AE78B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778603764, "uuid": "0a750141-f2ba-4bb4-b3a5-8f3951f3c088", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778603764, "uuid": "a2943185-c485-4c93-9823-0a94bff80452", "value": "49152:BQWJbrRxz0o/qkuvAVWknCzfMJGwMF/R6ooGX:B3bt7GknCzfEMHYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778603764, "uuid": "8b878dda-f9f7-40f6-b7de-d7717f665559", "value": 9631360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778603764, "uuid": "4b2b6650-e90d-4abe-a012-b085467d5083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778603764, "uuid": "5613aad7-a22e-4057-95a4-b34f2ff8f7e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4288ba57-4e43-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778618621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618621, "uuid": "d0091bc4-b626-4a56-b90f-21195dc44dd8", "comment": "Malware payload", "value": "61290c141d7fd9640df2460947788925", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618621, "uuid": "2190666f-70e8-4bec-b53b-9d8f9e3a21c4", "comment": "Malware payload", "value": "37583d1fa739505aa8918110340d06fa4cd5660be5e6b5e4c2999d8b57951209", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618621, "uuid": "aaa7116d-0224-42e2-a9dc-14fb83c63f57", "comment": "Malware payload", "value": "f856845d3fe570c6fd3e7a8ef5b193a670fe88a1", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618621, "uuid": "63790868-9dae-4173-8b56-85d761d9c756", "comment": "Malware payload", "value": "5655367b3fe92d0c93ba84b82f49f255f92eed9b1c7c58c049681c673a10119d66fbf0654e5954296aa69ed673628e5c", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618621, "uuid": "e9b2f7e2-df9f-45e8-8a2e-de94a181c929", "value": "T158150258726AD407CAA553B508B0E17983B85E9F7821C78A8FE96DEFB9F9F004D10353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618621, "uuid": "1d0d233e-151b-4244-9a5e-5240299131be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618621, "uuid": "8fc59035-4009-40c7-9168-ed4425631dac", "value": "12288:Iucp1ZIrKyVVXFAtqYHzibQ71GIuMuvzrSe+sQWGE2RKK6DUHITIwFKmqoS9UaOh:Dc1IVAqYHzWzvSP6KSjqomOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778618621, "uuid": "25e928ac-126a-4e15-b03c-d524386b1748", "value": 934400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778618621, "uuid": "c151d914-a520-4c15-ae1b-55a40ff16344", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618621, "uuid": "00e9d599-163b-4378-9ef9-a7fce91c19c7", "value": "Order Confirmed ( Ref SOSDT26-270477).cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c7ea1e-4e3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778616474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778616474, "uuid": "a492ec81-04a5-4f94-b0eb-c0d9fd56d859", "comment": "Malware payload (Mirai)", "value": "fd92f219603fa71d2cc935587f16927e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778616474, "uuid": "d9f0ac0f-ea2e-4284-8a74-05d2e93d54ea", "comment": "Malware payload (Mirai)", "value": "37b3fa2a5ec3035537b07f9500162c6a29c4b28b6e6a20bbd055aea0a8fdc32a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778616474, "uuid": "2f04dff0-03de-46aa-823b-294f5a723629", "comment": "Malware payload (Mirai)", "value": "27d06833249e004e9284fc07a8d44b44bbc0b89a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778616474, "uuid": "90f8f662-1008-4f7f-9df8-4637c154b624", "comment": "Malware payload (Mirai)", "value": "0af2d2e880e714765558055fcb8b908111ec2acbe1961e6c23374404d7016dd87c213bd404d384b855d868759455d654", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778616474, "uuid": "aceccf92-33d3-42eb-b83e-8464ce8a6135", "value": "T15B243A46AA408B13C4D72BBAFBDF425633339B54D7E723059528AFB43F8679A4F22501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778616474, "uuid": "9bbebfb0-75b8-4f66-bdb5-c6fc12120218", "value": "6144:wdgy5bWG7FDdGePadwV8nauYx4/K86kFHKQdM/RCzGy:wuy1FdGePaKV8nauYSC1NQm/MzGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778616474, "uuid": "ff3899dc-3954-49c0-b0f6-49e38787398c", "value": 214185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778616474, "uuid": "951ea831-101e-4768-a66c-f5c91555f6b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778616474, "uuid": "4b1a6c1d-a830-4d05-86b9-57ee3ba8a1a8", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5deae4ae-4e41-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778617808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778617808, "uuid": "43081c15-5ed4-4d1d-abca-b84a8b247473", "comment": "Malware payload (AsyncRAT)", "value": "ab6198b3b252147127a5729caae6ece0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778617808, "uuid": "2aa94d20-9fdf-47ad-8e55-35102136216a", "comment": "Malware payload (AsyncRAT)", "value": "3887c52499d0da365466602b3cf66c590e332444810f8847d7577d2258a626d8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778617808, "uuid": "402fa98b-ae37-4fc7-9912-34c198f27038", "comment": "Malware payload (AsyncRAT)", "value": "09a535fb85013b7798c4f58d03bdae79a502686d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778617808, "uuid": "4d0015e7-12c9-4ab9-a84d-e513f17741fd", "comment": "Malware payload (AsyncRAT)", "value": "aaeb883ecd10b28f7ce390ba4b4afee84c29c359f1de8f81b87ee29caa0cce0910c34c90e18f4eefdfc73b4e4e5712f9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778617808, "uuid": "9c949890-e383-4e59-a7fa-383ebd64659f", "value": "T1FB232C103BD9412BE1BE5BB85DF2614186BAE2337603D94E3C8811D75B13BC69A426FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778617808, "uuid": "0a350a7a-610a-4745-aa5a-19ecfbb463a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778617808, "uuid": "da04b4b2-0101-4d8b-b8f6-cfaa3fda2f2c", "value": "768:9o7CM0dnYi4G5Yhb9Nk13wRCn1OCDyjb5gr3iiQkgb/ClZFatYcFmVc6K:9o7CM0tVAUVebWrSiLgGrF2mVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778617808, "uuid": "5385edd1-1b2c-4e89-b86e-7a3a43fea161", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778617808, "uuid": "d891ed9f-a6dc-41da-a72a-24e10d9f8b6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778617808, "uuid": "87de8eb9-24de-44b6-b042-ba7f5899dd9c", "value": "3887c52499d0da365466602b3cf66c590e332444810f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c040a20-4df5-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778585028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778585028, "uuid": "25f1de9a-2163-424e-9031-49503f249cd6", "comment": "Malware payload (Formbook)", "value": "0c3f62d20eeb8b88e62cb07f44ad12cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778585028, "uuid": "6b7b858e-7919-46b5-9491-9f84d8c7e723", "comment": "Malware payload (Formbook)", "value": "38fe1b72ed874613880decbe5f2e31edeb1088d091e00e3d1fa80b74c552827c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778585028, "uuid": "597ffde2-03de-41da-9887-5e1f60333403", "comment": "Malware payload (Formbook)", "value": "b81482ad6465aaa696a0bcdf2f112389818ed3bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778585028, "uuid": "fe60523a-0975-443e-b28e-92c19b61bdb1", "comment": "Malware payload (Formbook)", "value": "33f441483a9ac8b81198cf65ae0bb56608d9d3d42b15279952325f65f391a074e0d7b00f689d857f0b6223a13a55fc59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778585028, "uuid": "1e69b385-028a-40f8-906c-c5e70a98d38d", "value": "T1DC75AF1923DD492CE4B9EF385B32379406B1FC2198B2D70EF70957797A26A905E9C323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778585028, "uuid": "660b87e6-0230-4595-b313-97e55e7ce904", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778585028, "uuid": "81c32e51-3b17-45cf-b030-3744400d2882", "value": "12288:8+7eoaggXxrrYKX33z+qcMYBUwo92piHlMmau1ouSl1rFumN2H8+9VL72By36oK/:n8nPCmQui1rBgc+9yoyfJuz0vy+3nA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778585028, "uuid": "99edbcae-cd63-4687-83d4-586197ad5d39", "value": 1560576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778585028, "uuid": "5591a55d-5661-48a8-8067-585606e4c4ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778585028, "uuid": "78308d63-81ec-496c-9d09-0ecba0391567", "value": "Quotation Request.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c9d016-4e1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778601585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778601585, "uuid": "f37d44e0-f59a-4b31-893d-6f71f2db3e1a", "comment": "Malware payload", "value": "d9fb6af03060bf57b7edfc415cb3eaff", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778601585, "uuid": "4087c0a4-da29-4e85-9c92-5b5d979eb552", "comment": "Malware payload", "value": "3936b5569b62f00c2f7128e538ffdceb05193d20a7fce06f0357d86792bee028", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778601585, "uuid": "b791df8c-035c-4a97-9d9b-01f7a8351bc1", "comment": "Malware payload", "value": "329ea535347d9d5fea470e6693a5602f2bb5ca60", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778601585, "uuid": "4b916627-ff0a-46d0-bb14-e72c530c5dc2", "comment": "Malware payload", "value": "606f77030c94c9dd88b394783eebca7b10f0699d59300435bd8269c46bad7c54de348c8ef3a663277059f344808615b4", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778601585, "uuid": "f47ce143-7231-4100-8dcb-2a128c9b279b", "value": "T1636633B6E214D9F4C42E966A60E11340938133EDDC42D8EF9FF2AED071E2E8564E9357", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778601585, "uuid": "a22983b7-fae5-4a3f-8e28-6bb34afe3282", "value": "196608:+ZftbeN2U0uU+HB/OGUElH6XU8YYlbHXUV:+BlNUrU+h/PUEl0U8YYlbEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778601585, "uuid": "56535e4e-a7a3-4ddf-9a81-7e192b3200ed", "value": 6643602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778601585, "uuid": "d4f9cd17-64e4-46fc-9789-5714ad2c3097", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778601585, "uuid": "c93f0264-8143-4599-9058-8c733d366745", "value": "2gotextileltd.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49070fb-4e36-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1778613228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613228, "uuid": "589b6325-b933-4f9a-b2fa-0572f032e4ea", "comment": "Malware payload (Gafgyt)", "value": "6f6a156e1d0e2c87a7ed57d0335d70f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613228, "uuid": "dfd6305d-551f-4dd8-8a45-f00e5311bd45", "comment": "Malware payload (Gafgyt)", "value": "3ae5793510a011fb8a6fac44f22557cee0b1d5c5d65f51b7aa7bf178dc7dd3b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613228, "uuid": "07d96880-a1b9-4ed5-8d2f-9d47323e3e45", "comment": "Malware payload (Gafgyt)", "value": "c862753c6d2d8e01d1a6b90c61acbde72f27bde7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613228, "uuid": "152a6743-8a3d-4f1f-a0f0-a0595dc384f0", "comment": "Malware payload (Gafgyt)", "value": "9ad068391d0df66c0b2757f19d959e49f0b21e8df70109a278b73c0515630e4d045220068530682fd02a3ff9ed62b425", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613228, "uuid": "38cfd5f8-a51c-453d-859a-5f071ace85f5", "value": "T12EE3D706BF109EB7C81FDD3301F98B0124CCB49725A53B6B3674DA69BA5A58B05E3CE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613228, "uuid": "5640e9f9-e4fa-47eb-8da4-0064013ae651", "value": "1536:JRYGb4Bo+0NFgNShEyX2zJuoaZ8jCSRCt6+5Jx0XJwqo5hspJ6xD:jthEdzPasCB/eBo5hspJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778613228, "uuid": "2b0e5172-c060-4fb5-a620-1bd65e504150", "value": 150112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778613228, "uuid": "61e18b19-e43a-4e74-9920-0386d6a8a84d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613228, "uuid": "398a924c-d623-4a47-bc57-5c7d86ca745b", "value": "FBI.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04fa40fe-4e37-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778613363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613363, "uuid": "af7a16dc-b533-4ef0-8fbc-351606e82177", "comment": "Malware payload", "value": "8821ba9facf40285a9d6c5d604a3fbae", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613363, "uuid": "3e571ee2-7d3e-4269-b353-26408fde7982", "comment": "Malware payload", "value": "3aed01a01092efc0b19ff83c6f7ae0142e32df7c6be04040fe54794bc40fa599", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613363, "uuid": "3bc3c4b2-72ac-4fcc-bdb2-eb54f063b260", "comment": "Malware payload", "value": "542f55a0a1a276d37399dfd751338288ebb74b17", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613363, "uuid": "9cebe1fd-98e6-4e89-b51a-66cabf922588", "comment": "Malware payload", "value": "ec02b6c1a94c4b8faabfcca63fa60c01b75f91b7eb337b5ba3e9cacdb5a0218cea52dedde54e06265d7b9d82b74db81a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613363, "uuid": "8c5e2272-05a3-4de3-85d8-380b70b78974", "value": "T181E0ACEB041B2E61C10CBBC6EF50C7549006B6D0F697736A620B9551FC797B0795BB41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613363, "uuid": "660e9239-740c-4833-ada5-fc0bfb04804a", "value": "6:hoKonv4n4eoKtilLkyGjonxnL3oKtRd/yGjonIFMnrlyKt5Hd2lEy7:g4IPlVGUB8cdqGUhkS2/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778613363, "uuid": "2a1665b7-b901-4d1f-bcef-10a473c4695c", "value": 435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778613363, "uuid": "03f54f19-7ef0-4b64-8d76-d944fdc60929", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613363, "uuid": "a3ca9b56-ef29-4bda-b4c7-1a5311aa94cd", "value": "realtek.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1c8358-4e1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778601569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778601569, "uuid": "27823bf1-dca3-431e-a12f-df355d1daeaa", "comment": "Malware payload", "value": "368967c11946ee9d3776c3e59dd64513", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778601569, "uuid": "d90d2d7e-5536-4678-b3c8-26958e9ea722", "comment": "Malware payload", "value": "3b7f60aee29fa5b18b313a6098b8e44cf81bc304a1db6b49016468408a7b5b12", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778601569, "uuid": "1986612f-172c-4d61-8d1b-81f37a6b08d2", "comment": "Malware payload", "value": "d43591103d595e9abf4abba4762c62bec5943e4a", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778601569, "uuid": "a112c520-9fa9-49d9-95b7-350f8e32231e", "comment": "Malware payload", "value": "1326b7e238ec8dd5b8b4015fdf8bb762aeae044a136585bf04ffa8c7b88ba5fd598e6aa0e21de88882aacc87ffeb59ec", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778601569, "uuid": "d9132874-3642-43ab-975a-cb87ce4f13f3", "value": "T1B882C81673A518B3028226E5D5CEE208F63A41AF500D5E50B4DC9285FFA696FD3F87E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778601569, "uuid": "767063ed-423c-4b15-b7fe-751e3248ab6e", "value": "384:+nNDkHb4l+ngusSoLgtVyV1a2kheaMimeWunsAmA:Xb4sgCoLgtVughHaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778601569, "uuid": "24ffec72-b2e0-4b25-bcbd-fa14828ec279", "value": 18572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778601569, "uuid": "d4ccc39b-fefc-44a1-a0c4-ea56bf4b1b1d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778601569, "uuid": "58bf5b40-86cb-4d43-b755-8a0583249167", "value": "wutashui.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c260489-4de4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778577754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577754, "uuid": "ebafb1c9-bf99-41c5-9f79-d89c0a62285d", "comment": "Malware payload", "value": "8f344d0000d5731e2da058bfd23ceab2", "object_relation": "md5", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577754, "uuid": "363f56bf-a744-4d27-8cfb-8eae365674df", "comment": "Malware payload", "value": "3cf5235ad93b49d50c9b09c17394b89e80da7d8604354824cb46921643661af1", "object_relation": "sha256", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577754, "uuid": "521d0363-5bb2-40f6-a1e5-40f382fa6d24", "comment": "Malware payload", "value": "5838d6307a848445af6c36488d0215050d10c428", "object_relation": "sha1", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577754, "uuid": "bd20a2a6-326b-43b4-b002-3f91b6eca09d", "comment": "Malware payload", "value": "0f5290787ce8018a5270f197dd616c4626c293842900993a8740a48a7bae3feb538fb53c3521311c95289b18d8fb9313", "object_relation": "sha3-384", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577754, "uuid": "05139ba8-bee6-45fc-aef5-3ab7b9c946f0", "value": "T1F7473353C30A0326EA0BFF3933DD02B7A62CE56C726391973FA456906CD1BD22757A19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577754, "uuid": "15efdbc9-59ee-40dc-9bf4-cdc8ac67358b", "value": "786432:5gqzWwbHifOZR/6XV95J5mIP8zxW/ZsG14sy75rV5XP9:eqz1Zd6lPJQIAg/SGmsy5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778577754, "uuid": "590bccbb-a0f8-4aac-b3f9-01f1ddb20df0", "value": 25548794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778577754, "uuid": "9042f4d1-f7b8-41e6-afe6-93d3b6814ef7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577754, "uuid": "2a791ed8-1af4-4dea-856b-8f2b36d24083", "value": "PD-92725.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4362453d-4e11-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778597147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778597147, "uuid": "59e2396b-7abb-4a2f-88dc-b4dcc1709ea5", "comment": "Malware payload", "value": "7e85edcdd3244a7fce7ff6df4a48db96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778597147, "uuid": "09761d21-ef3e-45c9-930b-3a87d18bfa48", "comment": "Malware payload", "value": "40d49613605ae9fd3aa617ecee001230ecb941c9517578bc041f58f927239f24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778597147, "uuid": "a7685955-9db2-45da-8c0f-dd6d5cf12fe8", "comment": "Malware payload", "value": "c8d6f0b40808c0758a7cf8971a0b8413f8e8d6b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778597147, "uuid": "29750f53-5b96-4b08-9c75-1631cb3d67bb", "comment": "Malware payload", "value": "2806684bb30f2e06d5e5bbba643707c998c2a498f78fafcc06bb19500c110faeae3f46c99731df9934332774b7f0100a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778597147, "uuid": "de1ac8ec-6bed-4963-9578-69c589d7ea6f", "value": "T1B4B67D23746641B8D8E9E334C42B9652B629F84987347AC36ED19EF09F317C09F38766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778597147, "uuid": "1a48aa55-750b-4331-9f40-7d3527a90d77", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778597147, "uuid": "138d210f-bf22-4440-bec4-b19faa2bfc65", "value": "49152:TP+0CjMVwnJVyDpr7M0IBL9eZu+V7h07DRWdjQ:TPVGwkBLCuqh0/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778597147, "uuid": "2e279d6e-f66a-49a9-b851-90e53bbce28c", "value": 11059840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778597147, "uuid": "d8d3500f-6933-4840-a4ea-112f24556e1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778597147, "uuid": "8aa746ee-33ed-42c5-8d66-eea6c0e95aba", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c843e09-4de4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778577781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577781, "uuid": "ec7d838a-1964-474d-94cd-a38f2b54af82", "comment": "Malware payload", "value": "e55f669048943ea8ddf664b718d1f3ea", "object_relation": "md5", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577781, "uuid": "5989278f-a72b-449b-abf3-4ebaea32969e", "comment": "Malware payload", "value": "424d435c09faf3736f36edc4ba6b2c26ca2b91aa0f685cdfd32c66d352bd09fc", "object_relation": "sha256", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577781, "uuid": "6df334d5-34cd-4529-90a3-bb6448255d07", "comment": "Malware payload", "value": "5ec688fbe036a969fe9072106fa9658a9ce29b12", "object_relation": "sha1", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577781, "uuid": "ed7437e2-a47d-41b4-90f6-4e91ec700651", "comment": "Malware payload", "value": "a3efb818df2bc4acc87a7f106a1cbe77b403ab612df9d235caa23e1e409d85c7b8127e39ab82f6a249daef0a4179fbd5", "object_relation": "sha3-384", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577781, "uuid": "783b208d-586f-46a5-8cc3-4f9e8ec461af", "value": "T142860261CB3F2FEE7D1A098C495F6A5A4C8C5E333D21C4F6DAAF11478224AD516B381B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577781, "uuid": "6cfafaca-7c4f-4607-baa5-922094e6bf68", "value": "49152:LnA5v7F/0kYnA5v7F/0kYnA5v7F/0kYnA5v7F/0kYnAPv7F/0kYnA5v7F/0kYnAd:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778577781, "uuid": "d25fbc18-ab0f-4af8-bae0-32680aea7e47", "value": 8111524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778577781, "uuid": "05b346f2-5a4e-4d00-8abb-bdbea19a555a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577781, "uuid": "53be0736-54ab-41b7-9603-50456588eaf5", "value": "prt (2).py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae052933-4de5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778578428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578428, "uuid": "2d0a8758-cbe5-46c6-9eb5-7beca3328296", "comment": "Malware payload", "value": "43224f60c072aaad896472b55e5aff8a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578428, "uuid": "bae2c7f1-8ce5-4128-81a1-5390b7211be2", "comment": "Malware payload", "value": "429a4fb4b9f367d0835dbb163576a18f63edf5afa8cdf56e02c46f587c63881b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578428, "uuid": "e02befdb-6304-427a-b0c2-ccc5883e8af0", "comment": "Malware payload", "value": "85dfafec5468012a7018e3054d641d5a746208ae", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578428, "uuid": "f7c10901-509b-4e4c-9173-896c721117ad", "comment": "Malware payload", "value": "a57be14ecee48e2284ab0fe1b144cd9dbafe65f452e78b128f331dd08ad08bb75e758d339a1022fd9af64bcedd195746", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578428, "uuid": "02b27873-3a08-47e4-ade0-792ad735e67c", "value": "T18841441B600416F5C92E5B32D5CE07833BAE92EF009A49C4705EE0602F057AA8FEAB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578428, "uuid": "5bb4cd56-9a67-41e1-879b-e424a44e07a5", "value": "48:RpbIQWxG6nTv5lE3tnzX5limkXeexdsp6/s0:RlIOmx23tdU/gp6/s0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778578428, "uuid": "488efcc8-f266-4cde-ae31-8306adaf504c", "value": 1955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778578428, "uuid": "902384ef-2e40-4422-be7f-889ef6d3a0e4", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578428, "uuid": "6fcb8234-5d77-4037-a055-4019efa2f7b3", "value": "429a4fb4b9f367d0835dbb163576a18f63edf5afa8cdf56e02c46f587c63881b.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f19df20-4e39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778614347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614347, "uuid": "f6d71f3c-c915-4fce-ad94-f4d9a3fb1c5a", "comment": "Malware payload (Mirai)", "value": "b81a7e00cfec8a1c0d2064ad360eb2f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614347, "uuid": "0ff34fcc-1c4d-4044-b939-83fd928b9b59", "comment": "Malware payload (Mirai)", "value": "43b2d1fa52f4f0b092fb4da9e8b74d6c7b4bfe3ad718d2c436314226a5e9014e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614347, "uuid": "719b9fd6-09d7-4da8-868e-0b74790484ac", "comment": "Malware payload (Mirai)", "value": "f16f1d737f6a0a871809e02d030830db175c1f78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614347, "uuid": "2b552b1d-4a9c-4436-9b22-7d04870a13fa", "comment": "Malware payload (Mirai)", "value": "4af68148a2579238dfc54ee816de6f024be716cc938fffdf7d97f366977e9d535cb566a8d916d0ff6a6862decb30972d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614347, "uuid": "9906cf0f-b33e-4a89-a6ef-8d4e537556bf", "value": "T17B6302BF77E4714AC89F8C21B45EBB539B4830B0289E634AA7E60815F7B5F0B7709491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614347, "uuid": "95b7a628-4d99-4ffb-8eb9-0bf6506b2590", "value": "1536:4lGzxLeExMoRX20H4/DNBVYT7k1Nf5OUTRKgkM6LU/y1N9:4sM6xRX20+TKQ16Ox/yH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778614347, "uuid": "57bc623e-c27f-44cc-8597-5583ec676e26", "value": 69692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778614347, "uuid": "789ec0be-4a7f-4132-a3f1-a19ea2e42806", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614347, "uuid": "059cba1c-8446-4fda-a241-35caba23b11a", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64453e8f-4e42-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778618248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618248, "uuid": "f90e5fa9-2666-4490-8014-1ca5df807e59", "comment": "Malware payload (Mirai)", "value": "86d7ac0a7a84c3920f1bb9467e41e728", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618248, "uuid": "811d8da1-0faa-4823-8b5a-80618107a51d", "comment": "Malware payload (Mirai)", "value": "44b345662177c0217e3dca46aef77f651a6cf3c490722ffc12c04e2ec0aadb58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618248, "uuid": "f1604ab7-012a-49ef-a94d-1462f3f66ebc", "comment": "Malware payload (Mirai)", "value": "51fe897813731b47c1867bb0f899f4be6a16486a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618248, "uuid": "2da44d8d-3e33-4800-9c6c-b867acf0a871", "comment": "Malware payload (Mirai)", "value": "c5c6eb763b9e2ab1cd6105c02f3071c306dc84c1c6c5a821137863d38c2177ff5d61de13d0f59282894c3ff29e79528d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618248, "uuid": "b7306ac3-7ea2-4103-b280-2ace6b7d21f8", "value": "T195D3E749BD819B10D9D635FAFE4F028933571B6CE3FA7202DA245B2137CAA5B0F76502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618248, "uuid": "9aab0955-1ad3-41a0-b316-1571e40daa83", "value": "3072:B0FA7wFSZ5Ijdg1zQH2uhJaykzZzVWaf4fOnZNfq1Ge:KA7Psg1sH3Pa3zZzVWafoCNC1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778618248, "uuid": "9fe75cfc-8e7d-453e-b337-5e3302ddae21", "value": 140952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778618248, "uuid": "c32789f9-0cb5-4c57-a0dd-98cbd5d37f79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618248, "uuid": "2755eb31-69d0-44d5-b44c-6feebc420370", "value": "SecuriteInfo.com.Linux.Mirai.9833.10926.23042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81cf24ce-4df8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778586515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778586515, "uuid": "1d1f0bf7-215c-4dbd-b666-e99df1fe81ce", "comment": "Malware payload", "value": "6c466463f78d4644395d6cc636139de4", "object_relation": "md5", "Tag": [ { "name": "84-32-22-130", "colour": "#27840B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778586515, "uuid": "08daa1db-6490-4037-80e6-3e6595cc025b", "comment": "Malware payload", "value": "44c3885cb5ae32059e201fd3f5b87738d5e88706d1fbcf30798883c3498f9eb1", "object_relation": "sha256", "Tag": [ { "name": "84-32-22-130", "colour": "#27840B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778586515, "uuid": "6ffb5f3a-19a5-4fc0-b417-dfb52784dd5d", "comment": "Malware payload", "value": "bb4ed1b85297d63acbe54c62d89ba51b42ec1103", "object_relation": "sha1", "Tag": [ { "name": "84-32-22-130", "colour": "#27840B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778586515, "uuid": "5b785234-39c9-4ca9-9d86-6099e989dc5a", "comment": "Malware payload", "value": "201b06b76b9d166ebb34bf84190da0e40de3706ade317de36218f89b8fef93a914093371ab1b0d687d7bdc353f1f7847", "object_relation": "sha3-384", "Tag": [ { "name": "84-32-22-130", "colour": "#27840B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778586515, "uuid": "9e53e2df-e18b-41b8-88a2-4b2a065da6ec", "value": "T1D2124047A2D0CE3FC8D953384467122472B394BEDF629713064815B53F427E81E6EB8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778586515, "uuid": "89626148-e38c-4822-afac-b294d78e2bd6", "value": "96:GqTVJWWGXzS6jH5ML09V1J9G8Yma+hrsrwegVekrf7mxaamBFBp8sBRnsH5vZAC:GqnWWHEZMWT1YmnhrsnurfjTr8sbnsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778586515, "uuid": "16d470a5-60b6-4ce1-85ba-a14cd3cb6814", "value": 9800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778586515, "uuid": "e3e4acc3-9a87-40e0-b06e-43dd4ccf323a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778586515, "uuid": "dedee9fe-70af-4022-bc6a-f50fd62593ee", "value": "44c3885cb5ae32059e201fd3f5b87738d5e88706d1fbcf30798883c3498f9eb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259ca4f1-4e33-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778611700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611700, "uuid": "50514be4-669c-40c0-9b3b-017d532e0688", "comment": "Malware payload", "value": "6de74ec110953745d28f6d312db9a673", "object_relation": "md5", "Tag": [ { "name": "BaggerBauenStealer", "colour": "#6A45B7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611700, "uuid": "a418401e-6847-42a4-92da-923699a96e57", "comment": "Malware payload", "value": "45cca886306760d949c4efbd2352448d89303e499d7d65e941a7beb29c75d160", "object_relation": "sha256", "Tag": [ { "name": "BaggerBauenStealer", "colour": "#6A45B7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611700, "uuid": "ba65500b-ab6f-48a7-bf13-1d673edd2c58", "comment": "Malware payload", "value": "16493e41f1b527a5d2480fce8bdb8e88438eb9c6", "object_relation": "sha1", "Tag": [ { "name": "BaggerBauenStealer", "colour": "#6A45B7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611700, "uuid": "5411896d-58f1-49a5-8f42-92483d410f53", "comment": "Malware payload", "value": "56bfe51bcef76861537b80dce285161602e12bd8e2828d7f6b51c2741b6c8630f13ffc55ee6614160b567439c802c077", "object_relation": "sha3-384", "Tag": [ { "name": "BaggerBauenStealer", "colour": "#6A45B7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611700, "uuid": "45cf1077-839c-4f6a-bf4a-2371c989b8a5", "value": "T19FB21A08B7F84616E1BF5BBC9CB260200372F6936912EB5E28CE54ED0C637605CA5F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611700, "uuid": "acbe79c3-837e-4330-96dc-792ee4729e2a", "value": "384:y5TdEQgwCGjW4ueQTOMzkMYhqas1iURa0dCj8F2919ElvjsyavuH:OZtAOmkVqnxs9j3JE6vuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778611700, "uuid": "88726d6f-8501-49bc-98bf-933a460cec61", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778611700, "uuid": "65136687-1053-4cff-87a2-fae5be8925c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611700, "uuid": "58775968-fdc9-46bf-9318-4a16799f1d8d", "value": "45cca886306760d949c4efbd2352448d89303e499d7d65e941a7beb29c75d160", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364eae07-4dfc-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1778588106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778588106, "uuid": "bbb091f0-a87f-4a21-9c12-6dc7f12d3c47", "comment": "Malware payload (ValleyRAT)", "value": "5ae1d940e1648064f8febb294c004a75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778588106, "uuid": "866b3ca3-0a6f-4737-8f69-e6e02a5e5924", "comment": "Malware payload (ValleyRAT)", "value": "46113d2114c18c61df361ac870b9eb29190821ff4bc245c556651522d060122b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778588106, "uuid": "2c42eeb9-a973-4a03-8ffb-3535a923050b", "comment": "Malware payload (ValleyRAT)", "value": "2e2da2b2aee5dcdd887783f95fb4bbf3dd8c95c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778588106, "uuid": "3431fd14-3a1f-4834-8fc3-ff5acb18c357", "comment": "Malware payload (ValleyRAT)", "value": "5f567e32db687f74760629d8fa786c0e313636d35057a6ded22d4c65463f2bbf872297ec14b7a8d66adcc1687024607a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778588106, "uuid": "de47c1d3-728b-4472-a06a-73e89679b98c", "value": "T18F161287E65C06E8F87BCAF08B56494EE7727C2B8750518F239279D31E63250A53BF12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778588106, "uuid": "d4c8a22f-4426-4aff-a145-8ddab2b5a612", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778588106, "uuid": "993d0336-ec9d-4fd0-aeee-2a5f12141144", "value": "98304:K2aHDmaPR2/1ykOja4/Oh5Ga+mHGnI2q40tTJWGrFR:GDJEy7afhKmmI2I5FR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778588106, "uuid": "171f039a-b91a-4662-98c1-f3febe7f19ac", "value": 4066814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778588106, "uuid": "dfc1416e-70d9-4155-9715-e6bf0ee46587", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778588106, "uuid": "6a4a7dbe-9710-4e80-977e-9d14ffb26c57", "value": "46113d2114c18c61df361ac870b9eb29190821ff4bc24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366a86eb-4e32-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778611299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611299, "uuid": "a4a0d628-8635-48c1-a99a-ab85d317a147", "comment": "Malware payload (Mirai)", "value": "3b471a3cf893b7c5155cb92caa92a630", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611299, "uuid": "0d927e9d-7458-469b-9792-7a3a2e9a3a94", "comment": "Malware payload (Mirai)", "value": "46c6fcfab477b6389c1e7efbc480497c02d222668f6670648d889c765c023c3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611299, "uuid": "bc42160d-ba75-4eef-8a6a-8e14983f4db3", "comment": "Malware payload (Mirai)", "value": "6cb645d21fee96733eb92d4190f7ce0946d0e19b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611299, "uuid": "88545327-83d6-4336-a453-be17e408e386", "comment": "Malware payload (Mirai)", "value": "85e5f983029ee798baf4b823fc188265f96c8a683264bb7d7533d6325288f67f74c687a78f3dcc64afe0fd08b046dbfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611299, "uuid": "4cc7ac65-16df-4a9c-ad31-1e39064a57be", "value": "T10A633902F9E290ACD546C035474FAB2A9B717C4943257BDF6BC47AB13E35E906F6A320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611299, "uuid": "16c51a2a-0a70-4151-91b2-67ebe3efd302", "value": "1536:UOrN99fCZ16SbVqwANHBDmHLk3Q7flYsiFLAvjKa3bSaENhpnW0wlc+30McAY986:H39f2Dxq7jDmz3cDAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778611299, "uuid": "322b56f1-3acd-4e28-820e-d61919b43b0f", "value": 71912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778611299, "uuid": "d7f8816f-80e9-40f6-a2cc-2a89f2242307", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611299, "uuid": "1afc8eb6-9cf3-4d5f-8023-6b8a43520648", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278c0718-4e3a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778614710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614710, "uuid": "7fddd68b-1ab2-4998-98f0-6fb848b65483", "comment": "Malware payload (Mirai)", "value": "b5a6a5d543ec4d2f1d915e1bff2c94c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614710, "uuid": "bcb993c0-b155-4683-8b5d-606e936cf4e6", "comment": "Malware payload (Mirai)", "value": "472437929e440d5c906f66a1cc714bb4b26f48157d4d84005758eb9130bc2dca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614710, "uuid": "6b02d780-8352-4079-b885-00a1409ce754", "comment": "Malware payload (Mirai)", "value": "de5219fcab719f9be9ac00945183960b14601129", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614710, "uuid": "100118a7-0b1a-46da-a4ed-5093814b27a6", "comment": "Malware payload (Mirai)", "value": "0e63c5b097ac6040ca43e33d264ec2f59a8b25a80a7723c59da286b1bf2bd0de0d20a9ba46174627d33c7b1790dcba70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614710, "uuid": "934392a9-8e3e-4b3d-944d-0c54b2864a3a", "value": "T100B36CC5F183D4F1E85306716077FB379F76E07A2129DA43D3ACAA36EC91501DA0AA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614710, "uuid": "d6e81acb-f2dd-4481-92e1-b2a1fbc07672", "value": "1536:tCvv4YvIBFrfSNuMHpoFfbpvaf9qtZSN27W9RKdqmeSB2VmJ:y4CIBFrfSFHKFfbpvu9qZr7SR8lHAmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778614710, "uuid": "444d8ace-e204-4faa-8868-7477232fbfd6", "value": 111176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778614710, "uuid": "b47a97eb-5c3f-4640-95ca-b86016482cb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614710, "uuid": "eb3e0618-5b26-47b7-9742-2355a61684f9", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27844dd-4e15-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778599132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599132, "uuid": "faccad7b-6d8e-49fc-8ac7-e77dcd25a3ce", "comment": "Malware payload", "value": "1ae1d4e067f206edf8476396416d8daa", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599132, "uuid": "d21b9d41-42ae-46cd-9837-815f5693f48b", "comment": "Malware payload", "value": "474d88a1610e9380519c50d7a45f5d13635bea0761219d0c2c00ef49aba8aed0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599132, "uuid": "01905b38-6ef9-4b8e-b263-8d34901f9df2", "comment": "Malware payload", "value": "46bd71332482b40710b18b7396d66e8e0d19f7a6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599132, "uuid": "9b8f173c-4f4e-4f77-a165-2bc1cd0430c7", "comment": "Malware payload", "value": "7cb1ebc5af0d9f93474e5bd9282ba29408c891634a54bbd78237b84ba4b74ab2c37f84c6eb9df191da69c6f666a5cb6f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599132, "uuid": "087918c1-ee37-4ee3-ba16-ba791b6b601a", "value": "T1F1926C0FB9518315D5C00474A5B2873FD6BA5476338454EFFBD88ACA1B682EAF83216F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599132, "uuid": "6761f8f1-de24-4f53-830d-766d7d4a74db", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599132, "uuid": "055c3b5c-c1a5-4baf-9194-1d366e9157ac", "value": "384:IIkjLVlvadxqSDO5wtT0vu98t2rFJ/Bgav8U9c5G:cqx3600G9oJa0UgG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599132, "uuid": "16fcb3bb-46eb-43d1-8cc3-c5d9aa736499", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599132, "uuid": "a0d40da6-2567-4b11-bef5-b38e63048318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599132, "uuid": "7f430fb5-bb2a-4edc-87d9-782cb12db3ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437bed68-4e3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778616475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778616475, "uuid": "a48d2f9c-9733-4e26-aa4c-a6b469a1bd03", "comment": "Malware payload (Mirai)", "value": "f8101362f2665e33e82d26fc68c3c074", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778616475, "uuid": "b3081cb0-de4b-438d-995f-ad2734daaa91", "comment": "Malware payload (Mirai)", "value": "476b9d3d17d5c75d47176bdb25916a4957eea7640a7c228786d95ead0cfa5606", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778616475, "uuid": "6ace3002-2cc3-4fd0-bf7a-910396efd1ba", "comment": "Malware payload (Mirai)", "value": "d9c42daa526df07e3b9947c6d92ab694f6ad5a6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778616475, "uuid": "a267db53-4481-4d62-aea1-d6dcef744f92", "comment": "Malware payload (Mirai)", "value": "5ff2e2f8787824a9bd0e78d2466484431d3030a1382c5dee78bb0d2e33fbe9d796d1c7e4ee292d1bb7cea84baa636d09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778616475, "uuid": "093b93f8-a107-4827-8994-a3380f2c9331", "value": "T1BE241B01B8518F53C5C32BBBF7DF42993736671487DB7302EA24AEB42F4669D1E2A201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778616475, "uuid": "e82f39a2-cf79-46d6-bff5-f36b24548019", "value": "6144:HlTTnB4qxAni22j1JpxmLyyKJKHtEqZ06L18Hts1QS1:HlT7FxAqRJXmhKJKHtEqC6L18Hts1QS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778616475, "uuid": "6a0521f8-2930-4625-a17e-734773326b03", "value": 218600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778616475, "uuid": "c0753847-9301-41dc-ac46-6441a4d15255", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778616475, "uuid": "3a19c643-c3f9-46f5-b54b-e0aea7991c4d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce460d9-4e1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778601592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778601592, "uuid": "c187621b-b619-4449-8b81-19067a1e55d2", "comment": "Malware payload", "value": "81d7e4612cb5be1c40678b13d9a49fd3", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778601592, "uuid": "0e213505-8246-4ec1-939a-57003f8fe54d", "comment": "Malware payload", "value": "477ed1c398c73dae4744c0b0fa2f0541279a2085c02b90c3a44967495ebab487", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778601592, "uuid": "3b4c8839-b7e1-4b7c-b203-49757caef941", "comment": "Malware payload", "value": "22e8a0498c5d20f22e19dfd6058d09077aebe79d", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778601592, "uuid": "da365aa0-5337-46e7-bded-953cc215f625", "comment": "Malware payload", "value": "ebaf19e6b510ec9a55a0fd48639c4c0a8b5d126ea19d3d694899b43fb077481b95d3c5862edf7272c27cbe4b6ff37408", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778601592, "uuid": "56c0fb89-4114-47c7-867e-41c0ee06b78e", "value": "T14AE5BF65F3C866D9D426CA398705E323D2B278224B76E0CB1A96174A1F77ED24F3F601", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778601592, "uuid": "086ab1bf-3c1b-4a08-9e5b-e7b626d419e6", "value": "8fe40e4a7e8c132ebd864d1b298b4ddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778601592, "uuid": "740b8498-ec4f-4025-990e-5f6602d47fca", "value": "98304:OXkkAD39z/qATOHuc4U5HgRpqf7sH7bXae+jr1WoB:YkB39zxCutUpgReOXsv1WoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778601592, "uuid": "04486bf9-b70a-4e27-b4b3-e2f7d658d3da", "value": 3147776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778601592, "uuid": "d9b95c4b-3638-4fed-b9da-63f3f1994063", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778601592, "uuid": "a09d3cf2-fe53-4ee6-9a34-0fd65f74e170", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8ddfad-4e33-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778611846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611846, "uuid": "e47b664d-d73e-4fbf-b5ff-06dc7cad9bcd", "comment": "Malware payload (Mirai)", "value": "1757f7b410d38a3605c442bf48a07d3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611846, "uuid": "1c0a74ba-a3e8-4b80-99f9-e93fe6465b84", "comment": "Malware payload (Mirai)", "value": "4897f5ffaab899c5aa3b8b1f7926e8a2aebedceb1465e804214735073cdc4a62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611846, "uuid": "122cf32a-a2d6-4959-b0da-112a8b53d674", "comment": "Malware payload (Mirai)", "value": "01d95176f000584f6222e90835e30d33c3795b01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611846, "uuid": "45ebb5ec-a2b6-4078-aa1c-536cd85e4e23", "comment": "Malware payload (Mirai)", "value": "7088a1b9bef2f8fc3b63100730a1bfb801ce7f7f0b9ed9ef535de756caec0cedfa387e2d7cbfdc9311bc30368003d6e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611846, "uuid": "9241c325-5720-4c6c-ad3a-5147bb35cbe2", "value": "T170142B46EA414B13C0D627BAF6DF4245333397A493E7730699286FB43B8679E4F13A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611846, "uuid": "d7db2896-5d40-42c3-9239-3afb0d49c147", "value": "6144:tuhJR5aqhFDMa8ewfx1wWqtKi5oWM/RsMSP/z:tuh3VhFQa8ewfx18voP/FSPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778611846, "uuid": "98635e19-5190-4be1-82b0-0bb0b7b514ff", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778611846, "uuid": "6d3aa58f-b199-4d06-bbe5-96ce68d19033", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611846, "uuid": "40e375e3-84c7-458e-ac06-405bc865fb92", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aee7ac2e-4dfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778587879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778587879, "uuid": "8bd7bca7-1500-49c4-98b9-b056de6d76ea", "comment": "Malware payload (Mirai)", "value": "88e060666510b70682733cacf1789f6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778587879, "uuid": "ba47baf9-d6bf-4840-aa42-92eec7fb5801", "comment": "Malware payload (Mirai)", "value": "4ae72235443a7bcf2a811826c9108dbe0b4b926aa01ae53fac27991d1404fc20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778587879, "uuid": "ce237c02-bcc1-4a65-8317-203762c76061", "comment": "Malware payload (Mirai)", "value": "8da6551092278c12ea3325226d17333b1cf3dad2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778587879, "uuid": "88bc1f03-5762-445c-b718-45f1c212d2cb", "comment": "Malware payload (Mirai)", "value": "30c2c644e74ddb2ebd62e608e2953a99b50c83f6917b95fe362c7c05edf6b4cb62d16870fe2767efaeba576983b7b0c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778587879, "uuid": "7e1eeb39-e335-40c1-b801-edce7bfee81e", "value": "T1797302EAB7C1354ACD9568751C21CBA17F62CE9F21DC9DB852819E571C5E432202CCE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778587879, "uuid": "aa9db0bf-791d-417e-bbd0-ee2454517fd2", "value": "1536:sK2/oUq4TGn1YA0J4THG+iatZGR8K0ehYYBD44u+qgw09i:H2w7qG1TH/GHv84u+qgwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778587879, "uuid": "615280bd-6860-4bc4-8794-91dede067ecc", "value": 76668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778587879, "uuid": "45d78cd6-6b13-4a74-b525-576a1c765904", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778587879, "uuid": "95a1fecf-ea0b-45ba-8f51-be1f1fa09dcd", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858d1386-4e1e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778602842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778602842, "uuid": "dd1e6f03-9f26-44a3-ad00-b76751248141", "comment": "Malware payload", "value": "1939e7af29a3521261623f4fa45f1970", "object_relation": "md5", "Tag": [ { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778602842, "uuid": "612bc7ac-2d2b-45ae-a53d-dd178ea1c4c6", "comment": "Malware payload", "value": "4b080c4ff5fcfa6372f0cd23d6d6a9974086be90e4fff42afef217cc800dde1d", "object_relation": "sha256", "Tag": [ { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778602842, "uuid": "4111c404-984c-4356-a568-b32bbfeb2a3d", "comment": "Malware payload", "value": "23456d3ae84aec2707a1ab5aefdabbb51ece1ee0", "object_relation": "sha1", "Tag": [ { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778602842, "uuid": "15cc7791-b995-4811-bda4-24b5da808595", "comment": "Malware payload", "value": "f4dadce32087da433dd6ee2f4d020baa352e86fd9192ca5e9ac4e3d4504e5cc2e30496e39e6e7fd81b3ef5a7e5f00de8", "object_relation": "sha3-384", "Tag": [ { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778602842, "uuid": "c535fdb5-10cd-4655-ae70-1fabee6e15c9", "value": "T132820A263AE148FB028653A4D5CDD209DB29426F51452EA0B5ECD7C9FF3222B93F47E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778602842, "uuid": "f1101506-cd0e-4607-846a-961ba3f06b46", "value": "192:Isr0idu1hDwHzAElbmolbe2b3fk2bzA4oX/bJbsDUqvmAQd0VgDbSIfSIzFl2Pyr:IsrUwtEr4oX6/KJnjUroLgBXn8BgwBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778602842, "uuid": "d727432f-1324-4541-8abe-c9be91495354", "value": 18619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778602842, "uuid": "da7e7c11-e863-45d6-9eb9-8b5c8fff822a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778602842, "uuid": "4eeedd2b-422c-4d65-bf81-f89a9fd73fc7", "value": "4b080c4ff5fcfa6372f0cd23d6d6a9974086be90e4fff42afef217cc800dde1d.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9790758c-4de4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778577961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577961, "uuid": "d3cb437e-d297-440f-909c-3cc94120411a", "comment": "Malware payload", "value": "56ff11e3d7de149ad251b6fd7e565a71", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577961, "uuid": "d3e68512-120b-46de-97c7-fa180b986401", "comment": "Malware payload", "value": "4bfc43e2b6d565ebfda49f8561d3c87bc72e7409626cc1722d9bc3dd91f2b8b5", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577961, "uuid": "0611b379-9da6-4f2b-b737-a7cf8f132de8", "comment": "Malware payload", "value": "0dd8290b2f8d55ded464640d6f6a0c33045aaaef", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577961, "uuid": "e4f5c766-24c2-41a1-9970-c29cfda65932", "comment": "Malware payload", "value": "458f602d4c926736305a92faa8b117fa18a3ac355e2de16330f855498d6619408dd16b3a64aca63c6b2029497082a9ef", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577961, "uuid": "dfccf720-9244-4767-8d08-ff0227bc41af", "value": "T11E6423C58EA2E098894D87C0DEC6839714CAE3F6D89FC3151E17A6614FA918F24C4FAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577961, "uuid": "5d00693c-a089-461e-93b3-3cc2ef7770da", "value": "6144:jvSSCPQfRjb4hMFmtMNw7XvLF0SbIm5DILaiRr7MfaPVfrHC74Oe5lMOg8OBF:jVCYfRjyMFmIwLLF0uELHCSdf7J5lwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778577961, "uuid": "0f88fbb7-cb43-48d6-8ffb-3fbc50ed0a82", "value": 323851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778577961, "uuid": "4326d30b-f18c-489c-8584-a83db6feb5bf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577961, "uuid": "ce507061-eadd-433c-8a14-8c098f91bc43", "value": "GroupTour_22People_3D2N_Request.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe28df18-4def-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778582858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582858, "uuid": "d81f2a4f-fdb3-46ca-834a-2baaecf71c18", "comment": "Malware payload", "value": "5300df2630470a9b8f209c4af095d456", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582858, "uuid": "29575b25-59cc-41ea-ab0c-674aa8513037", "comment": "Malware payload", "value": "4c37f2239888b689d67a193bbd7864d33641c9343574412470b4f882aefbff5c", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582858, "uuid": "adefdbb8-ad5e-4398-9333-eff33ddf0499", "comment": "Malware payload", "value": "7a45734b6ec0dec521e587ecad2ed540ea5c13e6", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582858, "uuid": "7376532d-36a2-43fd-b7da-de73f015eeaf", "comment": "Malware payload", "value": "d5eedd97dfc399d62472a4399701fccc9593d818c93bb0c6b12ff1f28ff0976152339f215a67b74288f9b6fedec4e3d2", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582858, "uuid": "cc1a0f08-c3fc-498f-b6df-494fc18dc686", "value": "T1F6D1314AFCA0F813D387D81BA4279A46F206BD0B29456474BDDC92652F98436E2F31CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582858, "uuid": "4e32919f-87ab-4616-8449-a1a6fd8d0ad9", "value": "192:wSoyUIV4Q7kgUs1jU19FIPkWxa9/Em1Gm1H7J55I8Zst:Pl+EAkcWxaEmjH7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778582858, "uuid": "51890d2a-8ee4-4315-9d97-cf1b25f3ae4f", "value": 6370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778582858, "uuid": "e756cd0e-d4fd-416c-a390-1873828556b3", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582858, "uuid": "8230c7c8-f086-4a37-a4b5-b7af8cab4178", "value": "gcp.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3583da02-4dec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778581233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581233, "uuid": "320616cb-504a-4f89-a18e-a3a7fbe7c913", "comment": "Malware payload", "value": "fa99ce8b277c7234e19d77edf47b0e41", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "WebSocket-backdoors", "colour": "#D9D734", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581233, "uuid": "257fea06-79db-4b20-847d-2eaa9e2d335d", "comment": "Malware payload", "value": "4cac1e5bd56ca33fec47d51124aec568263db81dbe77179606bc2e5a585bbb4c", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "WebSocket-backdoors", "colour": "#D9D734", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581233, "uuid": "82465121-d877-4aad-ab71-960bbeabea8e", "comment": "Malware payload", "value": "d636b1fafb3798222b94463aee2e9f5d2a3924c2", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "WebSocket-backdoors", "colour": "#D9D734", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581233, "uuid": "e5f53ef5-7bc6-451f-9dc6-42375bf3eb8d", "comment": "Malware payload", "value": "9a610b5d986bc60c7e9de14c69fe947c504129886416767bc8041ab577b0a060243cfabecf6acb8625d89512b08a6888", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "WebSocket-backdoors", "colour": "#D9D734", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581233, "uuid": "3d855bce-9dd1-4162-be00-09fe5b9e71a6", "value": "T1DAC41DB1794B0A6A326F02CF9017214CB083DED9DB5289E9B9F7E31063F4CD277A515A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581233, "uuid": "7126dff5-079c-43cb-b4c4-4199595d39d9", "value": "6144:FdshcG3cFz/+eRtCDNJKTUUXBqGsVy3j/Buv5ivs03/63Ywn5S23sMt3Se3RTOrv:N+OR6lNa9Jb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778581233, "uuid": "5086a9af-cdb0-44b7-b6a4-11de885aeb80", "value": 543320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778581233, "uuid": "a1bab6a1-2b78-43a3-b0ec-6b1cb4d27568", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581233, "uuid": "3e46541c-acd6-4552-a31f-73887c5d0ac8", "value": "4cac1e5bd56ca33fec47d51124aec568263db81dbe77179606bc2e5a585bbb4c.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c21d13f-4e17-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778599846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599846, "uuid": "991990be-d22b-42b1-9fdb-227a8ac2ade6", "comment": "Malware payload (Mirai)", "value": "6242d7c479ac5908f63983d8e1926c1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599846, "uuid": "cef4963c-ad3c-4e03-a934-0147bd7a9791", "comment": "Malware payload (Mirai)", "value": "4cbbfcb1b96e393f5432ad23f84d1718cb6da34df830189c53d03a71199f241a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599846, "uuid": "3ba15bce-1e40-4dab-b136-36999bbe543c", "comment": "Malware payload (Mirai)", "value": "d34b55b1a56b8492de48e40b879e1a5e6b9a7482", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599846, "uuid": "587b50a9-3db8-42a1-a0d2-b348a9d44136", "comment": "Malware payload (Mirai)", "value": "75502e998f9f9166f95933fc13f0f5b365fb956b473fa1fb83958467976d7516c70ae976b47caedc23afd63e790edb0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599846, "uuid": "9a8fc858-5050-40e8-b81b-eab436b80b99", "value": "T104C44A45F8808F61C6D52ABAF64D42AC73074779D3EBB2069A145B343BDB86B0F3A705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599846, "uuid": "16f1c7fd-cfd4-486b-80d7-49e4010e62cf", "value": "12288:dW9UnphRZdP2l7H/RSd99gORuIGCzibxTOY8p1oxp:YOphRZyr/ozgKuI/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599846, "uuid": "0084a17b-9e2e-4c82-ab7a-dc06dfa3a2d1", "value": 571404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599846, "uuid": "1cb39ceb-e297-4ade-aed8-f0902ffff015", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599846, "uuid": "b170d237-9142-4aae-bb30-2e54e94d0457", "value": "3atoNational.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824a81c9-4de3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778577496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577496, "uuid": "c353704e-aa43-482b-9214-8c6d4d2c9c4b", "comment": "Malware payload", "value": "3e672796fb223bfa4459b4149d6ff531", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577496, "uuid": "98a2b862-0705-49a9-8948-7a701575905a", "comment": "Malware payload", "value": "4cda128af8138a1e46eee0ee05351f3b381d66315232dc0eb1f74d37a7d14627", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577496, "uuid": "696b267c-b715-42e7-9892-363c22c98d9d", "comment": "Malware payload", "value": "3ed782c824f1e68ff1b37e8d2887619abbc4de71", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577496, "uuid": "84e03b34-e97f-4869-aaf8-b66905b4547d", "comment": "Malware payload", "value": "49b64181439867052895b2c1dc227d7781a1cbcb804d06b9d4a12817f2880fc863b33eb17717b7292ec33f7edde52550", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577496, "uuid": "760708f0-3d0a-465c-864d-1b4a22b8f1e0", "value": "T1BF068D0F679306ACC276AB7CD9530A15E2357DE00BA281CF0258B7E92FB67D18EF9514", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577496, "uuid": "5f73cc07-feda-45d3-ab27-6209add23af9", "value": "a410ae650a0af67c8ef41c26a6f14597", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577496, "uuid": "5a10a79a-5ff3-43fa-8917-f609d7deab12", "value": "49152:T20uWJRoZDGpmS8RQDiw0tATbOee9rYnR8HR2Zy1ix+kc/i+70Sq/03m6OWzwk0d:T2m0kmYEf1M+qrbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778577496, "uuid": "7fc90509-9dad-410c-802c-a8f401e24854", "value": 3834368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778577496, "uuid": "44ca4f9f-2fd3-4a30-847c-63fa4064b83c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577496, "uuid": "a47b788e-42bf-404e-a89f-a61e92811902", "value": "\u534e\u5b9d\u8bc1\u5238\u516c\u53f8\u7533\u8bf7\u52a0\u5165\u6df1\u4ea4\u6240\u4ea4\u6613\u884c\u60c5\u652f\u6301\u7fa4\u540d\u5355\u89e3\u7801\u5668.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6286d981-4e3a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778614809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614809, "uuid": "0ff92580-6782-4a33-b879-8a966103a2d3", "comment": "Malware payload", "value": "c6f11b1600568d07e2ebbb645746b99d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614809, "uuid": "476c26de-fdfa-47de-8005-4d0695b21dfb", "comment": "Malware payload", "value": "4cf3aa44e1631fe0da3530081c00066ac3e8f8fa2a2c48d7f633fdc3fcaa723f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614809, "uuid": "086f94a2-2b32-49b6-a62d-addfc305eb78", "comment": "Malware payload", "value": "0535e5f58e3bb1575e66fbb9b0142f286d67bc76", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614809, "uuid": "209811fe-d141-43d7-bbf3-d592575d9e12", "comment": "Malware payload", "value": "023b18d7a2e1ef933544d95ef5ab4d805d0eb75f9fa24e01d4af61473a585a52da4ebdd0b7b1c70e3fd7609a0671a9c2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614809, "uuid": "13e19880-0d55-4098-89f0-4bdcb7aa423b", "value": "T1EC769E57FCB814A9CC5EB23486736022FE26B449D7226BC35AD8E2481F576E48B77F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614809, "uuid": "ca1ee177-8625-4c3a-9381-a4d4696ebbcd", "value": "2aefcb1f9ba02f20af1dcc4f7b816e13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614809, "uuid": "4a688780-45e9-485b-b0a1-f40ace90bbd0", "value": "49152:33x+5qVpTMXdesyjiAsALE7NTEdQbesSvamBql2ncdEa7/ahecjX/41pftVaNPCa:3esxvqgvBqDh/fr2eJl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778614809, "uuid": "8d0bc293-ad5f-43fb-b5a8-def58088f0d4", "value": 7413192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778614809, "uuid": "2b00a8cc-d9c5-4321-8a6e-d8d89801528e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614809, "uuid": "c19ab35f-4696-4032-98da-4a6fc9d4704c", "value": "google_ct_2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c4b6aa0-4e38-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778613886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613886, "uuid": "c257c718-4173-4b86-9134-b94df9db5044", "comment": "Malware payload (Mirai)", "value": "75b2a8e09d472bf21b55dcdb5426a3f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613886, "uuid": "d60e164f-acaf-4330-8ae3-fa723f9762cb", "comment": "Malware payload (Mirai)", "value": "4f5dd517d653d6bba2ecad576c1edcf88e36b1b965a155ea163220421af0b02e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613886, "uuid": "0c0d115b-9e6f-4927-8cba-557000b04adf", "comment": "Malware payload (Mirai)", "value": "7e2790b499639bd9ace1bb1ee190362918a6a027", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613886, "uuid": "2c36beab-7564-422e-ab95-21d249619028", "comment": "Malware payload (Mirai)", "value": "80638482f7e4a7424b9b3c79ecf45089b015ceb9b7994f29a3dff21e7215e615739a377581630f9b355ee312d01190bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613886, "uuid": "da08dfeb-7d3f-4e94-94eb-dbf94ab27733", "value": "T199F34A07B5C084FDC4DAC5744BBFB13AD932B0AD1238B1AB27C4AB222E4DE715E1DA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613886, "uuid": "84afc1b9-eb62-49ae-8448-a1b7907c4008", "value": "3072:/9x5IDSqXmap8WB2UnteKXUfBVvPqVQtbDd8HjWL5I:/9x5IDSqXmap8WryxxbRNtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778613886, "uuid": "dac229d0-f708-43c5-9fb8-d6c0c1e3c32d", "value": 161560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778613886, "uuid": "b964c124-4da7-4973-ba50-6dac14c9b87b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613886, "uuid": "2066200d-84cc-4954-84c9-74b851b5467e", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f03b43-4dca-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1778566817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778566817, "uuid": "7ef7de4f-dd07-4b9e-9383-1e6046ac0f44", "comment": "Malware payload (NetSupport)", "value": "0a6f59b898e38a256f5fcc81bbefefaa", "object_relation": "md5", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "jpgomd-com", "colour": "#EF52AD", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pgrsv-com", "colour": "#2ADE9E", "exportable": true, "hide_tag": false }, { "name": "pw-fantombot", "colour": "#498CF1", "exportable": true, "hide_tag": false }, { "name": "pwn-fantombot", "colour": "#BC6C16", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778566817, "uuid": "495df733-a649-4e48-9c6f-de9acb347ef0", "comment": "Malware payload (NetSupport)", "value": "4f78f07b4ba523477c9d5adcdee167cdf4d06c1ef6928fe0163da398b57403cc", "object_relation": "sha256", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "jpgomd-com", "colour": "#EF52AD", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pgrsv-com", "colour": "#2ADE9E", "exportable": true, "hide_tag": false }, { "name": "pw-fantombot", "colour": "#498CF1", "exportable": true, "hide_tag": false }, { "name": "pwn-fantombot", "colour": "#BC6C16", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778566817, "uuid": "1e8567a5-fed1-4645-acaa-e69dde42bbfd", "comment": "Malware payload (NetSupport)", "value": "739b6766220eb181f65bb605e017fb7326065009", "object_relation": "sha1", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "jpgomd-com", "colour": "#EF52AD", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pgrsv-com", "colour": "#2ADE9E", "exportable": true, "hide_tag": false }, { "name": "pw-fantombot", "colour": "#498CF1", "exportable": true, "hide_tag": false }, { "name": "pwn-fantombot", "colour": "#BC6C16", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778566817, "uuid": "5838284e-8a4b-4d11-9b8d-c236661b2d2d", "comment": "Malware payload (NetSupport)", "value": "9e512764f0a810777e1c6aa0697f99e185057f186f2e02cc23856f8e619182ade48b948638c78b27c64938fd8838b788", "object_relation": "sha3-384", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "jpgomd-com", "colour": "#EF52AD", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pgrsv-com", "colour": "#2ADE9E", "exportable": true, "hide_tag": false }, { "name": "pw-fantombot", "colour": "#498CF1", "exportable": true, "hide_tag": false }, { "name": "pwn-fantombot", "colour": "#BC6C16", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778566817, "uuid": "cf1da00f-313a-4a13-890c-4e8defa71dfa", "value": "T1116533DE20BBFA65279390D4824C8F75F4C9D9145EB90FA989DFB53A09D92F22438F10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778566817, "uuid": "8af94c86-7d9c-4072-ae71-d80eebcf53ff", "value": "24576:wbpWJTyBSJacCpygRyAPsNoGEfTOjJL1j7gXKKzGxNQqfqNOsKbyuqKrMF+p:OpwTOSJDeZRlCEfidt7gXKKzGolKbyuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778566817, "uuid": "ee3724f9-f315-49f6-88ce-d6f08a3ed65b", "value": 1459499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778566817, "uuid": "eeffa999-9740-4e1e-b9d5-bfb735b66b2f", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778566817, "uuid": "f8add9f0-bd9b-4985-9a58-e0c4bad9cf33", "value": "AltPayload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab46a6a4-4dcf-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1778568975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778568975, "uuid": "4bd8ba34-aa8d-4ec1-bb7e-ab307bbf423e", "comment": "Malware payload (NetSupport)", "value": "72d29487aa4c4dc8d4d6fd5728e4f820", "object_relation": "md5", "Tag": [ { "name": "95-85-246-53", "colour": "#A58116", "exportable": true, "hide_tag": false }, { "name": "booking-static-assets-com", "colour": "#C3FF4E", "exportable": true, "hide_tag": false }, { "name": "clietn32", "colour": "#4982D6", "exportable": true, "hide_tag": false }, { "name": "img-pulse-cache-com", "colour": "#9E63C0", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778568975, "uuid": "238ed562-fc24-417a-9a24-d010c68baac1", "comment": "Malware payload (NetSupport)", "value": "4fe0c0826bccb2c21faca5d6f879e0ab046ce7eeeb98c35e31cbd47a8c1b0132", "object_relation": "sha256", "Tag": [ { "name": "95-85-246-53", "colour": "#A58116", "exportable": true, "hide_tag": false }, { "name": "booking-static-assets-com", "colour": "#C3FF4E", "exportable": true, "hide_tag": false }, { "name": "clietn32", "colour": "#4982D6", "exportable": true, "hide_tag": false }, { "name": "img-pulse-cache-com", "colour": "#9E63C0", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778568975, "uuid": "adf199bc-2d29-48e0-940b-15318ca6fd14", "comment": "Malware payload (NetSupport)", "value": "eb478bd9a5d7bc6fee8a9e8f019faf75406a2ad5", "object_relation": "sha1", "Tag": [ { "name": "95-85-246-53", "colour": "#A58116", "exportable": true, "hide_tag": false }, { "name": "booking-static-assets-com", "colour": "#C3FF4E", "exportable": true, "hide_tag": false }, { "name": "clietn32", "colour": "#4982D6", "exportable": true, "hide_tag": false }, { "name": "img-pulse-cache-com", "colour": "#9E63C0", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778568975, "uuid": "f83c366a-3173-4ef3-a243-a254087a5b5c", "comment": "Malware payload (NetSupport)", "value": "1c703d91169739db5b12870a7bd4ce70bbcc35a67650a2b3daad2d7e01f561f8034cbb3eec196e1aad47056a1165f495", "object_relation": "sha3-384", "Tag": [ { "name": "95-85-246-53", "colour": "#A58116", "exportable": true, "hide_tag": false }, { "name": "booking-static-assets-com", "colour": "#C3FF4E", "exportable": true, "hide_tag": false }, { "name": "clietn32", "colour": "#4982D6", "exportable": true, "hide_tag": false }, { "name": "img-pulse-cache-com", "colour": "#9E63C0", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778568975, "uuid": "67455e36-25f5-4a2a-8b61-092c588b1d10", "value": "T174A533C6640BEC9ACB44CB30C04FDF215BBE2F169F963581E39A15DCAC8D9184B2D967", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778568975, "uuid": "1f0d810b-ceb9-444c-b056-92a83a85edae", "value": "49152:GaWKcquaZYrp7xngVhEBNO9GAeuAGW4XpY2F8cMUCFQOJK02f1N96:Glqu+SNWENOzeuAGrXnF6uol6V6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778568975, "uuid": "01c1da54-a507-432b-9371-1a9e3a95be56", "value": 2236373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778568975, "uuid": "6c19e4d3-39e6-4829-98da-1ad06977e6c4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778568975, "uuid": "08f90832-600e-46ce-b9c5-b9d8745edbee", "value": "AltPayload pw fantombot.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a6c0dd-4dde-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778575133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575133, "uuid": "4117026f-6516-4929-a462-063e60f04237", "comment": "Malware payload", "value": "ee4346d277995bf40196c054de1627f4", "object_relation": "md5", "Tag": [ { "name": "1-8-0-472", "colour": "#8FED1C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575133, "uuid": "9b70b3df-7e44-455f-a466-9f2cd0123ca1", "comment": "Malware payload", "value": "4ff7eec9e69b6008b77de1b6e5c0d18aa717f625458d80da610cb170c784e97c", "object_relation": "sha256", "Tag": [ { "name": "1-8-0-472", "colour": "#8FED1C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575133, "uuid": "fe433d96-9601-4f1d-823f-57556e4f8de8", "comment": "Malware payload", "value": "8ce6e138f3df020612acb0826cb952bff24294b9", "object_relation": "sha1", "Tag": [ { "name": "1-8-0-472", "colour": "#8FED1C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575133, "uuid": "7111195d-d68a-44b0-ad9c-742974214045", "comment": "Malware payload", "value": "28e11d79e98618978b7dddf78a0b3316ed32759854dbc9701d4818a835665eaf99ef5d032f913707ef36235332f920ce", "object_relation": "sha3-384", "Tag": [ { "name": "1-8-0-472", "colour": "#8FED1C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575133, "uuid": "7460ce7e-a086-4925-912a-036e5ac549aa", "value": "T1C3D7331C3F3EF2FDD5AC45391F33AA8A09981F6D079400BB1DB2178A6B945A09DF446B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575133, "uuid": "41267da0-88e9-4bf8-86db-b32a112e7454", "value": "cebbab50025aad300d9290d50864f4ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575133, "uuid": "5906997b-dfef-4808-b741-44b8e96da71e", "value": "1572864:3Hc4N+NaXiW2yoNqS9qFTJ1HloBWwYU3wq:cx7NbWTXFoVwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778575133, "uuid": "41fbf93b-e5b0-4bca-b3f4-e153ac16a994", "value": 62498304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778575133, "uuid": "ac498a0c-94ea-40d0-ac9e-3767e7603229", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575133, "uuid": "1dc445c6-d3f8-460d-b1c9-f3eb6355d040", "value": "JDownloader2Setup_windows-x86_v1_8_0_472.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a6b0d8-4de8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778579453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778579453, "uuid": "3bd6d6c0-0946-4199-b31d-6fddb1c20370", "comment": "Malware payload", "value": "a9166d74ed7d792f118531945f289924", "object_relation": "md5", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778579453, "uuid": "0a853590-6eaa-4933-8f77-24513dd89514", "comment": "Malware payload", "value": "501108663581363c57421d3022a9f23f376532c9186e541c8b7569bcc7728df1", "object_relation": "sha256", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778579453, "uuid": "77e9f178-fc2b-48f1-8fa0-310e9ecaa75d", "comment": "Malware payload", "value": "99443306d53b2a7928061e66df575cc3d742e897", "object_relation": "sha1", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778579453, "uuid": "5136d623-48b9-4bd0-acbb-a0f6841f10d4", "comment": "Malware payload", "value": "11e2da50438230e27e5b401fff3107b894903c68ff38b968dd35209ceccd05dea398454fe4d056047fa03b7bae7f9088", "object_relation": "sha3-384", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778579453, "uuid": "e50da578-9c3d-4788-924a-61719c6454a2", "value": "T1A7D5AF07E6D600D9D01DC4F48A9ED233F673344A8B14ABEF164095252B77EE46E3EB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778579453, "uuid": "7e20f748-fa4e-47a8-95fd-32921459a53b", "value": "14338d2168d869b1b53d66354179e8c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778579453, "uuid": "6cdf5ce2-0f14-4e00-830e-6316992b670a", "value": "49152:cPDtyvMYqXiOaeQ3NZ+GEMDbG7m8x7n6mfu/oBLpweNsgMzqn4RGn6xN:WSOONYbQG7m8bdazBwn6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778579453, "uuid": "dfc4fb94-d723-4090-9361-5037d41ab8db", "value": 2877440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778579453, "uuid": "c41cb40c-ce5e-4379-8b78-69e50920dd01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778579453, "uuid": "2088761d-57d3-4ac8-94df-81c3e1571819", "value": "501108663581363c57421d3022a9f23f376532c9186e541c8b7569bcc7728df1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3573e17-4de3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778577686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577686, "uuid": "15dab453-ed0a-484a-9004-8fb343f0af23", "comment": "Malware payload", "value": "89116a81978d36a0c3643e6e0e885f55", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577686, "uuid": "27876138-510b-4eec-9eef-f599f5454d47", "comment": "Malware payload", "value": "51a12a4acda3542fc5a9ea71ced1d9ba17873b397aebeed6bd78f3722b464d2d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577686, "uuid": "91cc5b9f-e5d0-481f-8977-e519282aad5d", "comment": "Malware payload", "value": "8f18d569fb2970b36e89e251f039a0ecbf3e8ac4", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577686, "uuid": "a31ac9fb-1ac0-46f9-8a34-796cdb542da4", "comment": "Malware payload", "value": "e8190ba489899a59c7a810e41fd0cda7949fce5085d26f7e101631f8894a886e9f421dd478a549637fda0743a26a4910", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577686, "uuid": "942dd107-61ef-4c99-b347-335f158b4b73", "value": "T140D4F181977B2FDE2E555ECE086E6E09498C9D322C12CCF6C9DF1407823D7D256A2D2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577686, "uuid": "42d6bccf-499f-426e-9cb0-48378c601010", "value": "12288:gZwLXcDyYynmGoBd1iDZ6qPAZwLXcDyYynmGoBd1iDZ6qPm:8aMDyrZqd1iDwzaMDyrZqd1iDwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778577686, "uuid": "a39c3c47-c667-49de-9666-45d323d29dc8", "value": 620250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778577686, "uuid": "a99db4b3-8672-4428-a012-3bcf9e1861fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577686, "uuid": "cef05c2b-a73d-47df-ab96-bd01292f44fe", "value": "u-p(1).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60e0267-4e36-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1778613231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613231, "uuid": "dcc4e227-30fc-415c-aba8-5e609b46ae3c", "comment": "Malware payload (Gafgyt)", "value": "bcfd6a6637c22eb3b353e093724397ca", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613231, "uuid": "41f2a344-95b5-4453-8539-1ccc391b5a3a", "comment": "Malware payload (Gafgyt)", "value": "52148a6136ce081a70c4888a3bb334687ca61a2ee0820760c901c306dff70cb3", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613231, "uuid": "1235d2c2-3e7e-4c65-9c3d-6ed67638a075", "comment": "Malware payload (Gafgyt)", "value": "363e7d8d3df1585213eb9cc8c4ff23adfd809eea", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613231, "uuid": "b7d8cab6-c63e-44a3-802f-86ca8fff80bf", "comment": "Malware payload (Gafgyt)", "value": "521bf6108fd8d05633b4473ae7c05f6b4d02f8e9f8c211898ed4eb13e569988434cad5c4fd2cd2fa0457550960ecc363", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613231, "uuid": "b1c48835-ca61-4080-b2ea-7f0c510d86c4", "value": "T17E3142CF1094B523B17DEA2B77B5ED885001C6F721DB9E6BDCC89539C4C9918B159F04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613231, "uuid": "b0eef44f-1cdb-41dd-bd38-e8f746b2e92d", "value": "48:SpeXph7pG3pwtpxmp5+1pmyoHp70N5psFkopOTDp1ipi+1:Su/WymeEHeAD+DiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778613231, "uuid": "4183ef0b-64a9-4a2b-af3d-936db2036c46", "value": 1804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778613231, "uuid": "3a057400-e5df-4076-b2fe-880cbdebe58e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613231, "uuid": "10eb9846-ed50-47b3-a119-32013bb0da54", "value": "zorgy.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34cdeaff-4dd0-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1778569205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778569205, "uuid": "7284e959-b4ea-4637-bf05-512894c383f6", "comment": "Malware payload (NetSupport)", "value": "8037067c39db9d8276150e7cd6a378f4", "object_relation": "md5", "Tag": [ { "name": "212-34-142-145", "colour": "#B8CB35", "exportable": true, "hide_tag": false }, { "name": "jarfsync-icu", "colour": "#C9ADF3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778569205, "uuid": "c2c473ff-ab3e-4950-a423-7fc4c8df118c", "comment": "Malware payload (NetSupport)", "value": "52425be01415a7c24b6b682230a62ad769dce317efb6959aa06f33e985f6daec", "object_relation": "sha256", "Tag": [ { "name": "212-34-142-145", "colour": "#B8CB35", "exportable": true, "hide_tag": false }, { "name": "jarfsync-icu", "colour": "#C9ADF3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778569205, "uuid": "ba1d408b-4468-4d45-88a9-79aa4e86e473", "comment": "Malware payload (NetSupport)", "value": "e63bb59d53cab16abda53e312330c1e1273832ea", "object_relation": "sha1", "Tag": [ { "name": "212-34-142-145", "colour": "#B8CB35", "exportable": true, "hide_tag": false }, { "name": "jarfsync-icu", "colour": "#C9ADF3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778569205, "uuid": "f126c5c1-c672-457a-8e7c-81c31dce65f7", "comment": "Malware payload (NetSupport)", "value": "aa902dc92e9996ddecb5b3bba4b92c1e7629bb0f326fce536a8e0d076fda19bd4b777cc7decff3cf136b02350fd79ab5", "object_relation": "sha3-384", "Tag": [ { "name": "212-34-142-145", "colour": "#B8CB35", "exportable": true, "hide_tag": false }, { "name": "jarfsync-icu", "colour": "#C9ADF3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778569205, "uuid": "b2d40a33-1d68-4c74-90f5-29df90cdf995", "value": "T1E73694D97AC457F06929DBDC824775DD1394B13E6FBB280D02E048BA381EE1766E0CAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778569205, "uuid": "1a5a7873-459f-4537-ab94-80caf4007e5f", "value": "24576:HvMxUBFAz9A8VcbKGl+C9Jw6SII8oIV4KU5PBlvsHWbNIbWyzoPB3lCt:D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778569205, "uuid": "177bcb06-df0a-42c0-8ad7-a7be7638df2e", "value": 4917496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778569205, "uuid": "df143540-a847-4b97-91af-365ff674875a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778569205, "uuid": "ff9b2019-409d-465c-98b5-572bfc5402c2", "value": "52425be01415a7c24b6b682230a62ad769dce317efb69.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25d28a9-4dc7-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778565604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778565604, "uuid": "b39f31d8-5373-445d-8f70-024d137ac8b2", "comment": "Malware payload (NanoCore)", "value": "f9f72efb065cd4e50caf347b94a59da2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778565604, "uuid": "17b98426-1106-4f58-bd42-2133a83c3981", "comment": "Malware payload (NanoCore)", "value": "53145c9d841c0d36481e776a79a284081140d0668dcc77fe68a51ac254e6738c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778565604, "uuid": "d6cec21c-0f11-4e44-90f8-a679a7b3c237", "comment": "Malware payload (NanoCore)", "value": "01ab81ba6dca7c08c0bbbefabcc64959e2fc29d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778565604, "uuid": "eb5918c5-608c-43f0-9a92-17032c3fe20a", "comment": "Malware payload (NanoCore)", "value": "1b84ecbc59adf2f08c937c8ee5ea0aa7cc7949b21dca17c82519fb411c2d79aa27f8d9d4f4f7c6ab113569d95fbb38d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778565604, "uuid": "e089860b-ba5b-4474-af46-1d34044c61b3", "value": "T16D14CF2627B84A3FE2DE85B9612211539379C2E399C3F3DE28D454B78F267E10A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778565604, "uuid": "3fa37f4c-176a-45f5-b19f-c79acbac6267", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778565604, "uuid": "e0236c87-f6f3-4e5f-88df-93f0e006298d", "value": "6144:MLV6Bta6dtJmakIM5cd4SJm9dsJz1ORHN:MLV6BtpmkddvzORHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778565604, "uuid": "0a56bfa8-5b69-48b4-adc3-fca4b84a082a", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778565604, "uuid": "a5bd7b27-61ee-41ef-960e-fc780b980016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778565604, "uuid": "ddf7e748-0ace-456a-b360-fdb26e1e45f1", "value": "pdvmqe.za.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22edd779-4dea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778580342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778580342, "uuid": "2c350b90-07ff-4cc3-b2be-ae6ee6b26b2a", "comment": "Malware payload", "value": "8fc03a37e2126e71db637a25a8dd475e", "object_relation": "md5", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778580342, "uuid": "3e9c3d6e-c669-416d-895c-b99d0c98b966", "comment": "Malware payload", "value": "53d741754f6600e42c5a03b6cbbde5ccbc390b54134a8bdbd18a625c616f8fec", "object_relation": "sha256", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778580342, "uuid": "46e23041-09cb-4f54-99cd-b795f9e05f26", "comment": "Malware payload", "value": "0850e86403c5b6352e4d1d1cd12b2668c23220f1", "object_relation": "sha1", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778580342, "uuid": "5abba940-cb4a-423f-9e64-7ce6d5378318", "comment": "Malware payload", "value": "f8cc7405fddf924275079f74a3769f44ada89f4f08ce1f49b553107733ff0ea3cc7f71a585261cba0da61b46c56766fe", "object_relation": "sha3-384", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778580342, "uuid": "1f011115-47cf-4ada-8765-73cb9fa45f54", "value": "T196934B47AAC2EC6BC8294731C5B7433923B1F295178297034D299E350EE73E06F5BAC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778580342, "uuid": "cdb352a9-2224-433c-94ce-7aa3cd43f269", "value": "7c60a9a3b63e98f57465f542cdd33aa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778580342, "uuid": "a4343cee-5f85-455b-9306-cbc61bddf883", "value": "768:X5oqP5baSLu6ilnEta7KtFYxe+tqn9N+PWv74cMgF5L9MLVHhfj4oVwO:X5oqt/Cia7iFYxlqn9H7pMGyBh9SO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778580342, "uuid": "b9cae568-5bc1-4573-9667-3c8f899ec7a7", "value": 96633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778580342, "uuid": "576a4d3d-0e69-46c3-a916-f4f3081a206d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778580342, "uuid": "8c321f19-19ca-47f0-b00b-f6170ac2db2f", "value": "concrt140.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b0cec6-4e51-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1778624716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778624716, "uuid": "d0338877-ef0c-4d63-9524-0889d53cb77c", "comment": "Malware payload (ValleyRAT)", "value": "f18c7f52c2dd557e12b0c04f1e9f1227", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778624716, "uuid": "534a87a0-c880-4528-a805-dbae991c573c", "comment": "Malware payload (ValleyRAT)", "value": "542a659bb2be59897efc121c8ade7a8a32fa00ab2bafadb3f5d05edb564e7170", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778624716, "uuid": "185f1b93-5f83-4f1c-84d6-1048ab1c754b", "comment": "Malware payload (ValleyRAT)", "value": "f6bd386e862c4055f303e8edde07889f004a810c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778624716, "uuid": "74eef16d-8905-4d21-9f17-2a466e3bd29a", "comment": "Malware payload (ValleyRAT)", "value": "b57e3668151798d5356a1d1eadc562f1ac1b55c7701c370cf01a24a2dd3e516cae58522c626462c8a03822d160e22980", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778624716, "uuid": "146b644e-0a0d-452b-a0f9-040a541c6186", "value": "T13AB5D013F2CBA13FF06A493649B7D222893BBE6169128C6697EC385CCE251D11D3F647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778624716, "uuid": "e125ee2c-3664-40e1-bf59-df4a067acd8b", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778624716, "uuid": "8bcbcfbf-1495-4a84-8507-0f61674a992c", "value": "24576:GiAxXIrKbpw2rgoR6qfd3LPtE5WEY9UtrGD9kkm6sudFCt0zwub0DKKHxsBXKmGD:exXXm66O7Tp9UK9U2CtEY1UZGpZP/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778624716, "uuid": "93f667fc-503f-4e43-b19d-0428ef8a99f0", "value": 2315202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778624716, "uuid": "30f3b9a7-d27f-4619-b58c-8ed7cc5833a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778624716, "uuid": "eb5224c5-deb6-4158-aa5e-57a946fdd3f0", "value": "542a659bb2be59897efc121c8ade7a8a32fa00ab2bafa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b098ff3a-4e36-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1778613222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613222, "uuid": "190c587a-c696-4599-a29c-2df84c34c665", "comment": "Malware payload (Gafgyt)", "value": "f9b59baf92d804f5d3990c6c1ff4c8f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613222, "uuid": "7ee0d603-1dbb-4eab-ae5d-1f7b05f7326a", "comment": "Malware payload (Gafgyt)", "value": "54c3b17589a845cebbeee2898380c72d202b4956043387b9744db36fdfd04381", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613222, "uuid": "73b2a0dd-ba19-4f04-ba08-3bd2a9ee8716", "comment": "Malware payload (Gafgyt)", "value": "77736989d45506c4ee3940f9399e75bcdf6d3def", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613222, "uuid": "82901904-3619-4d09-a5fd-5e58426e5057", "comment": "Malware payload (Gafgyt)", "value": "7e995d2b3189675bfda2064d6f803a6f32510b2a6dac03664aa44011d2e78c475d337c6b4409e18e1ea7998c46d7c527", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613222, "uuid": "9a40bd56-e020-4db5-9751-76b7821101c0", "value": "T1E3C33917F9419F41C1D325BAFB8EA64933136FF8E3EB7102D9209F60278699B0E76941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613222, "uuid": "a1edc871-e4f8-4c5a-b3f6-4d482f887372", "value": "3072:RyK9yVznJoEsaMD56iNwaQFgei/oCkRXY5hTpZ3n:RyeyVzneEsaM96iNwa8ggCkRI5hv3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778613222, "uuid": "e1f7e752-46a0-4c0d-873a-0ffad51dc08b", "value": 129968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778613222, "uuid": "e5f892ad-c918-49ce-8d90-eaf83b759616", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613222, "uuid": "5fb659de-12a8-4cab-b786-66d3e4a693bd", "value": "FBI.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de7195a-4e42-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1778618318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618318, "uuid": "1271ae7e-9809-47f4-aa03-a81307690e14", "comment": "Malware payload (QuasarRAT)", "value": "7610b701925c5c80490f673641c10272", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618318, "uuid": "5cf834c5-6ba0-4a3d-be6f-4c8669507f89", "comment": "Malware payload (QuasarRAT)", "value": "551b085148561aadc70d9868541944bc35c7bf2dd283c4fe4c142513f6aef50e", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618318, "uuid": "c5b88966-a265-457f-8031-3a053ed6c743", "comment": "Malware payload (QuasarRAT)", "value": "4f64ce7ab3c1075d4d43d05018481cf12ed5ae8c", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618318, "uuid": "a1652d96-ceba-4b58-9580-877e85a700c9", "comment": "Malware payload (QuasarRAT)", "value": "f1b9273076342aa902a5cd8ad4dd4d0b30b88b797af01cce34e0e388c12c98113f17e9de5397a0fc23e41980cd69cfa2", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618318, "uuid": "01e25026-bcce-43a7-a6b5-1b6018b6b660", "value": "T1FDC533D45A33A559F5C4CBF07BA1CF651BE7A2468C1149A4169B1CCE00E9BDAF8B23C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618318, "uuid": "c2dc22dd-2314-453b-b759-2d48432e610f", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618318, "uuid": "b49089fe-fee3-45e9-9687-51562231acec", "value": "49152:HfosQjCI7ogR3YraEqXqWyRkGjab8ab8HO3cc37OrIsz9aTgK/YHjHJ:/2eI7ogKeEwqWyRkz8O8HO3jOke9m/Yt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778618318, "uuid": "ba48ef6c-6ebb-437c-8bc0-40abf3ce373c", "value": 2629120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778618318, "uuid": "20973044-e26d-4cd9-8264-81f4c97af23b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618318, "uuid": "9ecc5220-3079-4c82-b354-94c2a3879f39", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1604343-4df2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778584044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778584044, "uuid": "a83f7315-c5e5-4310-b4b0-09d0166b894c", "comment": "Malware payload", "value": "84aac9fc26dc97981303d334f2d46bd2", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778584044, "uuid": "b08d4b98-9e58-4eb0-8224-66b15b78bece", "comment": "Malware payload", "value": "552b159317005417fe2755ff502e05c618a2f568d646d8aa61edad9e02cf16b1", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778584044, "uuid": "421ad97a-0499-4f1a-8972-7fc21c88f6be", "comment": "Malware payload", "value": "f2e5fb30522c1c5ab7e39756b7a318b7dc210c01", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778584044, "uuid": "2045f3be-6cf1-4298-8f62-c8093ddc9e18", "comment": "Malware payload", "value": "f685bae1bbcff0933288bdf277c818fe95633231cf00b882757751a5d4955aa9ad69cd25634137124fd3be21920fe98e", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778584044, "uuid": "a45124a9-8357-4270-943d-addf183cb604", "value": "T145C156D198251CC3D3C7A4558C12A2E5632BBD0FAA056C74FABC53580FCD57AE1F226D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778584044, "uuid": "1ec4f542-b41d-43da-bb61-b77db5535c15", "value": "96:kB1pgLZQWVxKQolcLjDpoTqLnnoDBpo386a6HHc/UC30fktdhEwI84+j9NXeYQOK:kBrgLZQWhicLPpo4o1po3Pd8sCBcqtj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778584044, "uuid": "0dab8050-3f8c-4421-bd95-8ce023a83669", "value": 6035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778584044, "uuid": "95c12db2-a442-4a37-9191-7004e39bb357", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778584044, "uuid": "f5462310-db6c-49dc-8a45-495465df10d7", "value": "entrypoint.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd5ef11-4df0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778582882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582882, "uuid": "59e420b3-8d56-46f1-93ba-f8d9d3ad19e6", "comment": "Malware payload", "value": "b69b8be081ea6241a2525c894ebd0b98", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582882, "uuid": "1fc54c41-49e0-448d-b674-87ee23a3edfd", "comment": "Malware payload", "value": "5774ad8f2594f6f1c34cdfb2511dc4728db7b5f4089765600d6c74a353de69a3", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582882, "uuid": "d3b717a3-c4c7-443e-9d3b-1d40d2aa706f", "comment": "Malware payload", "value": "c6ba1a1b8b95b29b8f040c149316aef2735235fb", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582882, "uuid": "6f753b30-0c9a-4460-9790-a952ced46592", "comment": "Malware payload", "value": "69eebbade876a8f63188574b17bde8e4192b41735d58cdde5f9b318fe14b45f316e928674e43342c76d39819325bae92", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582882, "uuid": "cb85da32-d295-4ac0-bea7-3e9a547763fb", "value": "T13A714152E84A2E33C38351684963D165736BBC43D3078CB879DC83A12FC613AC0A16AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582882, "uuid": "c9709785-e602-4302-82bb-8543e4164bf6", "value": "48:FC+2P+BVcS51u4gqGPKUvwT8E07imDmmYu9ptpJX96o/K7dy9JUepP2f+PHS:FCl2LyCUoT8E7mDminpJJ/GyB+f+vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778582882, "uuid": "2d1552be-0272-4bea-9366-5604a4ad6a66", "value": 3823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778582882, "uuid": "6a421724-3e5a-44f4-a27d-138378370687", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582882, "uuid": "9caa5dc6-14e0-42e4-8110-bf520fc2b088", "value": "roulette.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc3395c-4dd1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778569677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778569677, "uuid": "acfa561c-fa27-43bc-b239-aaa3318d9e79", "comment": "Malware payload", "value": "32dfcc9398750a83a25661297692fe53", "object_relation": "md5", "Tag": [ { "name": "147-45-45-238", "colour": "#0A07CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778569677, "uuid": "c3f8756a-7a49-4ddd-bcc9-92aef7e6c789", "comment": "Malware payload", "value": "58906887aae22be28e5600b49fa6b7e420a3b2e60915bfb657366ff3f8e545a1", "object_relation": "sha256", "Tag": [ { "name": "147-45-45-238", "colour": "#0A07CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778569677, "uuid": "62929210-2dfd-4a3e-9faa-bb495a543c7b", "comment": "Malware payload", "value": "1ba214ff3c0e3091b286669477c9e7f060d04a49", "object_relation": "sha1", "Tag": [ { "name": "147-45-45-238", "colour": "#0A07CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778569677, "uuid": "27b59251-efa5-49f7-8102-3d71dae48103", "comment": "Malware payload", "value": "657793c2281461344e3b37aaca4f04619b8d3d45eaf12ca39ac77ac43adb69542fb55de2be97978213247aa96f847a9f", "object_relation": "sha3-384", "Tag": [ { "name": "147-45-45-238", "colour": "#0A07CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778569677, "uuid": "89fff186-1834-4584-b6a4-53ea21413b1a", "value": "T1E4D49E677B535E20C2854373D6DB894093B8A68276E7F70E354533A628073EFDA0B267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778569677, "uuid": "cad0babd-5dc3-45e6-9a5e-e1d566a3b90a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778569677, "uuid": "d92b8afd-e94b-4939-9359-354c234fec9a", "value": "6144:2yDzg6EwPGzh7HGvaMBIEXpbUuU5pEdLOp2UOXcXrUPpGX5XjdIck9UUSpMUhpI2:2odUqpdwban2fjNNG9zhd5xcPI35FJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778569677, "uuid": "81a892b5-3f76-4812-a31e-73d8ce708b80", "value": 606720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778569677, "uuid": "002f57ec-f980-4474-b82f-74df999eefe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778569677, "uuid": "f861c86e-b503-4a7e-8b4f-86ae53161810", "value": "58906887aae22be28e5600b49fa6b7e420a3b2e60915bfb657366ff3f8e545a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c915b58c-4ddd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778575038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575038, "uuid": "83b33cec-7991-489e-aad9-6a21539b3e30", "comment": "Malware payload", "value": "c19d686e686b6b391a4e6583bc7909fb", "object_relation": "md5", "Tag": [ { "name": "1-8-0-482", "colour": "#4C74AB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575038, "uuid": "b60fd492-d8d3-4275-adf0-406d61446ad5", "comment": "Malware payload", "value": "5a6636ce490789d7f26aaa86e50bd65c7330f8e6a7c32418740c1d009fb12ef3", "object_relation": "sha256", "Tag": [ { "name": "1-8-0-482", "colour": "#4C74AB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575038, "uuid": "49ab5fa4-9c49-42cc-b853-0d17064f303c", "comment": "Malware payload", "value": "e5ac58f956fc17d07435c311fdedcd9885fbb09d", "object_relation": "sha1", "Tag": [ { "name": "1-8-0-482", "colour": "#4C74AB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575038, "uuid": "3084797e-f12d-4996-b8df-879d5dc2ca4b", "comment": "Malware payload", "value": "5a714525ffa01032982e32603a4d6929be2541f60333f8095646baa1d7c4a0d1c2cec89663283ab8bbc47e585bb7a7f7", "object_relation": "sha3-384", "Tag": [ { "name": "1-8-0-482", "colour": "#4C74AB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575038, "uuid": "eda9766b-2582-4928-bd0a-09d54c6b447b", "value": "T1D6D7331C3F3DB3FDD4AC82395F33A58A89992F2D075400BB1DB1178A6B915A09CF856B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575038, "uuid": "fe15f45f-de3b-4215-b1aa-f660fbb99125", "value": "cebbab50025aad300d9290d50864f4ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575038, "uuid": "27605757-52e6-4be5-923c-4a4a0f2610aa", "value": "1572864:MTeu9qDhWj1tA8M8S9qFTJ1HloBWwYU3wq:+cFWj1trM9WTXFoVwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778575038, "uuid": "aad69522-478a-4337-9427-a4e12ff8d826", "value": 61749248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778575038, "uuid": "fc9ce008-e4de-4d63-b93f-1a9b267b600b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575038, "uuid": "41d548fa-c1da-4af2-9add-849fe03ff53c", "value": "JDownloader2Setup_windows-amd64_v1_8_0_482.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "065462f9-4e37-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778613366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613366, "uuid": "d0804fbf-8092-4a82-8a3f-0b88c74a54fe", "comment": "Malware payload (Mirai)", "value": "2531ccc4666927b0d31eda4de69f2849", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613366, "uuid": "85e7d92c-f8df-4b25-b05f-cdc250033253", "comment": "Malware payload (Mirai)", "value": "5d0a9dda26053604a5df7952160cb94d4b60a59beb64fdc58d4b702ca8050a83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613366, "uuid": "f1c9afcf-3261-43a6-81ec-ff1029fd17ad", "comment": "Malware payload (Mirai)", "value": "59ae74ab9aec5146f910a736425e7b2ad4cc1fb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613366, "uuid": "12295587-2168-4a5b-8217-f5a92342aca5", "comment": "Malware payload (Mirai)", "value": "39962a12e22303e660c1945a64eb880da949a09363c9181e522780be7bf752a0037c90edccaf092d80a5a118577afb9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613366, "uuid": "b91c6e40-2b0a-4635-82f1-3e000275dc51", "value": "T1C6B3D94A7E04FFABC43C4F70AAA9C71200D465C5B6A5A13F32A497DDBE792131E439D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613366, "uuid": "8ae67df1-aaa6-4d9f-be20-53b82e628ab4", "value": "1536:iaNo38r5kMk2pDeGSfB4O4+DaoRJ+zmxfKauS/76XCbw273/q96j2x0u:dwUOMZpTSfB4O+LzCz/evU3y96yx0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778613366, "uuid": "b4aeaee4-53b1-4513-9bd5-3c5e9f431906", "value": 113932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778613366, "uuid": "266509ab-64ae-4861-be5b-1badb96dfbc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613366, "uuid": "7760a5fd-5fd0-40bb-a9ed-cbe4e37589a1", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f0d10e-4e2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778610038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778610038, "uuid": "068b98bd-df74-4734-bfb6-10ef54d661a6", "comment": "Malware payload (Mirai)", "value": "5630fed295a7e1237c47aba818d86d2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778610038, "uuid": "95a67e83-1564-4f56-9cc3-242895f6d9d8", "comment": "Malware payload (Mirai)", "value": "5e9572a59b634b39f9d8d10f6fb2c96c2b211dcbf291da2c2596fb04ee831a8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778610038, "uuid": "b56c1958-fdec-451e-86c2-9659df4664bf", "comment": "Malware payload (Mirai)", "value": "35bd86f488a5ad9fd03c5f8780c35f6a5ac97453", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778610038, "uuid": "e9dd9985-7193-44cc-8bea-bf24af78ce69", "comment": "Malware payload (Mirai)", "value": "dd01523f9f4915f17006b9432a988db36b6a3ac3495f40bbe36cb58fc8b8e6f96ee41ad7e812584aed83b9d98a8054e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778610038, "uuid": "6ba39876-bd8f-467f-99d1-4f5e922492b2", "value": "T19514D709AFA10FFBDCABDD3706E91B0129CCA41722A43B357674D528F54A60F5AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778610038, "uuid": "da12f2e3-4bec-4aad-9879-2d8e48cb8be6", "value": "3072:PV8yR58w9qDy5X9pZByyD8cW5kLK5kW1g5E+x1T3GAFS:PV8yRBMOpZBycW5kWXS5BrGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778610038, "uuid": "967b3d7d-f19f-455d-8a20-bbbe02feca3a", "value": 206500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778610038, "uuid": "d3a0da8e-cfe0-441d-90c4-41630f081199", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778610038, "uuid": "18959334-ebe4-446d-bea8-b95f0b2ad22e", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965172d1-4de3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778577530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577530, "uuid": "daca91c5-f420-4ced-8832-a150866255db", "comment": "Malware payload", "value": "729576743c10004de2c4168eaf8889b7", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577530, "uuid": "2c7ab323-b051-4261-b191-7d38420f6876", "comment": "Malware payload", "value": "5eb9c0577c817e6053ed0658b20e97e0f60077df817f68462ed1f3b243bc0572", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577530, "uuid": "060cddef-6374-42dc-8044-c387d5231897", "comment": "Malware payload", "value": "bc89347b7d020471cd61a751f7ce770f69dd912f", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577530, "uuid": "e6f862db-83c1-427d-a002-a7fd48c9ffa4", "comment": "Malware payload", "value": "206fa0f01e536ae33f718cdaf71f7c2368b356325f18d0e518bb638fdaebe1a1e1cb2d68463333850e9921ce863052de", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577530, "uuid": "f416c017-5538-4c0c-9f4d-3450c3aa25ad", "value": "T1114126051B6A705DC656223B9FF6190424427A7057059FC93F8DA094DDFE48FF20EF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577530, "uuid": "bbee37a8-bf15-480c-913c-ac7de5559b64", "value": "24:uBko+5Zj+qIqHZTH+VLvB6CICtRqh/YlocedaD5g:noAj+q/Y56CICtRqh/YloceUtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778577530, "uuid": "898db36e-265d-4aaf-b2bc-48c2988fa06f", "value": 1996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778577530, "uuid": "b49b934b-3d86-438f-9361-382b9a40db9f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577530, "uuid": "96aa794f-b795-40a2-bcae-47bd4fc05007", "value": "Doc_2026100500234.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a77c4ef-4de3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778577295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577295, "uuid": "ded1e700-59e3-4d77-9e37-798c753ffe75", "comment": "Malware payload", "value": "934368e8b658fbdf79e2db6e087b0c17", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577295, "uuid": "70e2d1b0-82ed-4d44-8e87-68aa5417acdb", "comment": "Malware payload", "value": "604b9636828b9fa4e65b3378a8af65c1035ba9905a72a64b760a9541694aae1c", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577295, "uuid": "022c2c4e-5f7a-45c8-9b32-f08f035f6b6b", "comment": "Malware payload", "value": "a2ce3cbbe3a50ae97a5fedfd3b5cf34f93ffb3dd", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577295, "uuid": "07649f10-5ebd-4fc9-983b-70681bc10663", "comment": "Malware payload", "value": "51f8ddc1118dbeec9c886c829c817c1b6217b88184ca7f6f9d0cd925eb70051bc1b1e49b7c0f8e3031504da9081c0736", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577295, "uuid": "f29491d2-93c5-4aae-bc25-2afb5158ee3a", "value": "T10501AC0016ED1720D3739E3788A893035B32BE02CE7BC72D0650168C6819605EE2FF37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577295, "uuid": "1ff7e943-864e-4a55-90fd-232eff2f2b12", "value": "12:8o0Olp8plbwOrUcqjANPHCfvqDjo/LhlPaMuaQdhzPNUB29+UcY:8o0OWlbZ/WApH6qA/LTaE0zP+/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778577295, "uuid": "5ef96729-9cdc-43a0-88ce-3bf7c54c963e", "value": 697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778577295, "uuid": "95a4646f-b156-4d7d-9e22-4fecfa8c4cf3", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577295, "uuid": "f5ae968a-33c7-4bf3-88b0-2750050a464c", "value": "chiraqsrc.txt.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a026fe-4e33-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778611705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611705, "uuid": "03856921-8cfb-4fd0-b36c-8460f49f8303", "comment": "Malware payload", "value": "9752daf56a72a42fb6c5e7d1f801ed68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XYZStealer", "colour": "#EF7640", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611705, "uuid": "b1e777e9-5ee5-4c2b-9649-305435748e64", "comment": "Malware payload", "value": "6122aa8c3d335f932230f7052b035117a9c00c2aae4c4e880029062cf80def22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XYZStealer", "colour": "#EF7640", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611705, "uuid": "08401bc6-1b59-4517-86a8-f8f8d6f661e0", "comment": "Malware payload", "value": "61bbb12973616485d89831f0aefab861025f30db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XYZStealer", "colour": "#EF7640", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611705, "uuid": "961b3f6b-b766-4da2-bd63-81db4e43fc6d", "comment": "Malware payload", "value": "6e06678aa9d1c81d413b5ca24dae1a619888ed799c82ccc3260879308e069eaf1b02c485e833e275f2ef6c995a9cf13a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XYZStealer", "colour": "#EF7640", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611705, "uuid": "5c12d82a-ae6f-419f-9ca2-f6453c803d7e", "value": "T12CA6AD43A5D70CEACEE7A37451C76336A734FD658A295F2B9608C6311D63BC1AD2EB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611705, "uuid": "f226bcc1-b4c2-46e6-84b5-7365c9914734", "value": "a51311d881b875863b6259c4e6b8858f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611705, "uuid": "4161d875-04a2-4e19-aca8-67cde1299b98", "value": "196608:8VNkvyQLfCPPey1SfdbdeJ2uERGO1cgMMkAquc:zvyQOPRMneYu05b8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778611705, "uuid": "ae068c34-7fb8-4306-82e4-0e66c524e855", "value": 10020848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778611705, "uuid": "22d197e9-ad93-4c8d-aea2-939e7b8fdbbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611705, "uuid": "2e054af0-fce5-4987-8efc-ce3a88e87195", "value": "6122aa8c3d335f932230f7052b035117a9c00c2aae4c4e880029062cf80def22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab219a9-4e16-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778599226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599226, "uuid": "888b8277-a667-4dda-b347-ce2d20cd023c", "comment": "Malware payload", "value": "e9a43abcaefc7501fff5d74316725c5d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599226, "uuid": "fe71b8c1-7360-49ba-82e7-46349ffe4276", "comment": "Malware payload", "value": "62277b2c953b0b375cef65e1235e84510cdb818eb7cccef4e0c112a8a9b489b6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599226, "uuid": "87f6af92-8171-4a9f-af0e-6b4e97716c41", "comment": "Malware payload", "value": "87f42a68c7c7cd713a2773ba3c1a89b4a367e072", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599226, "uuid": "b2234c09-63ab-4d35-9aa3-121d281724f8", "comment": "Malware payload", "value": "320edd968abc53da91f3713a7f502e6aa53dd748f73fcf7d5b94b6e9bfa61389f0a0c859d578fb1ebd106dc16c5101fb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599226, "uuid": "2df6a638-7cc7-4002-8d14-6297d2995583", "value": "T150926C0FB9544319D4C00474A5B2877BD6BA9876338454EFFBD88ACA1B782DAF83215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599226, "uuid": "eb11b8b4-9e72-49bb-b2fc-cbabb0ec20a0", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599226, "uuid": "373618fe-45bf-411c-a9d3-aad5cd7f755b", "value": "384:wIkj7VlvadxaizO5w5DSZvu98t2rFJ/Bwav8U9cxG:Eax3qIUG9o5a0UEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599226, "uuid": "7159b197-fece-4fe5-abad-1e731ba88598", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599226, "uuid": "af4651aa-7e63-4fb7-9536-ab20ffb93c32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599226, "uuid": "43d19acf-c212-4515-9b60-b938200df1c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73531f98-4dbf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778562009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778562009, "uuid": "7c07e329-7780-4250-9d79-52880ae49179", "comment": "Malware payload", "value": "d67c59e83c9ccc33ca035e859b0661b6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778562009, "uuid": "7ff4fa6a-7b48-4070-8aeb-98470aeb6ba2", "comment": "Malware payload", "value": "635de5830fbae76dd4fad06ab19ba1e3d10c2ebd3b6dbd92611062902748bf11", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778562009, "uuid": "64978a30-3ad1-4b6b-88c0-6e588e420d7a", "comment": "Malware payload", "value": "29cd03cc4891927249da37bdf1e8834793a6f25a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778562009, "uuid": "20746c43-fa36-4053-9dff-9cd1a12b854f", "comment": "Malware payload", "value": "9862a86c40ad019fbb69f5a98777026649bbd4100feb0e701c47467489107f4bd7e10fbe1fb4b44d06058bfb5fbe74f6", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778562009, "uuid": "21d29b2c-103e-4e35-bc07-819b6a17dcba", "value": "T18E545802A3FE9109F1F35F98BEB964654A7BFE6A6D39E06D1090064E0A72E40DD71733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778562009, "uuid": "33322998-2099-4401-814b-50dbf24605c4", "value": "6144:ljvgvm4j+CtWaRR1nMJufOH0izyh6dwnS3TVaHz1U5s0lg2+:lDNCtWCnMPH0ipd+lT6g2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778562009, "uuid": "a5113a32-08e5-48a0-8f42-857e2b789104", "value": 300872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778562009, "uuid": "ec856f43-29ac-4201-bde2-ca3a928b5f56", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778562009, "uuid": "f8695fd9-8456-4dbd-bdd3-bcfd9574a885", "value": "rWhatsAppImage2026-05-12at12_37_26.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6dcb702-4e36-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1778613232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613232, "uuid": "f13f7d3c-5877-4d4e-9d1f-2e9050203b88", "comment": "Malware payload (Gafgyt)", "value": "9c2c4f4350f319d4f26f967f3db19ecc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613232, "uuid": "817bb2b5-8df1-4ab0-88b4-a1e209177a9a", "comment": "Malware payload (Gafgyt)", "value": "6496de6f3aab639a30defdaf9571912cc16217dbcfbcf0caf77520886470981c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613232, "uuid": "d2612958-d8e6-45a6-9b67-ae4b3336c413", "comment": "Malware payload (Gafgyt)", "value": "f61de8bf5918dfa36e7756b6426827973fd3afaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613232, "uuid": "677b1956-903b-4891-bf2e-b49db56b5d9a", "comment": "Malware payload (Gafgyt)", "value": "1bdf8831e8736b48499c6e0f24959cb2e6d309a0d62c4bb145518de9c90a6ecc1d4ef7bad2016b0291e33ac8e281af25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613232, "uuid": "0a7fe2af-d8a2-4b2a-8734-ed0be1d9e11b", "value": "T164B30997F801DEBBF40BA67600A708157130BBF60E931672B2667997EE761D12833F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613232, "uuid": "aba6891c-537e-433f-9b9e-8495e872ca4d", "value": "3072:8tSZoUl+fZV8yTd0+kU9ZjFILNOxsJ3MZC91:aSS86wyTq+kU9hgnJ3f91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778613232, "uuid": "c0648f29-c220-4fd4-bf45-05139f14c96a", "value": 114596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778613232, "uuid": "c1cdd52d-2aa3-44de-ab33-0f5e588ee5c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613232, "uuid": "77c16f75-4233-4e76-a2dd-dff575148388", "value": "FBI.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa68a5e8-4de5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778578422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578422, "uuid": "97e04800-684a-46d5-ae60-270e1eb7b923", "comment": "Malware payload", "value": "82cd71c3a89aa7504556acdd12ce6950", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578422, "uuid": "cd130041-d6a3-4c1a-9e52-228750307ca5", "comment": "Malware payload", "value": "65f9fca89043e26820a45e74993c6fbd2bb2331ee848aa497c477761cf23d366", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578422, "uuid": "abc0b805-ce24-4439-bfda-aaec27393afd", "comment": "Malware payload", "value": "3098b581d756403ba289711fcda31202c1c617a1", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578422, "uuid": "b073a0b9-f771-4bcf-88f5-e8273e2f1c87", "comment": "Malware payload", "value": "6fbdb9032e59d12e5e0661fb77d2238e8c61a2ab7662a959a5ac86788b9741a8c7c273ad175abcbff91a0604a1383186", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578422, "uuid": "d78bece0-5727-427f-95ec-309487750adb", "value": "T162F1AB3EC532F890871E360457A41C5A228866A7E3B34E6CDB082CFA7975755FF14A88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578422, "uuid": "ab9d9d1e-ae3b-475b-a000-d2b8204b039e", "value": "192:plIPpCdnq3nfNa7mbCP73bhdc52uDnD/dNIKRbwrRzPCKRVoD:pcGqXQ7S4bbYZdNIowr/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778578422, "uuid": "573d087d-576a-4386-ad1d-3436dfd3f892", "value": 8060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778578422, "uuid": "374e9f6f-7705-4dc6-99e9-3262bc16f232", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578422, "uuid": "3ece140f-2579-46fb-a549-a7de3f09a9b7", "value": "65f9fca89043e26820a45e74993c6fbd2bb2331ee848aa497c477761cf23d366.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a6f4cd-4e10-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1778596659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778596659, "uuid": "5068a784-5b9a-4d0a-b127-22d87fbbef51", "comment": "Malware payload (LummaStealer)", "value": "ae33b2d9c41d58201ef09648e140cf6f", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778596659, "uuid": "bc10af85-87fa-4f69-9be7-0e6e82ef34ae", "comment": "Malware payload (LummaStealer)", "value": "66c53eff1bdeab8089fe6a9be7dade42c2234b93679c57d19cae627b6b37374c", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778596659, "uuid": "cc6b63ee-42f0-450e-a933-f3e3eb0a248a", "comment": "Malware payload (LummaStealer)", "value": "519e64019127f30cf1419480526d8712ddb55f60", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778596659, "uuid": "7b6c5db6-fe1e-4ec0-93a4-7919eef30fe8", "comment": "Malware payload (LummaStealer)", "value": "ce75875ab713833145272a48e9c5bae70222b5920818518f8815751ca88d0ea42ad5f7a923a2970bed64208dd04f1115", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778596659, "uuid": "d5808683-3807-48b9-a55a-127dc60e55ce", "value": "T1D58512037AC83AE5E8381B71D0730A4257727C78D26627EF2198B579C9F22C15F36B69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778596659, "uuid": "598db3fe-5539-428e-98d9-7c1ff42bf147", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778596659, "uuid": "7273b0f4-9260-4c3c-8a94-3c49762cad72", "value": "49152:Lj47IObNTbkU7IObNTbkbkBGZoexZjBa0FbHE/IoEyee:aIObNTYmIObNTYO69NHCQye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778596659, "uuid": "b277f274-cc15-4aca-9c98-39191f288b37", "value": 1867776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778596659, "uuid": "cf5d7fb3-9c3e-4100-872d-0bd6282d9e23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778596659, "uuid": "7c56de08-a2bb-4f0c-97fc-8f14bae6bdc8", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9567f04c-4e1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778601580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778601580, "uuid": "6d10c084-9878-46a1-98cb-931f04c0e9eb", "comment": "Malware payload", "value": "2e4be534e7f5e10d8f0dd41a36ce6b78", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778601580, "uuid": "fdd35018-ad46-4968-a6d9-ac61710e5908", "comment": "Malware payload", "value": "6759a056b8f184ca905bb62ec619be655af0626bf2cdf3f94fd122954c026175", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778601580, "uuid": "419fb28d-2d09-4be7-8ce7-d96a7b7bfa9d", "comment": "Malware payload", "value": "df673dafacf54f93ec4c44b56fa7292076439579", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778601580, "uuid": "7f7ef9b5-0874-45ca-b56e-7a9e5bc72f0e", "comment": "Malware payload", "value": "dba952552e54e5b6fb700f677aecada0d52e1bf7a61aa703f6dc62f58e4ef98a71ccae04a440c0c35b6231130b28a82d", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778601580, "uuid": "42bb1ac7-946e-42cd-9c67-21e5e35414a8", "value": "T11D663332F57C29C5E87BF879A0921A91C7D2230ED582583792A13DD876C27CF19CE19B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778601580, "uuid": "8cbf2392-266c-4537-9032-35a9db7bf4b6", "value": "196608:+Zft7fymFDHX0uU+HB/OGUElH6XU8YYlbHXU5:+BFZHXrU+h/PUEl0U8YYlbE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778601580, "uuid": "a87a8622-67bc-4946-8c7e-b7f017e8ef80", "value": 6615896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778601580, "uuid": "69379599-790c-470e-91ee-97ba607cd70d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778601580, "uuid": "dc2f0a8a-81ae-47a9-bf36-3a0343e04f8c", "value": "1gotextileltd.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d145222-4dee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778582051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582051, "uuid": "90f095bd-7f11-4f22-b683-f2625337950c", "comment": "Malware payload", "value": "6f1881aedf7d9c92b4820f0e50b4ca4d", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582051, "uuid": "7f700eaa-04a3-4f99-8a60-f83429ab50f7", "comment": "Malware payload", "value": "67970ce42cceb27a9811db863d7c217418269299ed90b38e799baf49256ebf3b", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582051, "uuid": "ddf862b7-d75c-4373-ac77-c6e561855b5a", "comment": "Malware payload", "value": "5170196ab952fe4a1b8ca96a034853a82cd13499", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582051, "uuid": "b4ec1ad0-538f-4e30-8807-bb31c1bd92af", "comment": "Malware payload", "value": "00a9111c3ad2e57a9bb39df59fcd5007380989bf13ec5bfe6023bd6efa9e49678ef28f1d16adb7e5dbd4662dcb03d7f3", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582051, "uuid": "bcffb821-833d-4d6f-b9dd-b9870d6ccff8", "value": "T1AFE40207B8899E43E50747B57F121AD92A4CBE09EA91B5B734947FCF7E30F619C9200A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582051, "uuid": "5ea03db0-ceeb-4b0e-802f-77809f038a10", "value": "12288:Zh9BbVlmyzFj1Or0Eg1q3xpLQXExwd+UU0gc/KtGUWeK9:HbDzFj1bEgshcEx5zc/KGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778582051, "uuid": "9d42a521-b203-438c-abe0-31ee75e3e0bd", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778582051, "uuid": "4a0d7c8a-595e-4ef1-8c0e-e0f5764116aa", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582051, "uuid": "2ea9f394-8864-4b4d-8419-240d4cdeb518", "value": "SecuriteInfo.com.X97M.DownLoader.2343.592.29018", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dcf8b41-4e17-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778599849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599849, "uuid": "5acd5b47-bb6d-40f3-ab5a-a04f4c0254ec", "comment": "Malware payload (Mirai)", "value": "e957de4bc71dec1883acf137cc33f938", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599849, "uuid": "40ac16aa-da57-4583-b407-af15cca11695", "comment": "Malware payload (Mirai)", "value": "6871c749163495ee0d700767c31f21d15c7bb810e951996578c5eecc69f80d7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599849, "uuid": "33a432b3-a049-4d6d-80d1-c5543517f024", "comment": "Malware payload (Mirai)", "value": "b8d2519c1a734c378092b7688290ee73a7da85d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599849, "uuid": "601787b3-9232-439c-9860-3fe4a7d26dd3", "comment": "Malware payload (Mirai)", "value": "75868a5e689b53327178a72b688855955c9f05988d01cd6c73f6e7f9603c6fe3cb91ab3bd3a0724555d2171c803211e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599849, "uuid": "a277e583-0f39-4183-a746-7c134fc6e600", "value": "T169E47C537B218FA8E361D17105E38B659AA521A207F290C2D3BCC6107B51B2D6C6FFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599849, "uuid": "09ee392a-6c31-4ace-ab52-ce3ac679aa27", "value": "12288:GAjmpSMI4I4CIUj5Qb/R5Q8mS5dgv8L6jA6Po2SjP9sI8pZH/5xy:GjI4I4CIUj5mp5Q8mG2A6E6UFoB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599849, "uuid": "259fc8d5-eefd-49aa-baf6-d077097a25b6", "value": 685056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599849, "uuid": "355a2ae9-343d-45c4-a928-1d269092c5b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599849, "uuid": "178953b5-6f8c-442b-b4c2-60f198ebc952", "value": "3atoNational.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b76d86-4e16-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778599242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599242, "uuid": "ff4decd7-2281-4535-9a4a-2b2b66e08a39", "comment": "Malware payload", "value": "87a377c75f44957814114e0f909d28dd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599242, "uuid": "27308eca-3dce-45df-b695-df95dd0c0f17", "comment": "Malware payload", "value": "6b142f44c207e4a3b63a4f8cd8ab7be6b0df2940dca49c20be97c2b47bd0f73b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599242, "uuid": "87dd7e28-1e29-4bff-8912-4cfb04e61686", "comment": "Malware payload", "value": "c5691386b6b599bd62708504d5f574a5f0ffe7c8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599242, "uuid": "e169c060-48c8-49bf-a910-85d545bd3907", "comment": "Malware payload", "value": "be571036ab428465ee966ef5fd5503868e2ec0afc4402212ca4b4a0d1d3f1b0d7eefc291dc6f8ddbf2f69af8c7c62404", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599242, "uuid": "0609375c-9f8d-4317-a671-57138f10eaf2", "value": "T128926C0FB9554319D4C00474A1B2877FD6BA9876338454EFFBD88ACA1B682DAF83215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599242, "uuid": "8d0a767a-520b-4017-b66a-26fbe5cfa636", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599242, "uuid": "488c5032-918d-402a-83bd-a3a0e5f29cdf", "value": "384:iIkj7VlvadxaizO5wxDSZvu98t2rFJ/Bwav8U9cNG:Cax3qAUG9o5a0UcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599242, "uuid": "c197ac90-795b-4e1a-9477-a5d8b50c35bd", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599242, "uuid": "0b57758d-19f9-4890-9a70-fa7525653817", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599242, "uuid": "2f53e11f-76ac-47c2-a010-cb884c5f8be6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8863c34d-4e1e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778602846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778602846, "uuid": "c84239d3-8cac-4bb4-af45-82cf6bdde86a", "comment": "Malware payload", "value": "bea2f1381ded44b1a0f233b5a29d393b", "object_relation": "md5", "Tag": [ { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778602846, "uuid": "136d0170-8879-49f0-825c-15d023f499dc", "comment": "Malware payload", "value": "6b8adaf9cb54de3c856c6ac73682d66ba3f33f760345fa3bcc26f1ba23bc6f1e", "object_relation": "sha256", "Tag": [ { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778602846, "uuid": "390d140f-116d-4216-bc33-49a696e1e5a9", "comment": "Malware payload", "value": "11f999d6cadd968d849568011e8252cda995c9d5", "object_relation": "sha1", "Tag": [ { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778602846, "uuid": "58d54997-2c16-45f0-bf45-8d26b6cb161a", "comment": "Malware payload", "value": "19d54a9989e8683dbe0a13ace74203157970408edd79c0ea472dbdb91103e144333d95de11d869f0e268e177e83f3f51", "object_relation": "sha3-384", "Tag": [ { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778602846, "uuid": "9df4d2db-cbea-4a13-a455-5dfd3ccf6465", "value": "T14382C606BAB548AA41C265ECE4CDC70CA729816721266E50F9CCC285FF26A2E53F47F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778602846, "uuid": "bc8e79b8-767d-4dc2-84e4-fa0bb361c53d", "value": "192:X497idHj1hWoh9AE9bm1befbE49dbzRTZE/bbbJbuIfvmAQT7DbSI+SI7Fr8Y7yv:X4981ttTZEjW7nIkNoLgUyUraIBlij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778602846, "uuid": "47174532-a64f-4824-9e71-472948e06228", "value": 18422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778602846, "uuid": "7cfde02e-62db-4cdd-bb3e-694c6d8002e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778602846, "uuid": "ff229078-43f9-42f5-80ac-d297527638e3", "value": "6b8adaf9cb54de3c856c6ac73682d66ba3f33f760345fa3bcc26f1ba23bc6f1e.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f979034-4e14-11f1-a769-42010a9c0008", "comment": "Malware payload (Blackmoon)", "timestamp": 1778598349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778598349, "uuid": "9171ddc1-1a74-4334-9eee-36f5288dbc8c", "comment": "Malware payload (Blackmoon)", "value": "da865bf855a7d456f30613ad6fcf7245", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778598349, "uuid": "0e017162-7c04-48e6-b10a-dd7d15fcab6c", "comment": "Malware payload (Blackmoon)", "value": "6c063317b2459fc92e19a88087cdf5589a92aca35259fc4b2e7ed7a838512576", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778598349, "uuid": "d5477ba6-0fbd-471c-8b1d-ad0dd702fa6f", "comment": "Malware payload (Blackmoon)", "value": "ac1b64b6c99f3c60a76ae45e4ece70aab7ec612e", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778598349, "uuid": "eb113325-312e-42e0-ae89-b70d9f363145", "comment": "Malware payload (Blackmoon)", "value": "52ace1277561c7e382fd3d5b731ce89c729ec3963b5ab10f99d1897ddd292b38b3a39b17f76ecd42e3ad57b4e5133eae", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778598349, "uuid": "21c7bb19-f885-4c99-9510-c971bcf7cad3", "value": "T1DA751212B762C0F1C49702755962D33EFB7062004BA9CDE7EBC46D60AD626E67A3B34D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778598349, "uuid": "636c60d5-34da-4130-8cbb-2e0d93c1932e", "value": "4712c1cff07cd671477e333c5e6ecd54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778598349, "uuid": "8cdb6550-4c29-47b8-bf54-d102db8bc54d", "value": "24576:WJHPLxGSxZHRWx8Tu10A7ykw111HZ5EDSn9zoKyk+Jz0W3PwktqgHWvGNpPXZ4jM:Wialcpx761B72S9z9yNRX/zU8En0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778598349, "uuid": "3d42dde6-efcf-4616-9efb-26ab1518ddc4", "value": 1636864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778598349, "uuid": "14351e5c-fd12-4e46-8149-2a8061239990", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778598349, "uuid": "8ea24a03-a56c-4b8a-846f-bef6d8b0c918", "value": "6c063317b2459fc92e19a88087cdf5589a92aca35259fc4b2e7ed7a838512576", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded79014-4da8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778552311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778552311, "uuid": "c44d4454-491b-4e53-97f6-cc8e102237ce", "comment": "Malware payload", "value": "0215019921a5e71c31ce5662cfb01d39", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778552311, "uuid": "9bfbce55-0391-4230-a39c-64761efa30bc", "comment": "Malware payload", "value": "6d0d8ed7f5b697dc23734a075e1c2f0854d29cd7a634b641c88d678d15b741cd", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778552311, "uuid": "44d28616-c2db-408f-a1e0-4b809211d7ef", "comment": "Malware payload", "value": "7c1a754ca0084c33ed3955473312359f6121f154", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778552311, "uuid": "8229ba38-ca67-4aa4-a3c2-4ed0cd3202a0", "comment": "Malware payload", "value": "7b977169a84a1ba110860d6a1e9711f6b3258642307e31444c485c163b7f891ca2752aca2365b2941182a02eb73ff221", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778552311, "uuid": "2fe18a44-7303-4e20-b012-f5a43f915000", "value": "T170B533C10CCBB17ECC8AC6F892D49A2CB16B3F798B72497BA7D4672C04335A85675634", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778552311, "uuid": "6a1eab51-6ce9-420a-b88f-05763bfbf5ac", "value": "815e1ba56e855b07daa7197697b159cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778552311, "uuid": "1c05ea50-cc54-4b9b-8867-3bbe3d3a1692", "value": "49152:LJuaFWZ7pu8vdF67frtbKNn6QQS1ZEgAcs9l6nj6Rat1lXr+:ciWZdu8vdF67frkiiGRatLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778552311, "uuid": "13048e31-e0c4-4ab1-87e5-209164c7a47c", "value": 2376704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778552311, "uuid": "9be62615-17d0-49f9-990d-abc6b55f5470", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778552311, "uuid": "42776eac-ad69-4a99-898f-2704f7551bad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa6c140-4dd9-11f1-a769-42010a9c0008", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1778573250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778573250, "uuid": "47803594-e3cc-4119-a7ea-620a751c3cc4", "comment": "Malware payload (Socks5Systemz)", "value": "a81b15d09d3eac24e114c73cd6083ecf", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778573250, "uuid": "d25c7496-dd76-41f4-a864-94f52950e42b", "comment": "Malware payload (Socks5Systemz)", "value": "6d3717087fba937c040eb485187f32bfac53ef227738e89880a0733e80a397fa", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778573250, "uuid": "062c709a-a8ce-49b0-b9d7-f583212b49fa", "comment": "Malware payload (Socks5Systemz)", "value": "ecfdf9be89d709c5fbf34dda9b52e600e6e6ab89", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778573250, "uuid": "8b34b86e-abcf-4be3-a343-1ecc8b8e214a", "comment": "Malware payload (Socks5Systemz)", "value": "e5ffa2ead8386f25f4908c806fda4c26774e8363cf29fe97de4025c02cc334463be9e588a6037e3ba8d446d6f33e61ca", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778573250, "uuid": "1434afba-1ea6-4aa2-912e-c31f4b91a3b4", "value": "T1E406337566A062BCF4A63F75582AE1F68E27FFC168317444324916BF7EB0283B05235B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778573250, "uuid": "3c72b490-c64e-48f7-8dff-2e7dabd518c4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778573250, "uuid": "34592a4e-984f-4847-a198-68e71ae7a0a2", "value": "49152:1v3TV6AXcv9CIF3TLr6l7+Wl0pV8ucmmEQFRcnVBTcuauzvHE9cP3slvpZIioAtm:Nh10oKjRXQHcnzcsbHESPclBZ933JOjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778573250, "uuid": "6115c7ab-54bd-4788-8bb1-dde6ebd33004", "value": 3787257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778573250, "uuid": "f67f1b68-8dd6-4e9e-aca7-43bb977a627a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778573250, "uuid": "112a7c1e-1813-4416-a98c-09cda8eb092c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9949b7-4de6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778578589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578589, "uuid": "4d4b1531-58ff-430f-ac53-3f9b4120d484", "comment": "Malware payload", "value": "adb720667db0965b3828529298371235", "object_relation": "md5", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578589, "uuid": "1854e070-a965-4e29-a26b-1728c2526ac1", "comment": "Malware payload", "value": "6d5b1b7b9b95f2074094632e3962dc21432c2b7dccfbbe2c7d61f724ffcfea7c", "object_relation": "sha256", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578589, "uuid": "3087b010-1595-4494-a764-85af0dd03b38", "comment": "Malware payload", "value": "0aca4fb004410b37ee07061b559e49d0cad04598", "object_relation": "sha1", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578589, "uuid": "6ab1cd45-bfb2-4f86-b05f-38f88bf01352", "comment": "Malware payload", "value": "ecd5ef802fa9b2997a01998697016ac8378ba68756fcc2d22177b5088a8f3d984ef1a4a52b60e7a014e61e4b2823cf6d", "object_relation": "sha3-384", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578589, "uuid": "fddbee6b-e28a-4dbc-89e5-2fb778e1c5d9", "value": "T12A3104116837444BE0B55038D1C4BB61A7B619074AF66C42766CCA7C6BFEC20A667D68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578589, "uuid": "429fec00-6478-4a42-af0b-546a1e4f9422", "value": "24:SOGlTc2JOAxmksx3q7qU327+Mh1C9xO39KF5PFMo9GkRTjr4jrdyzqLmcfCwV99D:jG62OCmt3q7qU327+21C9xzpMjkhab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778578589, "uuid": "3227e3e4-8f92-4042-8906-66401cb569fe", "value": 1717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778578589, "uuid": "10b769d3-8dcd-47e9-aeb9-a6bc74a8a0fc", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578589, "uuid": "124dd5cd-8bc8-4adf-b901-18df96d27d3d", "value": "2loader.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47ea9fa-4e15-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778599135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599135, "uuid": "0ba4b8d4-9e6f-496b-b35a-ee0d5d415595", "comment": "Malware payload", "value": "69cd627f25e1f0d3d151a0801fa51e12", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599135, "uuid": "0b083475-d14e-481c-9b4b-49d28b1b9784", "comment": "Malware payload", "value": "6de1bcd1bf22e3c388fad4d3f9626cfd648f06aab2aa829fab7448ffe73346c6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599135, "uuid": "50fa286e-7d35-4484-b2fc-473addbe83af", "comment": "Malware payload", "value": "afc4667549d9f1667979d3c72d401b9e254af689", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599135, "uuid": "2ac3a281-d326-4ea6-a947-99428a9747cd", "comment": "Malware payload", "value": "15ea28cf5349da4eda7bd0771cf97d64a48a075299d96f6d1a1f142f55de0ef07149657890ef759c7b16127c448d841d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599135, "uuid": "98373b1b-8f15-450f-9ece-9c8769a2ad9f", "value": "T186927D0FB9514315D5C00474A5B2873FD6BA9476338454EFFBD88ACA1B682EAF83215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599135, "uuid": "d43c4d72-fa8f-4eb5-be15-752359d36fce", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599135, "uuid": "fe1e2d90-dda3-44e4-9c2e-095c7ba1bbd7", "value": "384:7IkjLVlvadxqSDO5wtT0vu98t2rFJ/Bgav8U9c3G:Lqx3600G9oJa0U+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599135, "uuid": "533c994e-0858-4571-bd68-159526330997", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599135, "uuid": "29f19339-c432-4ba4-b5a4-3b50848bf973", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599135, "uuid": "784d2784-6cf1-480e-aa74-5bc7e776eb76", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17275a88-4e5e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778630144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778630144, "uuid": "2ae686c6-12ab-4dba-9d69-f9c63327d31a", "comment": "Malware payload", "value": "7aaa1a443447a413c13c42d58db69a79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778630144, "uuid": "5bd12d7c-027a-4990-95ee-1025401967dd", "comment": "Malware payload", "value": "6ef27a778205b49344615af4c6983ebe2ac8fe89738eb44c202fdefb0fb40cc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778630144, "uuid": "a3e4a315-0adc-4394-ae69-ca4282217a3e", "comment": "Malware payload", "value": "51b97cfe8af4d4cdaaa40f98bfd7816d5fd04b28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778630144, "uuid": "c1878422-0fa3-4e61-ac65-3a3cc5bc2747", "comment": "Malware payload", "value": "841df29dd45302a65a338b59288926580c41d86f1f043886ddde27ce52ebcea2f2194febf3dca746fb9501ad702b3840", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778630144, "uuid": "55032758-d6d4-496a-9235-dafe3a4f1b3f", "value": "T10F05E757A89550F4C1FEE134C666A213BEA13499073427E76FA187F10B26FF86A7C318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778630144, "uuid": "57de2dd4-37d6-417f-b858-82408d537114", "value": "24576:ci3nHRD3wC7g9rb/TBvO90dL3BmAFd4A64nsfJ7Fx:c8nxDgC7g9rb/TBvO90dL3BmAFd4A644", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778630144, "uuid": "b1199a31-f6d3-4597-801b-a4ed06faddbe", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778630144, "uuid": "41d04d2f-384b-4592-a61c-9b4e1d9ea346", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778630144, "uuid": "98febd4b-9636-4c0c-92b6-75bb31c9387f", "value": "6ef27a778205b49344615af4c6983ebe2ac8fe89738eb44c202fdefb0fb40cc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e576c63d-4dff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778589688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778589688, "uuid": "7d54eee7-b67d-4ad8-ba67-5bc112738a39", "comment": "Malware payload (Mirai)", "value": "91edc899b9d22c78f15484914ef6dfea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778589688, "uuid": "54f13707-d741-4089-8e36-6ec6f9a2ca6b", "comment": "Malware payload (Mirai)", "value": "70cee0606803245e03000daca21d79dfcd7a60a6a8c2fa5d573977b4db7bdac2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778589688, "uuid": "80151300-0a51-4f80-a15b-b4f1aacef2cd", "comment": "Malware payload (Mirai)", "value": "31614271eb258aaf35960999ff553271455eb35c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778589688, "uuid": "b2637253-bb7a-470f-b09c-5bd106004b3d", "comment": "Malware payload (Mirai)", "value": "5b3de454fc6e0affbf5a28b127a684082dd57b671b7a359137f4d6234aef041a2cfe9a611d9ada4bb9a7cb5630a6076c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778589688, "uuid": "153d003d-d826-487c-aa3d-8ba8f614a2a1", "value": "T14644C64F6F229F7DF269877547B38E24975823D616F1E680D1ACC2005E6438E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778589688, "uuid": "e6dab18f-47f0-4808-b1b2-76c683772942", "value": "3072:hQRAWezZcJJTSmDayBPRXR1Pcd8aQ5UjDpBod9OhixXSO15QCql6Hiimr7:haFezZcJJG7yBXSLaAKmiH58l6C/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778589688, "uuid": "b46c3f3a-faae-458d-8aec-c15db75b428d", "value": 266032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778589688, "uuid": "4a3e55bc-8eea-43f6-a622-96ce427e38d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778589688, "uuid": "a52f3c7f-c5bd-4909-9a2e-e862dbba918b", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f68adee9-4def-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778582845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582845, "uuid": "4f0b43be-7a6b-41dc-a8c4-827a94a78f66", "comment": "Malware payload", "value": "9f4b14951ae39bf81553c4bfbd291625", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582845, "uuid": "3cb63887-eb85-4131-a9d8-b484c38f0e5f", "comment": "Malware payload", "value": "714152c0489c3d8d9196305efa12a6850e5d460ab62ff3be91caf3fb852ec793", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582845, "uuid": "e7c8850a-99a9-4a87-8780-baf1f7790749", "comment": "Malware payload", "value": "e04ab4c0cfca07c952d914b3365a962a68290d09", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582845, "uuid": "b7ec7313-6541-41ad-b796-23940b0be534", "comment": "Malware payload", "value": "7b37b35880933654d170f12401884e7dbfc79c19c7e1d9f65d61154864819eee6629b5061a7ecd9152362229f0e597d8", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582845, "uuid": "6d76e235-81f8-4a0c-a553-b05af6c1b7b5", "value": "T1E811933A0D125F949408D6186D2310EF839FBA2B5E2C70A1C6DB4609E18826838BCB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582845, "uuid": "61da8b72-8842-483f-bd7d-9b9ea8decf93", "value": "24:XZN12L9r6TvW9XPxCHQzMZv6VBBZjjbvaEoTaKeP50KSm:XZuL9r6DWVxKQzMl6BLjDaEoTnq0K9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778582845, "uuid": "a6ff2cb5-a633-4f80-ae59-366ad22cfdeb", "value": 1100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778582845, "uuid": "941a10c4-548b-43d5-8d44-e042687c0918", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582845, "uuid": "1e8f26eb-b531-4135-948a-ec5884bd29bd", "value": "config.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eafdbdc-4e17-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778599851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599851, "uuid": "1afa9177-a498-4dea-bcd6-36745512b0b8", "comment": "Malware payload (Mirai)", "value": "bc47641abc36f0323d7059005ac68f31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599851, "uuid": "70bae100-abc5-43dd-9e9b-f69a0b9d6f84", "comment": "Malware payload (Mirai)", "value": "7193c33dbb432ee106450b2b6d9d1f3ba918b702844a69f322d293890f83b3d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599851, "uuid": "ee08e5c2-6125-4a85-8435-b02bb47ec815", "comment": "Malware payload (Mirai)", "value": "edb489579296816af7520b6d71f94c62a70ba187", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599851, "uuid": "b7ff4624-6a43-476f-ac6d-9f88ff31d93c", "comment": "Malware payload (Mirai)", "value": "ad7f52b60cb159c5980be97adfc77f3c5999010c6dc18b2cfcfda97a431a8a1aabf0d0a6028091aab37ac3544a5abaee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599851, "uuid": "c9afb5c2-32e1-454f-9126-d34e498ecd94", "value": "T1D0C43945F8809F61C6C529B6F64D42AC731747B9D3EBB2069A248B3437DB86B0F3A705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599851, "uuid": "a217b0b0-772d-4bac-a722-a1f4e066b282", "value": "12288:mbI4/8tPeXe2k/q/d4z1poDwTVj+HG/KGF4oB8p1oxB:mb3/wGXe29y1eMTB+HOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599851, "uuid": "9d92dfdf-7046-4a9c-bb34-9d22788d41ad", "value": 567312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599851, "uuid": "4a0943ec-3625-455e-bf98-082b67da8f6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599851, "uuid": "dc2585c1-5438-4592-9175-46d428e306d5", "value": "3atoNational.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818f6a68-4de6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778578783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578783, "uuid": "de712b42-4858-4912-88be-41e00a585c55", "comment": "Malware payload", "value": "110b35fbd9f49e4c1f84282b5d198447", "object_relation": "md5", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578783, "uuid": "cde39d65-374a-4ae3-b7bd-f07b4c36a83c", "comment": "Malware payload", "value": "71cb918d22e98ac486e6f1142530a1529f198ec8c982da595e24d75e9c1d1c43", "object_relation": "sha256", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578783, "uuid": "f288107f-c160-48ff-9b46-5df4ad6bfc0c", "comment": "Malware payload", "value": "762692abf948b60d068f2dbd260f847a26c4c977", "object_relation": "sha1", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578783, "uuid": "ca47c6f9-6db6-4c5f-8cfd-b177f3c4eac8", "comment": "Malware payload", "value": "705403acafd5d63b4daa73def3dd798ae17eb62d82fc1b5d43e6c12d02f534f2949eac0281000af0b85edb2ea5cc5c66", "object_relation": "sha3-384", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578783, "uuid": "2699896f-bf21-477e-941d-c4966a8e9b45", "value": "T104316533DE1860E8C3855790B4E632CCA46B514AC297705450DCEA5AFE81FD9096B3A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578783, "uuid": "db4b27e4-13d4-428c-9f62-a8bc5c8653af", "value": "48:dwKDpsThCmsBJYtFe/yVzH7WbMWbtWtPW:espsT90JY4yVzb0Mib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778578783, "uuid": "53063592-ba75-414c-a725-b36f3fda34a5", "value": 1798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778578783, "uuid": "f89ebd4b-34cc-46ae-9f95-6b8e2b9ce200", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578783, "uuid": "5f7fec78-e6c1-472b-ad31-023d277875ae", "value": "71cb918d22e98ac486e6f1142530a1529f198ec8c982da595e24d75e9c1d1c43.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f91a751-4e17-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778599852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599852, "uuid": "eb4c15af-c5dd-4d7d-bc2c-0057a7f933e0", "comment": "Malware payload (Mirai)", "value": "988ee36f178f8f055230a5cbf8f6abc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599852, "uuid": "a9bf4f02-81aa-45bf-9e4d-41434314c044", "comment": "Malware payload (Mirai)", "value": "71cef7380cb5a7d7e4e2eb63ee59f730eb6605f3cf6eab2923e20da2f8c683fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599852, "uuid": "4a1a6adc-3b5d-464a-a9ed-bb7f748a7195", "comment": "Malware payload (Mirai)", "value": "dc08721ac8c72bda80d10fff02917260e9c1aa99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599852, "uuid": "c650fda5-5f15-4d98-9fa6-7e3cf73a6c03", "comment": "Malware payload (Mirai)", "value": "71dc98b5f01a9341c4352c6ab2f3d7f58eca255025240314f6e4b6c0c62a553d503d853c67df221fd42b4fd90a8a8098", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599852, "uuid": "1a6f4b5a-7880-4152-ac3b-1630114b3f46", "value": "T182E47C02EF841FEBC4AFCE30852E835B15DDA99706D1A778A1BC8D5CBA4D6690FC3458", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599852, "uuid": "6c75c2fb-4feb-4dd2-bddb-414895ab9023", "value": "12288:ZfojS0w8u2RCYgTJNGyBmtwFNGp/A3LZ69kzBviqODo9aYV/rtRsvrb+6XsmsYJ/:j+a8riUvCA0gF5lLNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599852, "uuid": "83066821-4f55-4c93-a397-4a0e5601c0d3", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599852, "uuid": "479c1f46-150b-4b5c-ae48-65802516a538", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599852, "uuid": "bec25a31-c60c-43d5-8661-8cf0d4ff3425", "value": "3atoNational.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a3a6ce-4de5-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778578465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578465, "uuid": "f558bc48-e07e-41de-8526-4139be8c6039", "comment": "Malware payload (AsyncRAT)", "value": "c64fbfe4bf22012fb43c9a6f5e4b36b7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578465, "uuid": "dffcd308-f75a-4233-abfb-5e61990affd8", "comment": "Malware payload (AsyncRAT)", "value": "73690e32177b11e117d5e13867bbd6fe5e95450c71322de56dddc82bf9f0b5dc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578465, "uuid": "2b43f3b5-d2d9-4374-8f4f-cd923c6f2368", "comment": "Malware payload (AsyncRAT)", "value": "6d79432e43aa466100783d67e10bb5e1d93b3ac9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578465, "uuid": "1a34f012-a029-40e8-8533-ffab9f6c5775", "comment": "Malware payload (AsyncRAT)", "value": "1e480e133d6cfa96e895d60fb792f090e6cfc38f0a18c9d9d99eacd83b26a63b7ddd342630447f953c316e61a73b8b1f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578465, "uuid": "5d5523b5-222b-49a0-9c39-faa3a5c4c9e2", "value": "T166057C16E7E416B4E63BD238CAA64633E6B678450770ADCF0258D6192F33ED06B3B315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578465, "uuid": "1b96a5d7-4fa2-4986-8ba8-e835f0504178", "value": "d4652face233fd6b259d63f8abb6894f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578465, "uuid": "6abfecf5-1386-419d-bf44-7d23e7dfe5fd", "value": "24576:mvFZ7RU/5ouxIxvVC22vdF4+BVDhnD23oxY9GAvP9BLBB:mZi/5FxnF4+BVda3tAAvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778578465, "uuid": "d55e8364-4efa-4dfe-b6df-aac9e72123d2", "value": 814747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778578465, "uuid": "b623356b-20ff-4409-8487-ee753bcad9ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578465, "uuid": "75ea15bd-fecf-4d17-bc0c-5a9e1e40b671", "value": "dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d0cee1-4dff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778589454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778589454, "uuid": "8e108e33-d008-4c6d-b2ee-bc9ccaf06dca", "comment": "Malware payload", "value": "04b7dd7f3eca27a82d6ddc206b8e2528", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778589454, "uuid": "332c1632-4608-4fae-8aa7-eaeb24ce5baa", "comment": "Malware payload", "value": "736e8835ab03dd6c4f5d962cebd6781d535d9871f107cf1b926e9434d395d24c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778589454, "uuid": "ac698b4f-47ea-4547-ab01-d4c5c6e8d2c9", "comment": "Malware payload", "value": "3b32d93bb7b464b2fe5b6f9e627016f84ce65afe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778589454, "uuid": "280670a2-e812-4617-b6c7-07dce6e9547e", "comment": "Malware payload", "value": "757aacb684ef44ce7abcae98633e749593bc1717bebb364743dd835b8047eedd5105758b84bf30aa3f0daad0eed66d92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778589454, "uuid": "41efde78-6260-46d2-85f7-9a5306d5cb17", "value": "T19718094A7F42CDD2F506827598678B907372E8B50FB083033169372CEF6F3999DA6598", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778589454, "uuid": "64bb4591-e6e6-4884-9d70-67a9d4263b82", "value": "a5396d0e3a0b90f35cda230c0314ce27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778589454, "uuid": "97f98bbb-d685-4b84-80da-9b29dc9ab9b3", "value": "196608:McUkm9h7c2Q2zvsydRQi7ZkfvVsy6STxa0dEBqtiEPFNPyDhCC38C9WCk3pNjgJ+:MxrQUQi7Jyjhd+Dhh38Pg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778589454, "uuid": "ff0603ff-dd84-40d7-a029-2a1fdf0ab3c8", "value": 89257924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778589454, "uuid": "5283f3f9-81ea-49eb-a5fb-45d3b1435653", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778589454, "uuid": "193ab48e-953b-4cba-b21c-c73f0ee514d9", "value": "upz8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c6dd82-4e39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778614306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614306, "uuid": "ea217c69-58a7-4e32-8083-14153ed5eba1", "comment": "Malware payload (Mirai)", "value": "6d41ecf6f3346de7d60a2d70ab821b1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614306, "uuid": "3434c16f-dfc4-49e8-ae70-63efb17b12ce", "comment": "Malware payload (Mirai)", "value": "73afa6e3887e0429edc33669952dd61ef0675c94010706ac4446a8bb2225dea9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614306, "uuid": "91c5bb56-1259-4114-ad41-f10fa2031a8c", "comment": "Malware payload (Mirai)", "value": "268a93c83a28739e255260e4ca3a47997e073ff6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614306, "uuid": "95ac842e-977d-463c-81ac-4aa16237daf6", "comment": "Malware payload (Mirai)", "value": "61ab741de2129bebeb4bb9f74d02db954a6e978fffb74bffa725fbe9284709af86807fb09d39676a16505e005a67ba2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614306, "uuid": "9752a071-03b4-4f77-b2ca-895e126cee69", "value": "T177D3F649BD819B10D9D635FAFE4F028933971B6CE3FA7202D9245B2127CAA5B0F76502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614306, "uuid": "3da69aa2-f866-4502-b73e-82a39b5f3458", "value": "3072:JUZoHwFSRkcUHdgZzQH2uFuaOk/ZzVWafIrqn1Nzqtq/:moH3EgZsH3ka7/ZzVWafU6Nmtk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778614306, "uuid": "f82a4e93-0003-4f01-a41e-5b4420a75e59", "value": 140952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778614306, "uuid": "f44a41f8-4e58-41a8-ba26-ef1ac956f5ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614306, "uuid": "3fcbc663-e3f5-458d-90b9-2647b0d6318c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b75d4c1-4e39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778614367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614367, "uuid": "f24e83a3-5ac7-490d-b4a4-481b429d305f", "comment": "Malware payload", "value": "30fe19b7c1fb0c7619c69325ddcd0cbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614367, "uuid": "38c94b4f-4021-4c79-b408-91268231b88c", "comment": "Malware payload", "value": "7407a678cff20bcaa44835b53a7d71eb72b23e83fbb4040a83dbb4f233b00c9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614367, "uuid": "34376259-295b-42d6-8f25-4c6606ecafcf", "comment": "Malware payload", "value": "f3ea4598c6e838c78fdd449ed107eaf30d7b699f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614367, "uuid": "e9834b21-7d3c-4640-b9c4-641c8eb270ca", "comment": "Malware payload", "value": "56c91bee77e3d6bd0e45d0641e82fad10fdbab963f08f5f9572f40552937d27644856e1abf732af367aaab0a2da58866", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614367, "uuid": "d0a37125-6369-402b-b685-c1131f7fa2a6", "value": "T15424A61E6E229F7EF368873047B78A35A76923D627E0D644D1ACD1105F2039E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614367, "uuid": "0e4d2ab5-3993-4b25-b723-44e811f7fc99", "value": "3072:AzjaduAuMszUIaRiSrJz/cU9PSa5iCbu3xiEuf75VSeC:AzGduAuzUIaQSFf8qib3xc75oeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778614367, "uuid": "c3465965-202e-4044-9846-7585695fe599", "value": 217084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778614367, "uuid": "a5c15d3f-abfd-4c88-9faa-94117e83e638", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614367, "uuid": "a6d2d418-0ac7-445a-841b-e340eb36b7c5", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79091d38-4e0b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778594660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778594660, "uuid": "a23b7cb1-6cf4-4ec0-943d-2d3a31f0ab5d", "comment": "Malware payload (Mirai)", "value": "004207e2c39db5a8f176ed0486066d2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778594660, "uuid": "4be32c54-8ad1-468a-b3ee-e180c168041b", "comment": "Malware payload (Mirai)", "value": "76c9ac8f0603993bf3612f0c91106f649b652741480d461441687df9994d5e79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778594660, "uuid": "b5b711ff-db6b-4c57-8b4c-2cde2c24d357", "comment": "Malware payload (Mirai)", "value": "03056d0b0daf32f68ee0eb1130c9fe2db1b60be2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778594660, "uuid": "ed24532e-1f1a-4082-80cf-aebdd4a74362", "comment": "Malware payload (Mirai)", "value": "4e4a8fc0174885dc14426de310429061138886d7ba7d2f24555fb0f2909e05973aa4ac9551a912418f4d1976c532f21a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778594660, "uuid": "74a50b28-4f8e-4cf0-868d-bf54d6f7e183", "value": "T173244C83B905DEBBF40EA77604D307217272FB6549431A32B317BDB5AA3A3D4242AF45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778594660, "uuid": "f27a5b51-ee8e-404a-bf85-074f26dcbe33", "value": "6144:P3JBwlW3WjyLJyIlRhxTgj7L2vJ0PfY4KH+Ehh6a1A2nONsl1:PZBrxLh0nY4KH+Ehh6a1A2nONsl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778594660, "uuid": "30e68db4-4b50-41f0-91b5-be9344b8268a", "value": 227712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778594660, "uuid": "3cd2ce46-145f-40fb-b46f-97458c97c48e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778594660, "uuid": "b8e85251-3f35-4748-91ad-7c4f3ea81b0a", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec19dd0d-4de3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778577673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577673, "uuid": "18f0ccf7-aa5f-4502-850b-58057840bc35", "comment": "Malware payload", "value": "8a5dadc5faf424df1e8a0efad023df81", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577673, "uuid": "50b220ac-57b4-4848-87ef-2a894b45649a", "comment": "Malware payload", "value": "7709d8c34d490509f3624104611eb75a862944dd9d7a642f44514ada16c85ee9", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577673, "uuid": "ff37f321-7a76-4dd5-afa5-763e1180b064", "comment": "Malware payload", "value": "4a1a6ed11fd50b621659d7976899d050ba2e15d3", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577673, "uuid": "6f5124ea-f1e5-467c-af8f-d4d9c3e7cd61", "comment": "Malware payload", "value": "ba88946ead46de794e27fb533b4bdc5862fb4f5a034d30a02235e6571c14f6e61c0ccc66d3b8aeb402dfd175d1242c9e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577673, "uuid": "b79098c2-af79-456f-8dbb-e503b5269ff5", "value": "T15255F196DE2F2FD77D3D4948086E2F5B4C4E5D212D1398E6CABB104B8614FE742A182F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577673, "uuid": "accffec4-26c0-47b2-8a64-e5fb77c5b44a", "value": "24576:K+RHJVyWJ+RHJVyWJ+RHJVyWJ+RHJVyWZ+RHJVyWJ+RHJVyWJ+RHJVyWJ+RHJVyy:Jz6z6z6zqz6z6z6zL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778577673, "uuid": "9387468a-7eee-490c-9e78-731d33fedb76", "value": 1346017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778577673, "uuid": "1e4a0248-3cf0-44e1-a4f8-13def2b715ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577673, "uuid": "6763680d-f9d5-48a1-8ee9-f4cc152c277a", "value": "ud (2).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f2960ca-4de6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778578618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578618, "uuid": "d179ecad-725b-4237-980d-f1cbb9abb10e", "comment": "Malware payload", "value": "f5a2612903efca73e5e63e7b77a6d22a", "object_relation": "md5", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578618, "uuid": "f511fec0-68be-4ff0-bd4f-4daaa7c85c92", "comment": "Malware payload", "value": "78208c6dcae5099a407b81d257948d2ad571b4a01ec0a6573b4c3a161787ee38", "object_relation": "sha256", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578618, "uuid": "a9386bbe-c925-4941-8840-e02f280ec8d4", "comment": "Malware payload", "value": "6b915262032d978c228b31719e6a57ea35ee3f1b", "object_relation": "sha1", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578618, "uuid": "b434dcca-bd09-4d8f-a2c1-1ce64154e5b8", "comment": "Malware payload", "value": "528049766cdea8a9676171078a94fc8464609e4631a4fc721c0492b9189b0d103b238d825b6efcb577ccb9cd753e84f3", "object_relation": "sha3-384", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578618, "uuid": "2fbb64c4-45d4-4f7b-bf41-40ceca3bd275", "value": "T1791184A5926D3D68E096EAB5904B6F836D216E134028BA4B83D24C861FC36E6C74B9C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578618, "uuid": "68a67af3-0c2c-4ce0-9096-3d8ef27c4023", "value": "24:9kz/0BrdL0L/cpZmVL7LzjL8bdjdBWpvqY6chxUnzaW3h:9G/T/kZ+Lz8pj4nqzas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778578618, "uuid": "cb42c081-8c0c-4cd4-8e1b-604d44266ca9", "value": 968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778578618, "uuid": "ffa65716-9667-465c-9bf5-40e97fc24a36", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578618, "uuid": "b3aaeb5f-8d55-4853-b769-3464660e7bdf", "value": "2loader.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28fef15-4dfa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778587428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778587428, "uuid": "5356d510-5435-4b95-b462-70924c76191e", "comment": "Malware payload", "value": "abf5f8237b0fcb989cfd5d4f372b2e58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778587428, "uuid": "fa4cfe9d-53e3-4e8c-a3f0-16e607df1b7b", "comment": "Malware payload", "value": "79c131e66bd132cec01935296fce8326c5fda972d830b8d53555548ad9dce6ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778587428, "uuid": "fdfa0f5b-1f27-4263-8059-e25b9073d8cb", "comment": "Malware payload", "value": "5d862fecd1d71ac96d025c287ad8a69474949987", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778587428, "uuid": "54d0721f-9608-4f12-9507-a839359380ca", "comment": "Malware payload", "value": "8fe14c2bdae60dd28b808a52f199c4a0536d8a70774eb701d2800ee35a45a304a02bd9933995779daacefa3e3f5fed5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778587428, "uuid": "ad72f990-a6d1-46b4-bcf0-fbe19fa799fa", "value": "T1ADE55C17D66F5B4D180A3B61106A5D9AFE89CAFCEF726BC4E0CF90B210EE1110B855B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778587428, "uuid": "9bbe0a96-8544-49c3-8b68-5490d31ec8a9", "value": "49152:YTd4SulqG11YKzqmi85B2FHgRXD9DpmrNmBhSGUw7xNEoRxx2Nht8RvVbT7j:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778587428, "uuid": "5ab6b266-ae10-4f57-acd0-7bb9b4720539", "value": 3105913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778587428, "uuid": "e17b4b41-26d7-49bf-a682-ebc0a1e87e6a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778587428, "uuid": "bb13c922-5c7d-4e5f-a6ac-c0fb2e824be5", "value": "REQUESTING QUOTATION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a91e77-4e43-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1778618579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618579, "uuid": "df8b2a8b-6cd0-4f3c-9eba-3423087bfab2", "comment": "Malware payload (ConnectWise)", "value": "4b6a035ccce69449a67f21a5a6586ddd", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618579, "uuid": "47bf8645-347e-411e-9759-9114258ca7a8", "comment": "Malware payload (ConnectWise)", "value": "7aa3e6f815f9187640aa09543f8c350fa38bd496ca125699bf36f291cdd65eda", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618579, "uuid": "da297b2d-6849-4b17-8747-b896c2ae5800", "comment": "Malware payload (ConnectWise)", "value": "abd976ad30355f4df3e276c9f5ebcc5fd9dd0950", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618579, "uuid": "c274b1e9-0650-47ab-8dba-7ce8a75cec59", "comment": "Malware payload (ConnectWise)", "value": "1c02a3ffd3cfb81800eb71741b145c120a3da6c76c97d7757328f9cc0a85109101fdac50c038e52e73b38aa67e03ac3b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618579, "uuid": "e34de3c7-0c96-43f6-9358-24df504fc2d5", "value": "T1F6D61211B3E595F6D0BF1678E87A92655631FC044722C2AF53A4B96E2C32BC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618579, "uuid": "bfd22952-0a75-4513-bf67-6b248df2a747", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618579, "uuid": "b12ddeac-eadb-4e3d-95b6-8842619f3bfe", "value": "393216:VCXvI5MvHx9JNCXvI5MvHx6CXvI5MvHxfCXvI5MvHx6:VZ6HxFZ6Hx6Z6HxfZ6Hx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778618579, "uuid": "045ba766-51a6-4070-9357-4f50d644b93a", "value": 12762168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778618579, "uuid": "bb8f4351-971e-4875-8ae2-a4c968542a39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618579, "uuid": "50b7c3a4-4d32-44cf-88d7-55082fe7f0d6", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b284bfa0-4e32-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778611507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611507, "uuid": "d829dc02-091a-4fe0-b1b2-edbbc334c84d", "comment": "Malware payload (AsyncRAT)", "value": "af4f645e046597f489815285ad187f78", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611507, "uuid": "fe35dd76-af87-4745-a308-d7c1ba9e2f5d", "comment": "Malware payload (AsyncRAT)", "value": "7af19fd50abaaa9bd360f2d2a6ae06a8f095c1d9533b5dfc7df496eea527d762", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611507, "uuid": "cd785bcb-232e-4f0c-8f63-87c6e4f34a5f", "comment": "Malware payload (AsyncRAT)", "value": "ffd653016a316c98b4b09a967d3e76ffc9284843", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611507, "uuid": "94ecaa57-400c-4a7a-85eb-2e089a1be05b", "comment": "Malware payload (AsyncRAT)", "value": "8143d65acc06ac423a8c35463753a501ce4a25a2876a6093ba24d73b181b2d351adf79bd24dfe06a617d432547dc6548", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611507, "uuid": "026a8875-063c-42f9-b227-1afe6a6da6b0", "value": "T12BB31900279F9177F17D9F7484926200C17EABB7B323C45E388865D976E378267C27AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611507, "uuid": "6412e376-6367-4870-994e-79d58f843f12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611507, "uuid": "19049b68-f120-4803-9186-4bb4f640ca80", "value": "1536:Mu/dRTUPE2hJRRg2WvO1bCBQ86tbdu90vG8rPyQ8QlD+zVS/TRhjY/F:Mu/DTUPE2rRRRWvO1bCB6bnNPY/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778611507, "uuid": "b24cd666-b3b3-41ed-b53b-9c614aed5cc1", "value": 116736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778611507, "uuid": "3910f32c-00c7-46ea-9a8e-af456b66eed2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611507, "uuid": "d58e5b92-c912-4747-af94-2cb47b161b15", "value": "7af19fd50abaaa9bd360f2d2a6ae06a8f095c1d9533b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975980be-4df8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778586551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778586551, "uuid": "5b929db1-27e3-4e1e-96b5-db1d959e8cd0", "comment": "Malware payload", "value": "16e47ad87b5ce6cf5b116736194c39f9", "object_relation": "md5", "Tag": [ { "name": "84-32-22-130", "colour": "#27840B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "submit-data-com", "colour": "#32E759", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778586551, "uuid": "744b15d8-31fb-44b9-884c-56184d80f821", "comment": "Malware payload", "value": "7bb095da3f7ccee76b8fe484f52cd318144a99d85aab6fcb8dab017b9bbdaf08", "object_relation": "sha256", "Tag": [ { "name": "84-32-22-130", "colour": "#27840B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "submit-data-com", "colour": "#32E759", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778586551, "uuid": "25bab00d-147f-41b0-a5ee-ded9337256e2", "comment": "Malware payload", "value": "ad70d28d05ca026cd278b6615540207820798218", "object_relation": "sha1", "Tag": [ { "name": "84-32-22-130", "colour": "#27840B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "submit-data-com", "colour": "#32E759", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778586551, "uuid": "1c45a12b-34ca-4e65-ab40-e6a88cea831b", "comment": "Malware payload", "value": "c437c85c692b7b21c84d451a8c7e234fb8c2690a7fdc4b5986e1f30f7dd12c87bfbeae16d8fc0e2a35d97c17a304f029", "object_relation": "sha3-384", "Tag": [ { "name": "84-32-22-130", "colour": "#27840B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "submit-data-com", "colour": "#32E759", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778586551, "uuid": "b3243d50-a186-4102-8a4f-46bf8cf56ffb", "value": "T15826E191F99B44B2E5026531486762BF23305E095F32CBC7E644BB6DECB39E20D371A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778586551, "uuid": "35971895-81e5-4de9-8e2d-fed9f88416c3", "value": "42e4699ccef35d7497261b7a3541dafb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778586551, "uuid": "6e54e70a-2501-439f-b3d3-d2da4d6663cb", "value": "98304:4+Iggi13jQdBhYQDFtvM4pJSiFT0gQVmcPv:JIJxdceFlMnAIgum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778586551, "uuid": "4e3efe56-263d-420d-93bb-5e3570a3b0ed", "value": 4707328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778586551, "uuid": "131fcbb4-6e32-45c6-bd73-1e784f977359", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778586551, "uuid": "dbc97ab2-973c-46b2-8684-a7ea4c886a1c", "value": "7bb095da3f7ccee76b8fe484f52cd318144a99d85aab6fcb8dab017b9bbdaf08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620fc98e-4e31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778610943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778610943, "uuid": "a4f2268e-5c59-4735-b1ca-0d64d5b88ed5", "comment": "Malware payload (Mirai)", "value": "685f6d1392eee77a9f56b78db8c88ef9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778610943, "uuid": "4ef7ed8d-f206-4863-bddf-d1ffd00c1d4d", "comment": "Malware payload (Mirai)", "value": "7e1d756f0501e2f730cf0ef8e64a3a79a003d09d6ab4837de3d2f9c94c772d0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778610943, "uuid": "310d583d-faf1-4401-980d-fc716e2ef122", "comment": "Malware payload (Mirai)", "value": "f2f33bade2b1efb15c12700ab30ccc70aa9aa91a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778610943, "uuid": "b81f0b83-d2b3-4526-9be6-3adc28dd69ea", "comment": "Malware payload (Mirai)", "value": "cc33c8f273d063adb62fc241e97b5c20d6ecd3c12402fe6219634c56cf85a81269bb4a649c3281d7cf984d4ee7f0e3a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778610943, "uuid": "247df455-cb3a-4ad1-b50f-da2ea88f54f9", "value": "T195F34CC7F801DEBDF80BE73B44130909B530B7E250925B372297796BED3A1994927E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778610943, "uuid": "06a9aee5-2fb2-4c25-bedf-e8c47d8b405d", "value": "3072:3Hnond6KarABKW2kdTah9tcIVsYNiVvjbixLbTgy3LUvtS:XonwOrdTahrcFYN3LAy3wvtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778610943, "uuid": "8e3413f4-b015-499b-af6a-56c84cc6d0c8", "value": 170368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778610943, "uuid": "541d3329-0d0c-4e00-a926-9e1b88824b2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778610943, "uuid": "bd1fe4be-47c5-465c-8163-3b06e4600aa1", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d37d6e-4e42-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778618406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618406, "uuid": "2f5692c0-c699-4d98-8ad8-2193447b4f8f", "comment": "Malware payload (AsyncRAT)", "value": "ac30acdc79934b62bd576641833a3911", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618406, "uuid": "14afc83a-bfe6-419d-b7fc-3b8299c369bf", "comment": "Malware payload (AsyncRAT)", "value": "7e820c725b6d0166a2fc708f04fde89c82ae947129b32ac8db0c4eac709bef00", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618406, "uuid": "989631f5-0866-4024-adfe-2c2a208d76c7", "comment": "Malware payload (AsyncRAT)", "value": "b7d64c1cff9813a22bc7a84043f8a5693e2cb97b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618406, "uuid": "15125fb0-46e8-435c-9416-c31f3db55ddd", "comment": "Malware payload (AsyncRAT)", "value": "3612b66355f00bda1739268d3c1f3798b9adf724f801b37d1e6080bc03d58c17e3d5a31c315df2f8ea4b1a71f9916622", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618406, "uuid": "3abbaedc-9274-4177-a581-4d8acdd39d96", "value": "T151233C003BE8C12AF2BF4F7859F26215867AF2633603D59A1CC451DB5B13BC696426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618406, "uuid": "c60bbf2e-4511-4268-88ca-a27ac581bd2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618406, "uuid": "d3c60342-4e86-471b-9c92-7a65ea1de553", "value": "768:Wu/dRTUo0HQbWUnmjSmo2qMPS4sl83lbbb4dNK4cPIm3zjbwgX3iQP6N9VTnkZDX:Wu/dRTUPE2OkGTKOm33b3XSZ3VTnKWdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778618406, "uuid": "a4f5cf26-6972-4313-9dbe-f0f98f5174f5", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778618406, "uuid": "1ba207b9-bd06-4f53-8488-8642f6b31a87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618406, "uuid": "50fd92b4-735a-4c44-a652-b080161fa264", "value": "7e820c725b6d0166a2fc708f04fde89c82ae947129b32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afcb2bd9-4e36-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1778613220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613220, "uuid": "a8ea0c68-96d3-4698-b06d-c521c5747c71", "comment": "Malware payload (Gafgyt)", "value": "9b7bfd5b0f95b23b42b75649acab3c46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613220, "uuid": "4db55d9f-9be2-4997-a48d-1d14c52ff753", "comment": "Malware payload (Gafgyt)", "value": "7fb05537a9e270985cb79efad8605bbf83dda2a9bd26f4cc55ebce84d0d76789", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613220, "uuid": "5eeecc73-d927-4b0f-b1f7-081303ebe7f0", "comment": "Malware payload (Gafgyt)", "value": "8f0a1d1d92e0baf2b081c6fa42504bdaaa0b7406", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613220, "uuid": "b8cdc907-e89b-45cf-87ff-6d9bb93ee5ca", "comment": "Malware payload (Gafgyt)", "value": "bfcb3f960a8ce7bd5fbe18baca2426e702c8a6382f7b499b486ba2be3beddf78c298c1cbffc5117254af5e639c6f7815", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613220, "uuid": "42eb027b-8562-4a0e-8928-642ccc0135b9", "value": "T121B33A56BD018F53C2C315B3FB9F47887B2667F8D2EF3203D925AF61278A4D60926990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613220, "uuid": "c5544002-a6b6-4b94-8a8c-f72630371a7c", "value": "1536:tFLUYuowW9MgwaG84b47XGF2rwGDcCa6rwO0923qVbvR0hrh9Fvo5hJppvq:tFYST9qP+GQcGK6/U7qHro5hJppvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778613220, "uuid": "7dc04cea-5e93-476c-bf0e-a69b6ed62570", "value": 107720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778613220, "uuid": "94d6d84d-d17f-4d0d-b7c0-68c1b5a7b3b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613220, "uuid": "bdff1fa1-58ab-4d8e-8bef-4b1abeab6aef", "value": "FBI.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf0936d-4df1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778583663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583663, "uuid": "20923892-a6d5-4de3-809e-08e9145de1ca", "comment": "Malware payload", "value": "1a36feb792700560115265a52f303804", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583663, "uuid": "cf05534e-2f9a-4ab3-b79c-f89d7283f5dd", "comment": "Malware payload", "value": "80836871a4feb66368c92dfd3c323c446b55a57a94d2b584a8ee799b08a79d8d", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583663, "uuid": "0ab17016-387d-48e0-b6a5-9429e666feb3", "comment": "Malware payload", "value": "01ea6832a12a3876b08a1fd465dbec4813a19cb0", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583663, "uuid": "997dc1c7-25b6-4f00-89fe-212b73a6caf4", "comment": "Malware payload", "value": "fe6e6b71ec11760320b38d6b060019886348412f1353c7cb5f5abe911491c924bd5992600ea354e594247b2660a34621", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778583663, "uuid": "b71d4df3-297c-4811-bd89-a6ba7cfdc13a", "value": "T12C252300A055AE8ED5025AF0AB97F15B236EBC7476C94947362CB35E13B4F76D083E2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778583663, "uuid": "dda19227-6e2f-4388-8ef9-fc32f52d8ab1", "value": "24576:2X9rUoadQdOHX6ud05NOtce4vDs1zCIRefrAsM:2XNUZdQM3HOD+zCIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778583663, "uuid": "5252a9c9-1637-49b0-b3e0-d555a8eb9902", "value": 991232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778583663, "uuid": "b938b3b8-0376-43e7-8edc-d00133971655", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778583663, "uuid": "7737b6b2-7158-438e-b3f8-4d7ef78813a4", "value": "DOKUMENT TELEX HBL 28752740.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899afad1-4e17-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778599842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599842, "uuid": "e601156a-b023-48e9-a881-7de06e94e2e2", "comment": "Malware payload (Mirai)", "value": "4c1447e92458a3eda96cef084e3b113c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599842, "uuid": "2bce1f9e-c7aa-4dbf-b9f1-c66f6974adf6", "comment": "Malware payload (Mirai)", "value": "81cffc21a39c6569d61b380d8d5a511971b458ad5bd6eca905ba94c707bd1fd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599842, "uuid": "c4c4fbc6-b841-4014-8e7f-7273c0d59173", "comment": "Malware payload (Mirai)", "value": "99aaa57931ba02dfe697c4373d9fc4988425594c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599842, "uuid": "b7c104d1-00b9-4631-9f63-8ca708b33fc5", "comment": "Malware payload (Mirai)", "value": "230799518c1745327241ca78b90e19431ffd8e178898b99d7d3f9cadfe3700a5d405b30d5650b124040425294d978bb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599842, "uuid": "de30e7f9-201b-4786-b10b-90c8a9e1f57a", "value": "T19CB4CF4773063E3FE0B7A93E80C64B16BA39D3914143231B2166FA6575235B97F267C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599842, "uuid": "ad962bc5-5fa9-445c-9fe5-d2a9f294c536", "value": "12288:+i8TBUA01o6zTBG8yIkdk6h7Gmr3WMNTSwhhVjboH/:sUvJzTpyAGKEVnof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599842, "uuid": "63f3f14e-b0fe-42c0-b217-bbd65085ec9b", "value": 526048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599842, "uuid": "edbb4279-12b4-455e-960f-20a425042697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599842, "uuid": "29be2b3b-3bf7-4a17-aad0-41c3fd53ed8c", "value": "3atoNational.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9056bca-4df8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778586580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778586580, "uuid": "348521ec-524a-440c-98be-88f486f41036", "comment": "Malware payload", "value": "7811a2f4a2658515690286235c6524e9", "object_relation": "md5", "Tag": [ { "name": "84-32-22-130", "colour": "#27840B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "submit-data-com", "colour": "#32E759", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778586580, "uuid": "284e6945-6f83-47f8-bd2e-649af7810850", "comment": "Malware payload", "value": "8225ced200725fcce20ce365c4bafc391df92eaf9476b5fe7c0c11c76c83866f", "object_relation": "sha256", "Tag": [ { "name": "84-32-22-130", "colour": "#27840B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "submit-data-com", "colour": "#32E759", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778586580, "uuid": "0a4ad1fc-6df7-44a5-ab6d-1f40d34102f6", "comment": "Malware payload", "value": "122ed783bdd6a7cd2ee67964a0ede2a027706a07", "object_relation": "sha1", "Tag": [ { "name": "84-32-22-130", "colour": "#27840B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "submit-data-com", "colour": "#32E759", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778586580, "uuid": "d6a29343-1ab5-4517-8bf2-3e3d776a8249", "comment": "Malware payload", "value": "52c922245dcb821cf828b602dbfb00552a693341f37bdcdb16ae2c504d9e59b9cedbd1ad5c7578e865a81c86962654fc", "object_relation": "sha3-384", "Tag": [ { "name": "84-32-22-130", "colour": "#27840B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "submit-data-com", "colour": "#32E759", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778586580, "uuid": "3d49fb4c-68fc-4e14-acbe-58657d5c28ee", "value": "T15071B74060541AF2D94DA3BF8547B895FD4E7248A2D80B0F07D8981A2F7547BB1D9613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778586580, "uuid": "00483237-28d5-4ec2-ad33-75c9322b53a9", "value": "e82dd51b077167be63c004bed23d0c1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778586580, "uuid": "551d7d33-27a4-4651-9755-e97a79d1d772", "value": "48:6IZUBQYxZul2EywS6DeInjk7QLzgzIzQz4zAzo157D9N9XM/geu3ahr0/x:2BQMZ7EywS6DeIj++D9vXeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778586580, "uuid": "8a0af639-a5cf-49f7-beae-82dbfc208ba3", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778586580, "uuid": "5bb69db2-4f0e-41df-b030-10c3f4319915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778586580, "uuid": "45963460-0ef0-495b-8bff-d4282f8fe3ef", "value": "8225ced200725fcce20ce365c4bafc391df92eaf9476b5fe7c0c11c76c83866f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662be977-4e36-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778613097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613097, "uuid": "4873e512-3bdf-433f-9fe2-7599d2bb8aae", "comment": "Malware payload (Mirai)", "value": "9afed4099240b7571721644de53d0826", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613097, "uuid": "dbfef3f5-85dd-479b-9321-231273d31a99", "comment": "Malware payload (Mirai)", "value": "82e0133d8ed18d7a6d890761d6a2359bba7d5cad98336e3807311e6bc85d86bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613097, "uuid": "0aca508b-fc30-4226-9c34-87ee24922069", "comment": "Malware payload (Mirai)", "value": "167b421eb741f56626fd5a98372117f01e6c146d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613097, "uuid": "c012c881-a1d7-411e-996e-a2b50df72eff", "comment": "Malware payload (Mirai)", "value": "274d0d93d8e519bf77960718b22fc5d814bef71c1cd3e61bd888e1fd35d7d63bc7341ca6199f736cbd54d62d3fc3c9d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613097, "uuid": "46e008e6-5a66-4091-8cde-e6db4db02000", "value": "T1B3F31B46F8818B11D5D112BEFA1E128E37131BB8E2DF72029D245F657B8A97F0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613097, "uuid": "259c378b-168b-4edd-8057-4b5e7cc89a6c", "value": "3072:HoMMMm3ccsq05jvU0G/6OZXj3ucTaazNtDFBcGrBIqwT:HoIwczNXMjZXbucGaD4GrKqwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778613097, "uuid": "97531337-5710-4608-b7f5-e9414a4ffb13", "value": 167324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778613097, "uuid": "e13e1109-af21-4973-bb04-87042100bd05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613097, "uuid": "7e972558-a4cf-48f0-befb-622919867ed9", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a32dfe5-4df1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778583388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583388, "uuid": "c195303e-48d8-4ed1-a41f-36a396bbd75a", "comment": "Malware payload", "value": "e0f019c63c2e6deed0abf6504d9c62e9", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583388, "uuid": "5dd2b5ce-668c-44fc-aaa8-ebed166c04ec", "comment": "Malware payload", "value": "84935298a78203bf4c4e97c7135dd662d05053de85452c7ff490b36ccbebf32a", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583388, "uuid": "f36ec778-1b3f-4af1-a450-d24a15c948ab", "comment": "Malware payload", "value": "db0270746a8ce5a15ad4b903dc8c46459328a8b3", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583388, "uuid": "ab07342f-838e-491f-b74c-35679eae0a32", "comment": "Malware payload", "value": "872a3f60f704885dee4773ae80125c8a4624cc72e573af3b93e0464ef96c96b7b122f3d3ce7b058ff7f26ba1fcc35bb2", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778583388, "uuid": "7f8d18ff-acb8-4301-99ff-c899c7b8729b", "value": "T11D65336A35ACA716D321F4F991E8B6C179C41BF30D84FE91AA4CBF2017F558805C6BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778583388, "uuid": "a211184a-cfdf-4df2-8297-1d21585404ca", "value": "24576:ge/oeDJnBmsMYmLD5k3OZRRzIE2KiTGB9ciJPnn77Bapk:5/mFpH5k+DxbKGB9c2PnRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778583388, "uuid": "a4ae49fa-50ee-480b-b95c-6598d568fc68", "value": 1458498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778583388, "uuid": "3573de66-6bdd-49ac-8609-0aa54f3c6f29", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778583388, "uuid": "499d1d83-f234-432f-832f-47534a4169d8", "value": "solution-tool-1.0.1.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf27a420-4dff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778589651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778589651, "uuid": "75969421-ed76-4fe8-9c9d-7e397f1a4b75", "comment": "Malware payload (Mirai)", "value": "6827d5cf87f34ccc77b9be4b56cb5c2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778589651, "uuid": "13999d4a-e84d-481c-99ea-d7773ca78cfa", "comment": "Malware payload (Mirai)", "value": "859b8df890ad88aaeb0b2c009c7e7742397dcdcc5de8779cc2e021453b4f4792", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778589651, "uuid": "e396ee2e-9798-4e71-928f-93503ab54a73", "comment": "Malware payload (Mirai)", "value": "980bcf42dde7feb28919198d394e5cf21f46ea2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778589651, "uuid": "c0aec180-be2a-4c10-9216-05bb09ea54f0", "comment": "Malware payload (Mirai)", "value": "1618f6fb975d6dec7dd25324b4095b1be095a8ed1532ea3d3665f2421079d75ab67cc5575d5bb7eff4c202c0f91a9deb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778589651, "uuid": "47f93f38-c1e5-4f3a-a583-198895533965", "value": "T1158302A85148122DE68DC1BF0D740BA15FA22340DB61ECEE9A3D7FDFDD09360B3A5561", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778589651, "uuid": "114f97a3-cf68-4472-8814-673a2f396c97", "value": "1536:aLbq07WwzHua0I42b1VSmIZr27ArDPwzKixksKci1FiMU9aVJuV:af7T0I425VSthhLixjYuaVQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778589651, "uuid": "626ded19-a2c6-4f0c-98f1-4e03db27af7e", "value": 83780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778589651, "uuid": "4b450600-cd8a-45ea-ba51-4fef782d07c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778589651, "uuid": "22ec7978-d59b-4a32-9221-9187e541ae7b", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae31da26-4e36-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778613218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613218, "uuid": "76fff33d-a2e8-4f85-8409-d57073b955bd", "comment": "Malware payload (Mirai)", "value": "67a3423937951a7ec60374cc56d61aa7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613218, "uuid": "ed582ef4-b20d-453b-a755-d0b64d65067f", "comment": "Malware payload (Mirai)", "value": "85c91ff7d677a256c5a69d1adb26b070945a1e686278445221229f98674fa241", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613218, "uuid": "aa1ba01f-866e-4b1d-a1b4-175143f6605e", "comment": "Malware payload (Mirai)", "value": "097460185e986530cd59604098f3999f8719810a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613218, "uuid": "71136f5b-5f09-4a04-9ae4-3c99d7157168", "comment": "Malware payload (Mirai)", "value": "60acddaf22b8d2af16a6a3f951000bb1273a56cb26dd3502536db992ea30da916310cda3a217167635490c9fcfe916c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613218, "uuid": "f1d03842-95d3-43e7-8f72-64e5f924c186", "value": "T1E0933BDAFA42CEB3D06310F116FA6B218971F9FB1C22D682D7647DB09D111C19A16FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613218, "uuid": "3ee3c09e-71df-441d-b62d-afa35e22e11d", "value": "1536:OD9HhBPQBM6ZXMar9wEeHo7mUvsEyabYB5bqNd2xOyQJ33+ZPEg:mTe9Mar9eo7MEY/qbVJ3uZPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778613218, "uuid": "a7cfebab-336c-47fe-93f4-a905ac72b666", "value": 91212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778613218, "uuid": "a2f858b1-9cfb-402b-8b43-e85b12be20c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613218, "uuid": "f3c3cf35-345a-4ee5-9c2d-44e6374f4c2e", "value": "FBI.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e19cf57-4df5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778585193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778585193, "uuid": "918da083-25f5-45e0-8830-f9f7572aed80", "comment": "Malware payload", "value": "d7b5cc9675c2a500d6e383c4ce2bbd14", "object_relation": "md5", "Tag": [ { "name": "62-204-35-187", "colour": "#923AC1", "exportable": true, "hide_tag": false }, { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltstrikeBeacon", "colour": "#01FB6F", "exportable": true, "hide_tag": false }, { "name": "weedingswedes-com", "colour": "#F0DEE4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778585193, "uuid": "5c406faa-9cec-43e6-b912-2b5adf7bbaf6", "comment": "Malware payload", "value": "86d250aaf3763fbcecdaf02d886d399f321622a9acd032dd3a2cf318410f70c4", "object_relation": "sha256", "Tag": [ { "name": "62-204-35-187", "colour": "#923AC1", "exportable": true, "hide_tag": false }, { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltstrikeBeacon", "colour": "#01FB6F", "exportable": true, "hide_tag": false }, { "name": "weedingswedes-com", "colour": "#F0DEE4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778585193, "uuid": "1abd8936-3701-4cd1-af00-085cebbf0ced", "comment": "Malware payload", "value": "f6206c04cf234c429a9338b2b550007ecddf7d14", "object_relation": "sha1", "Tag": [ { "name": "62-204-35-187", "colour": "#923AC1", "exportable": true, "hide_tag": false }, { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltstrikeBeacon", "colour": "#01FB6F", "exportable": true, "hide_tag": false }, { "name": "weedingswedes-com", "colour": "#F0DEE4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778585193, "uuid": "41a60e2f-e21d-4aa0-be02-61d6ccc50971", "comment": "Malware payload", "value": "840468993740ad21edf6e2469000138aec0bd1265fb529619f3082fe0f06fa10d46b38918b66bc071202e4ff1e3cad20", "object_relation": "sha3-384", "Tag": [ { "name": "62-204-35-187", "colour": "#923AC1", "exportable": true, "hide_tag": false }, { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltstrikeBeacon", "colour": "#01FB6F", "exportable": true, "hide_tag": false }, { "name": "weedingswedes-com", "colour": "#F0DEE4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778585193, "uuid": "8603b727-b363-44f7-b670-8e026ad4254b", "value": "T1A94423C2DEDA35108D9D06999ADA0750FDA8F0D99A3B3079BEC0D45CE1E5AAB44073B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778585193, "uuid": "a0221eb7-77a7-43ec-9be9-b60d527a8bfc", "value": "6144:31XrbZKCZmpPvrEbQzG6pF1OZHAhaRDd3kz3:xUvrEbNC/aFdUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778585193, "uuid": "b71fcc53-2d4d-48c4-8442-4251486e3de2", "value": 256184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778585193, "uuid": "77edff52-8553-4bfd-898e-ed15765dc06e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778585193, "uuid": "9791f8ba-d3eb-4237-8bab-55ed8471b3b5", "value": "4ab0de01c3bad1d3a6d703e8467430dd6c557d0a2e6a61f88bc6a10a2fd773ed.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f9c769-4e04-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1778591565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778591565, "uuid": "d5adf111-8448-494e-b3b6-584ecfdd5b31", "comment": "Malware payload (Stealc)", "value": "7d8b0b96f6ac622f490373872364e2ca", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778591565, "uuid": "e3117e80-f74d-460d-8afa-753dcaee31ce", "comment": "Malware payload (Stealc)", "value": "8719cf81d8557b035fadbeed2c2e14389ef9c6196ececd56c5a98ea49086f925", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778591565, "uuid": "4eba7865-8a78-4ae1-8f21-611bc4b266be", "comment": "Malware payload (Stealc)", "value": "c4b8d4360fa3b7a5555750c2beb04e2202b2e07d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778591565, "uuid": "b990ea98-bd4f-4349-802d-4903271781ff", "comment": "Malware payload (Stealc)", "value": "6363ca2b800be6e634795c23e18dfffabe75be3c323601b43db909f1c808bafa79824158609988cb2ab027f4b6beaa3f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778591565, "uuid": "6421fa14-b427-4e3d-a02f-b7e6685e6af9", "value": "T15FF47C1EF7A612F8D0B7C274CA428553E77278465370968F03E15AAA1F3B6905F3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778591565, "uuid": "551f72d9-e2aa-4849-ba49-746934587867", "value": "c5a49d74dbeba2b4cb56b327e236efe3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778591565, "uuid": "d915fbfe-30df-4668-9373-1050b62e2a14", "value": "12288:VrHqQr5XgvVozsROaYzPIP17vMKroQyxBlDetAqxSv:1PgvVqsI0d70eoQyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778591565, "uuid": "6aab67fe-4723-4e19-bcf1-dd8ca48bd565", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778591565, "uuid": "8ac52def-ee04-4b45-a6ad-4dc965136d79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778591565, "uuid": "7b408d65-80e3-40a4-93eb-86ac2fbb5220", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4432ba41-4e3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778616476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778616476, "uuid": "a9300f8e-2527-4ae7-bdbe-961ba431380f", "comment": "Malware payload (Mirai)", "value": "5efde0539a246ec14cca9a50bd47c366", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778616476, "uuid": "3c97f005-3898-42a5-9e5c-da7484717ff7", "comment": "Malware payload (Mirai)", "value": "878c42ddd4aa71eedc3122703de37b79dee4fb76d6d9601802ee6ce0a90b3fde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778616476, "uuid": "a7a87d4b-1ef7-420a-8bc3-ce83c8c4a0db", "comment": "Malware payload (Mirai)", "value": "832b1f147e94733f89803f5665017884ce0a3983", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778616476, "uuid": "ce287379-7049-4d7e-acbe-a5fe4098bdd4", "comment": "Malware payload (Mirai)", "value": "75b0bc73a71a9d10811fb71158b8033bdadaf8695827446fdc875132ef5797734fe274c16a8ec35e3f33b96534563d38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778616476, "uuid": "2922420a-8764-43ba-8b43-66bdc4a3782a", "value": "T1FB144A13A8A55F97C096AFF662B38A740753E8150B571FBBB62AEDF80603DCCB405364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778616476, "uuid": "0a39f3c8-ffd4-4760-87c9-9cce5b051895", "value": "3072:XRXC60p7HBJqUQJflu/+tbdWoPa7oP3DELM6D44+rhhxz1AMhONflN:XRNOHBJqlJ99o65PTh6D44+rhhxz1AMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778616476, "uuid": "588ba330-d677-4083-a9fe-9b7032df9c24", "value": 191977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778616476, "uuid": "72068692-3623-4c95-b651-d412864406c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778616476, "uuid": "70cd461c-9a56-496a-8f67-5e15e2127ea2", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e5b9fc-4dcd-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778568238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778568238, "uuid": "5c78bef1-5051-4dee-bb06-c911dc42f00a", "comment": "Malware payload (AgentTesla)", "value": "a488c3c57f5ae2c9cb0f24afa9e46fa0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778568238, "uuid": "f84f1107-9df0-429d-882b-696fd73494f9", "comment": "Malware payload (AgentTesla)", "value": "87d9440b64a6a9d0409c7492c125620cadf930d5191881e1e8eff772f1f961fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778568238, "uuid": "9b668fb3-8ef8-4fe6-a8c5-dcbecdcae03a", "comment": "Malware payload (AgentTesla)", "value": "bf64a70489db55c81410e2302cf1ba305c2bed4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778568238, "uuid": "9da24552-b646-4801-99a8-0681ac1fbf70", "comment": "Malware payload (AgentTesla)", "value": "bac64b5ce5e819dfa36e269c899c3733d8464f459a4dcbbda18e931a1b1cfbd5cffba94aacb3750574558238b05f9dc5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778568238, "uuid": "a4de82ed-2a40-4de1-a20a-b01c0faabb5a", "value": "T13645CF2D368F885CD591DB788F333BD41770D47658F2D35BBF885338A62A6E09A8C242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778568238, "uuid": "90ed7d96-fd8d-42ea-a957-639397863819", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778568238, "uuid": "65ae50b2-85e4-4681-a102-79cfc7446ac3", "value": "12288:LuObrpfwuMYBUwo92piHlMmau1ouSl1rFumN2H8+9VL72BovGYN0OuHiDqEO5R6a:LuafSPCmQui1rBgc+9l03HiDq9rUiSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778568238, "uuid": "4e2a7472-0f9b-4987-8bb0-f869d6ec9bec", "value": 1275392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778568238, "uuid": "dc78fa98-77df-40ef-89f7-dde9936ed6dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778568238, "uuid": "7891e9fe-0fb0-4930-9466-0f8b5b0ac97f", "value": "vessel's particulars.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e9d3f1-4e0b-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1778594707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778594707, "uuid": "accb0587-3cde-480a-a32e-a67e3830b96a", "comment": "Malware payload (ValleyRAT)", "value": "50b03a33711f0b05c35036ed0200a2f0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778594707, "uuid": "aaf2b0af-6ca0-4b65-b94b-2e252df809a6", "comment": "Malware payload (ValleyRAT)", "value": "88b4ba70045e6be08c363caa30f3a50a7870902a337420944c78a37d5d087a7a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778594707, "uuid": "d19b489f-d810-4ead-8c63-f7977b6a76e1", "comment": "Malware payload (ValleyRAT)", "value": "eccf088ba2b6926de93ea0f9b49cd3b1cf31e664", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778594707, "uuid": "654968a2-82b7-4f35-be78-1f2e8933e6f3", "comment": "Malware payload (ValleyRAT)", "value": "ddb8e3d7342d97da8bc5271b951bbf0b11d9763dcae32651e0c4798de470ebb984b2e36a714489f406bbc2e18b8ac308", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778594707, "uuid": "98dfb82c-e0a6-40ab-870c-38bc0035dc04", "value": "T130669E11AFC55AF7CB23BB3C1952A16CB09E9C140775C3E3DA9F7DBB28380425918B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778594707, "uuid": "0c4c44af-fa66-4943-83ac-63e638b23798", "value": "2906427f09ca80a891ca05cb0288033b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778594707, "uuid": "936fb5d0-101b-46b8-a616-259dec6506e6", "value": "98304:f2jx3ftt34TBK0mUKo7mt3Wc2PxrotaQdq70pEd+2MiV+Uyg:fCtSK0I3Wc2P4d5l8Fy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778594707, "uuid": "b4ff5bc5-2032-4bf8-9410-556a9efacb0a", "value": 6700544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778594707, "uuid": "81394cda-2381-4034-a150-8ccd18369e9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778594707, "uuid": "f9efaf03-39f4-4598-a2f4-cf6e7c8a0cf0", "value": "88b4ba70045e6be08c363caa30f3a50a7870902a33742.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8c9177-4e43-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778618560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618560, "uuid": "feb1b04a-9806-40f3-b8a0-7ef132543692", "comment": "Malware payload", "value": "e8eeac1d79057adf62f728876f0fb6e1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618560, "uuid": "93a429d8-6b1c-4a42-83fb-b7b6aaa9a872", "comment": "Malware payload", "value": "89bfece0fa4499eb58fe0e112ef212e32fab31f1d14432eba8eb30dce89d1aba", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618560, "uuid": "ec89604d-dcfc-4ceb-82d5-ddb92ab4d067", "comment": "Malware payload", "value": "6aba89bc0391d1ae04a2479ebbaf12d9f1af3499", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618560, "uuid": "251d5e75-a582-4eed-b233-8af3e5d284ec", "comment": "Malware payload", "value": "ba9089c4896e8b7fd7f28a432fef658bc08e798706a126b48f1ee54c231771910a57985483e5ffea06a46ba425ffef59", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618560, "uuid": "e909dcb6-acc2-45b6-b4f5-2582ec2296e1", "value": "T1E3268C2C236CD7D2B5E9D736C81EFAF09A2D98176D94FE0520698A5CC684F03339C59B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618560, "uuid": "2811283d-0943-459e-99ae-79c1e5e0a3b2", "value": "98304:xeLIbuCbEiwKthDtxYBcxjMcrf8efN9Qn40pY/C3mvGivQXs/i5lo91/qQSEjDn6:x33thZxSORFqn40pYK2LT1YEjzqFugae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778618560, "uuid": "c7f511c9-4135-4954-ba99-ee55c4677866", "value": 4806106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778618560, "uuid": "53f7026e-9546-4550-9dfd-eee14322bf94", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618560, "uuid": "7febf31b-7444-4354-903d-7fb01eaf6afe", "value": "2981425613_AWB Shiping Docs.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ba6516-4db3-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778556807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778556807, "uuid": "9bff1c66-25ca-4843-ace0-114eb7c60110", "comment": "Malware payload (AgentTesla)", "value": "846c7b1201cfeac0cd48ecc080270f9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778556807, "uuid": "15e32240-5f7a-463a-9d4d-47ace0c8482f", "comment": "Malware payload (AgentTesla)", "value": "8a27732f805c8cb6a4f37443ed728cd5239dffb6e3e12d02aa7e698b5fc3f23c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778556807, "uuid": "292f0c69-18df-4de8-89bd-2cf287fe6b9f", "comment": "Malware payload (AgentTesla)", "value": "4513de2145b455c2e5217ca3988f9f9c46a44392", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778556807, "uuid": "4a7b1115-9272-42f2-ba47-fe74b8e0972b", "comment": "Malware payload (AgentTesla)", "value": "a03e6b516156c486f4db8ea7aca6da66772eae4ee0c15889a9d4ae14fc42139f976d78bd5799e9fb366349f6637614ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778556807, "uuid": "6669f16d-c9e1-46a7-aa09-c67c5c5e952b", "value": "T1DF25AE06A7E416B4E63BD238CAA64233E6B678450771ADCF0355D6192F33ED06B3B325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778556807, "uuid": "c40447dc-81a2-4a71-84b5-05ac0d807877", "value": "d4652face233fd6b259d63f8abb6894f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778556807, "uuid": "79c07848-ac69-4d03-bd2b-964a0ff02d20", "value": "24576:mvFZ7RU/5ouxIxvVC22vdF4+BVDhnD23oxY6GAvP9x9YyArqrL53SUS:mZi/5FxnF4+BVda3tFAvdYyArqPDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778556807, "uuid": "28f5245e-11d5-42b2-ae67-9c1cae094da9", "value": 1027779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778556807, "uuid": "09987cb9-55ee-4718-b06c-1f1e4bbdb160", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778556807, "uuid": "4947edf5-4df3-4b72-a6bc-7b592e85516a", "value": "RFQ_NEW_ORDER029384545909.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afab32c-4e1e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778602851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778602851, "uuid": "373a5d4d-8273-4795-baf5-d90745b90ede", "comment": "Malware payload", "value": "058c3d8ef8836d440e87ff61889371e4", "object_relation": "md5", "Tag": [ { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778602851, "uuid": "bf8b4c2b-3d51-4ec3-bafa-a8450135e463", "comment": "Malware payload", "value": "8a35709b785162abc526c2d042d720747226adc38cdfdce93c4f177d121fcbc2", "object_relation": "sha256", "Tag": [ { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778602851, "uuid": "d0f1d0bc-45c5-4634-a056-38fec183ee06", "comment": "Malware payload", "value": "1c6537d912c921286188242de587caf4672c4e6e", "object_relation": "sha1", "Tag": [ { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778602851, "uuid": "aa823b37-1111-4e6b-b5ed-f1c59187079d", "comment": "Malware payload", "value": "026b1e360ddd9f19283a3ad03dd682875ce819e6ffe4b89e19925ad85a9049b7358d5bf7351057db376e830576631f74", "object_relation": "sha3-384", "Tag": [ { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778602851, "uuid": "545e7118-e970-4547-ac25-7896809c8aa3", "value": "T13882E905376540B7028762E989CDE20CA728822F21491D51B8DCC7C6FFA297E93F96F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778602851, "uuid": "51191128-33e7-4bfe-9cb9-a538e960ace7", "value": "384:HnfzJNaGgwhwizVcWncaHSCIZMoLguv5LVAL:t+whwwV1caHGMoLguBLVAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778602851, "uuid": "9b054160-0f6e-42c1-adf5-69bbab7da919", "value": 18690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778602851, "uuid": "f6ea37b3-8529-4ef3-bba6-7fa6ad9a1e7d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778602851, "uuid": "e3561e03-feb5-4d14-b75a-7420972ce308", "value": "8a35709b785162abc526c2d042d720747226adc38cdfdce93c4f177d121fcbc2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "477fbd2f-4de6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778578686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578686, "uuid": "2dbd7a70-c3e9-406a-9a84-247acbd584d2", "comment": "Malware payload", "value": "124e8f4ac077538b7aaec5e96eddd4b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VanillaRAT", "colour": "#F5ACDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578686, "uuid": "6b53c442-2f2c-4c48-a65b-748eb6d8e8e5", "comment": "Malware payload", "value": "8cc79c0fd5b9f3ea578e267293ae2b4492a33c68df39f426fd83e9eb54477128", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VanillaRAT", "colour": "#F5ACDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578686, "uuid": "8e39d020-d326-49b8-a4c6-2bbb7a0ed036", "comment": "Malware payload", "value": "6f8dd67dfba626df7e47f31d7e4e0b83dae40fb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VanillaRAT", "colour": "#F5ACDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578686, "uuid": "75eb2971-d4fa-4cdc-8c0a-f9846097c5ce", "comment": "Malware payload", "value": "4ac9907e09486b145fdb5bca3f37844303d77fb59f92e5075315a393530237d9517ce2d7eacb06fbcc4450de0136b69b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VanillaRAT", "colour": "#F5ACDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578686, "uuid": "fb53162d-586e-4814-a162-91701b994d45", "value": "T17D65229893EA5745F2FF6EB43929505196B0BA16DC13D75EA3C020CD0EB3B05E636E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578686, "uuid": "bc0a9499-0f19-422f-bebc-c7787df52310", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578686, "uuid": "d6c6688d-cdb2-4cbf-adbb-072395e41333", "value": "24576:T+JEfJhZ8j53sY1jCeqm6qv80MaooQajSMpHYWOkEfW5EQJZrUVvsgMYHQgdUU2w:T+a5csqCeq08moPajSQY5HYryHACWRHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778578686, "uuid": "99a42496-a2e0-48fb-9f31-80d70f08b6a2", "value": 1503744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778578686, "uuid": "7b7aee02-6030-41e9-9fe8-97ac58c5b8ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578686, "uuid": "ae4fb997-d2d9-422d-a8cd-f8d4c66f3cb8", "value": "ae888.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4321dce-4e4b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778622247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778622247, "uuid": "86acb62f-2f67-4600-a06a-1c8704c28e65", "comment": "Malware payload", "value": "72737397a4317a463150781ce7228766", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778622247, "uuid": "bb860918-b1e5-413a-b7df-3de6ec66ee9f", "comment": "Malware payload", "value": "8cd988339da258cbbb000009f6fe817d168bec28774f204b9ac6331e8404fdb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778622247, "uuid": "fb5a97fe-756b-493a-9b25-0e87fd226580", "comment": "Malware payload", "value": "e580c3f5379ebd184c22362868165b5798e98d4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778622247, "uuid": "7a37f681-6b99-4671-8696-766dea7aff5d", "comment": "Malware payload", "value": "26d1c83e0a06e282f0b54d152f17861c3774e8a651c5ad2422c241ff7296d8ab2c54c6fe021f34a74ca7321975fe201e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778622247, "uuid": "fee2be16-8d05-4856-bacf-76692cadfe41", "value": "T1F90833296124F56DC4664ABA1092DF30E30D179D6B7959FFA33E2708EBF104A15EC38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778622247, "uuid": "878fd8c0-643f-4ff0-b8f2-9a377a298e53", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778622247, "uuid": "6acf278b-efc0-4646-967c-ea34680e3481", "value": "1572864:/t9IKPT2IRWYAeozQykC0Z9Acpb20j2qEmvRmf/A8C7k7v/wRcWz7:/UK72IRWzJzWpbp5EmJmf/AA7vsz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778622247, "uuid": "49d7e150-8295-4dc9-b426-5a2b851acf88", "value": 77333258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778622247, "uuid": "9323b17c-2f1b-432b-9496-c013cc040af1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778622247, "uuid": "3e9b6df5-3f1a-4416-944a-d2c150cbb820", "value": "activator1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c79c6f-4e39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778614365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614365, "uuid": "488c408b-ea7a-4a4e-b63a-8be5afc961c8", "comment": "Malware payload", "value": "de7980d3970de785955ea9a678ded4c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614365, "uuid": "31e064e2-258d-4a54-9e20-c0f1450a3a7c", "comment": "Malware payload", "value": "8d96f3dc7b26fd2339beadffb3596682e41aa3e1cd03cc649f4293dbbdfa80c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614365, "uuid": "7e7a4eb0-b82a-4b8c-9cac-a8414b8b7bda", "comment": "Malware payload", "value": "6c80608e3af66f37ee664ceaf9d2f2ab2974d070", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614365, "uuid": "2792e2a5-7020-4e2c-a49a-15d5117a4066", "comment": "Malware payload", "value": "09f8aecc3bf51d123f3dac0d6cb5c495d5c822ea393b8893c03db5d510303e7578fe60f82d04b9a34f0d0c5b19361d8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614365, "uuid": "a143673b-7982-4f97-8614-8b81b771d2c7", "value": "T16C24E80AAF510FFBD86FCE3702E9070529CC655722A43B7A7674D528F54A90F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614365, "uuid": "8d30d7a8-bb30-4f31-a9f8-ce3bf3f0f4c6", "value": "3072:8fAcPtTDzpyZMvZ6bM9CwfJPBKs6dh52xUZQkm:8YcRDzpy5bMMwfOJ3ExF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778614365, "uuid": "f19e1e41-c741-40c4-9c6d-53378e03653b", "value": 220220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778614365, "uuid": "3b9af562-7cd0-4478-8911-8b85851f7c84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614365, "uuid": "f60f347f-b50b-43b3-8d4b-87a4184b4e44", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91524f9f-4e48-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778620900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778620900, "uuid": "06fb3a25-8334-4dea-b8ee-0b96a5711384", "comment": "Malware payload (Mirai)", "value": "fd0292a9db405e3a5f0ee6da5572a0a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778620900, "uuid": "a1768544-8755-46ac-876f-4d33723a451a", "comment": "Malware payload (Mirai)", "value": "8e9e6b5cdc2005899b81676470394334f0d82a3b160a44c9abf4b88bda18c1e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778620900, "uuid": "15c2f2e4-b495-4938-8166-ba1e23b5a74b", "comment": "Malware payload (Mirai)", "value": "99a045b9eb90e153fb9ef3da92bb6bcc8ba477fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778620900, "uuid": "5a32a6e7-dd06-4ce4-b283-b3504ea1f791", "comment": "Malware payload (Mirai)", "value": "efcd749bb7618ad7e3de1fcc415f7feffe1a5cb55ac286e8e7a8ae99fea7928f87258091de3a7f11580b4462b8694811", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778620900, "uuid": "f639ef45-b77b-4c32-b0e4-2ab2f728b67f", "value": "T1DF73E562FE81CD51C8D928BAF91F42D83383076CC3FE75029E159B3566DF59A4E3AA40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778620900, "uuid": "6bda2e9d-038f-4b97-843e-918297949e9d", "value": "1536:YuxrrNjNGwTV7dlYKpU+//ObQnCqvOHofkJFpocAkXhAc7:3Ph7dNpUMqQnNmBl7AkRAc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778620900, "uuid": "b5aeb688-4cda-4c7c-8401-b03623c600d4", "value": 79340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778620900, "uuid": "70f1368e-cb61-4d01-bec9-b04d3c825cde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778620900, "uuid": "b64aba39-99d2-4ada-a8d4-58e7194e856b", "value": "bot.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c2f2c4-4ddc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778574656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778574656, "uuid": "a028a2ad-4a41-4504-be14-cf81c8b7f3ad", "comment": "Malware payload", "value": "c52d1792912d7eff9fc9c953a3a69367", "object_relation": "md5", "Tag": [ { "name": "172-96-172-91", "colour": "#24B0B4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778574656, "uuid": "e0d9f26a-b174-4fdc-a751-343da2bf4177", "comment": "Malware payload", "value": "8eb31c0e48b7c0cc914210aa55bc079c9735b236a07cca892c107c5558d0b7de", "object_relation": "sha256", "Tag": [ { "name": "172-96-172-91", "colour": "#24B0B4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778574656, "uuid": "d1722a9c-cd04-42a7-83fd-d80b85320a93", "comment": "Malware payload", "value": "663f2fc8b251a326f23f5425b857038f80355b11", "object_relation": "sha1", "Tag": [ { "name": "172-96-172-91", "colour": "#24B0B4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778574656, "uuid": "e2cac86d-5736-4fa5-abc9-7a3751c847d3", "comment": "Malware payload", "value": "fd9489bd06ccd44c39061d5f17425eaf299004d0703f4360416a7483fc6c00c1fa36f11088e02a2c3722be1654f4fe44", "object_relation": "sha3-384", "Tag": [ { "name": "172-96-172-91", "colour": "#24B0B4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778574656, "uuid": "06df698f-f869-4b3f-9c7e-9e86e3dd8b53", "value": "T1F2C2834C715131F984BF34BBC76F6501B122445746AADD24B88F53ACBF45A3C82A2FEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778574656, "uuid": "b0ccc76d-ca2a-4026-b2c5-41f91b9e727e", "value": "768:JY+NK4/lsn7D3u0r5Lx7DFsXBHwBLGu9iFJaM:xy8HCX9iFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778574656, "uuid": "29e11e1f-15fa-4b10-939c-ebdaa8401f1d", "value": 27138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778574656, "uuid": "4f48e2ef-3466-44a2-b630-96223fa81bd9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778574656, "uuid": "d952f908-b332-47eb-9a59-5367f4c95baa", "value": "8eb31c0e48b7c0cc914210aa55bc079c9735b236a07cca892c107c5558d0b7de.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c9506e-4df2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778583914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583914, "uuid": "4334695b-877a-4b1b-a8de-f35d8c51ae56", "comment": "Malware payload", "value": "d323c8c88a89d52c5c8980a058c54960", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583914, "uuid": "ce07f302-2624-4192-ad76-b9389433ed4a", "comment": "Malware payload", "value": "904cee0e70cf6625790b9355993a02d41f88f21ab5ab376f6c08aae649c5fad0", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583914, "uuid": "40cbf776-1dec-4851-aa2c-e3ebf11db9f7", "comment": "Malware payload", "value": "bc30fd33ea721dcb9f18f546562f41996839950e", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583914, "uuid": "99d4a7fc-71b5-4d95-8339-8cac1e9cc5fb", "comment": "Malware payload", "value": "2f32ae6e18dd09a86477495eb81766b167b8368c5a3c648ae619a50a6aa714241f56b91cb901ae7932a11ca8df34c402", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778583914, "uuid": "7c01e169-f22c-40d4-9b21-ddcacf226c79", "value": "T1B9C423C34CEBD6FABD98430161B34FB48D7546FA884FC49293D266E62F6D34A440B974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778583914, "uuid": "4351fc3a-265a-46b3-b44b-9e32995683f3", "value": "12288:O9ltGv6w+tRs/QXi4t1JA7S6kJlW4VbeaElXkew/QpRjNwDaPr:yy6M/UBVyaEdkezjeOPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778583914, "uuid": "57ce0c61-753c-48ad-a744-ee384065d4a2", "value": 578382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778583914, "uuid": "be4c0461-f85d-4768-bcb9-3df88bc4e76c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778583914, "uuid": "5134c9e2-1432-46cf-916d-47545a4e1a67", "value": "d323c8c88a89d52c5c8980a058c54960.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906802b5-4e17-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778599853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599853, "uuid": "ae5ed28c-205f-4d73-8e7c-5dda78fdc400", "comment": "Malware payload (Mirai)", "value": "6c2355ac61b9043fad5beb2f33128f8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599853, "uuid": "f58a5154-3fd4-4724-ac9a-d96948172796", "comment": "Malware payload (Mirai)", "value": "90cbb9b988975131a097be2511711bad2b70b32ee41fee7623cc9191902bb368", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599853, "uuid": "d1d1c64f-3ff4-4f0f-86b3-5087edb84912", "comment": "Malware payload (Mirai)", "value": "3564fc38865718d6e6d6707f7b97eef9b5abdd13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599853, "uuid": "f85de03d-529d-4363-806f-cf95683dd04f", "comment": "Malware payload (Mirai)", "value": "824c7f79ba97eabc599dd0ca237b0eb5248e84d4d7d782225952d500e08da93e8cc8ee2c91c97966ee446ec933d456c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599853, "uuid": "56f1b866-701b-4dfe-a7ab-bf82af5e0c2d", "value": "T181C4CF93F6705ED5C01D4AB454BED2308B89E29713877581F6FE82002C6B56ABF9FB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599853, "uuid": "65b73055-8f11-4939-9246-2336688e65d0", "value": "12288:CmqG3UsALedu3sB9quj1xLpm121VYoLRkJQpIztso:oYYLeQeqAlKo86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599853, "uuid": "cca38b0d-8684-40c5-a56a-923cbf6e2c65", "value": 594600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599853, "uuid": "c6f3a229-0cba-4d73-bb80-13019e0a5c96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599853, "uuid": "813602aa-cec2-472b-9c1f-c0a3f4e17fff", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "552f8c39-4e0f-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1778596318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778596318, "uuid": "4335b1b6-0599-4fc5-83f9-3ea7ea9a3643", "comment": "Malware payload (QuasarRAT)", "value": "24e9081b35dd217fef95bf9541fea3be", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778596318, "uuid": "86df2433-9878-439d-8dc3-adf4270a3168", "comment": "Malware payload (QuasarRAT)", "value": "913a718ec5938abab66f81f08ed0d8d8dd141cfff630004dd9247b2f3170e58e", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778596318, "uuid": "2a32f65c-192d-406b-baf8-b2d11dd16e36", "comment": "Malware payload (QuasarRAT)", "value": "0706c002bd392afb3d634e3eaf52dd56e6ed2b32", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778596318, "uuid": "aea35c01-4d62-4cd2-bf2e-edc7dead733c", "comment": "Malware payload (QuasarRAT)", "value": "644c580fb67cf5c0535373d6a473fdc8a2aeadd1c9c3e1cbbad1421664c0d3c269e80b7aea01dd4194736a4516bde1be", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778596318, "uuid": "11fdbc0e-5ac1-413c-b3e8-11a535061ea2", "value": "T1B0E55C143BF85F23E1BBE273D5B0441667F0E82AB3A3EB1B1191667E1C53B4059427AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778596318, "uuid": "9b901ba7-f4f3-4168-b432-a3faea18af21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778596318, "uuid": "4c357a85-7077-4309-935a-3ae32919e8d0", "value": "49152:PvzvE2H5aweBHPbl6T/yGaqA6/yfDkE2HWk/+F+oGdiqTHHB72eh2NT:PvDE2H5aweBHPbl6T/DaqA6/yfDfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778596318, "uuid": "d6c1b56c-9cd8-43f8-a0ac-3c6b1815e866", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778596318, "uuid": "0805d66c-79b7-42f2-90aa-c76febfecceb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778596318, "uuid": "7cda5670-6ff3-4fbe-9c18-23f6813309f8", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce1f4cf-4da0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778548523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778548523, "uuid": "c0f16aba-d78c-46dd-ad0c-eb158b99540c", "comment": "Malware payload", "value": "51532260e6f29b52c6829f0fec177eaa", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778548523, "uuid": "b17117c2-6d9b-4dce-bdab-1bfb5dea2609", "comment": "Malware payload", "value": "9248b313a40c89e3c91c36c2a037c0ed2e24db27321c5f8cd3b0603780cf98ef", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778548523, "uuid": "c9db1715-96ba-4ec0-b486-59fff7030a1a", "comment": "Malware payload", "value": "d9331fa70d9896724874c3c2a03f8ebdc5a31d8e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778548523, "uuid": "03aefc26-9dcd-47ac-b5a1-45049c7f5e29", "comment": "Malware payload", "value": "27474fa4191487685da5450e27949f16b93555a362bc3e42329b82b1926e6a645d21243099316fac7aafbab6d1f7cee9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778548523, "uuid": "92a51946-f9e9-4b9a-b833-aaafd08e4d39", "value": "T174137D6966857C24AE99883B1C7E2F0CB9A9C3E1310451EDBFCB3CF58C19A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778548523, "uuid": "ff04a45e-9502-42fa-83c5-5d82409d95b5", "value": "768:b0+f9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnB:b0+Yc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778548523, "uuid": "0476871d-115c-47e7-a37f-8565bbab2ac8", "value": 45508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778548523, "uuid": "181c516c-e692-4bd8-ba75-63fa9926d9d3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778548523, "uuid": "66a0032f-392c-416c-8cf8-b8de6f99e2cf", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eebe32c-4e4d-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1778622910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778622910, "uuid": "631f5c52-4a9a-4616-a319-648098a0c113", "comment": "Malware payload (DCRat)", "value": "06b9ebceeb682fda05627e97a24241a9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778622910, "uuid": "3531e3ec-5252-4745-bf43-8c2a7238d536", "comment": "Malware payload (DCRat)", "value": "92598fd7f0d08b6ed7534573448bb262091b178cb63b436e399a6a1b04596e65", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778622910, "uuid": "daee6ea2-ffbf-4993-a4a6-d250b26bf79c", "comment": "Malware payload (DCRat)", "value": "abfc946473c5bd6eab9c3d1a982b9b54717f790c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778622910, "uuid": "626cbb2d-322b-437b-ba6a-62c5a05717a3", "comment": "Malware payload (DCRat)", "value": "bdbeee5c894b7921581702de599f34dc7518209483d8dce5b1c273f4880c4e8359886fea49f6a0a527e7918efcb3b0e9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778622910, "uuid": "b3ba98ad-101f-4e90-aaa3-f6118447d760", "value": "T1192539017E48CE81F4081277C3EF45484BB49D5166A6E32B7DBA376E161A3A73C0DADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778622910, "uuid": "e0601893-2442-474d-bb56-91817c454a8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778622910, "uuid": "426c8ab9-b900-4806-b18f-658a4819fc00", "value": "12288:Qi+IrHYVefz7tXzRiGLU3cADcKtRXZ24iTw8Iw7v/kRSSlqWu+FST1d99gDXuR4j:1rHYVeltiGL+cADc0lj58IkqSiuRSjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778622910, "uuid": "22fc606a-7958-4a8a-8ae8-72f57e482cfa", "value": 993280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778622910, "uuid": "1565334d-6e9b-406b-8c71-51005e205bab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778622910, "uuid": "8ee7fe1b-0a41-45dd-b5eb-43b00352ce59", "value": "06b9ebceeb682fda05627e97a24241a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dcb89d9-4dee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778582052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582052, "uuid": "51ed9b3b-09db-4ad0-927f-ab581e12d96b", "comment": "Malware payload", "value": "02d93e6857132c462f882d9c5e455739", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582052, "uuid": "f9207788-88e7-415c-a621-fb7613781c15", "comment": "Malware payload", "value": "931ae234f87ce4ab7d946b5339f55b42579233721285245f26cf1456ebb6afd5", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582052, "uuid": "5496ac39-5821-4d7a-9463-f4b4e78a1a3b", "comment": "Malware payload", "value": "64afc04013345c5d3afdd61768248f0d78c5fa57", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582052, "uuid": "e1c3ab2a-0d09-48cc-8f49-b31d5b2cdb11", "comment": "Malware payload", "value": "8e2ddca91664e0eb7f716838324107e4cfb4f391dd725180494a929cfac7aa951aaf76e0a29aae0e549841214f04fce4", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582052, "uuid": "e01b2e97-c843-4cef-b79e-d8e690107fc5", "value": "T19D25230060566E5EC5029AB16BABF55B235FBC74B6C44A07322DB36E1374F72D087F1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582052, "uuid": "7de62d48-6954-4b9c-af24-8eccad88026b", "value": "24576:cX9rUoadQdOHX6ud05NOtce4vDs1zCIRefrlZ+g:cXNUZdQM3HOD+zCIK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778582052, "uuid": "9cfa0703-d5ba-4d0b-8d5a-47a3f4ff7131", "value": 991232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778582052, "uuid": "9b7cf0fc-c622-49b7-95c0-80db13d41d1f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582052, "uuid": "141707b4-d228-4185-941e-9a86a7b92f83", "value": "SecuriteInfo.com.X97M.DownLoader.2343.3225.9909", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96bc73a9-4e17-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778599864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599864, "uuid": "cd4446ac-f53b-4a08-b8ad-6b6f777e9041", "comment": "Malware payload (Mirai)", "value": "f180f9446ecb789b432826b965fc0270", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599864, "uuid": "256f5e12-5410-406a-936d-0ab4b9e40d48", "comment": "Malware payload (Mirai)", "value": "94d06f3b90cddcbe3ac34c4fd54fbf3242bb57492193e6c8650de2746c57891e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599864, "uuid": "f6544ff9-007e-4e4a-b275-843e1f747b01", "comment": "Malware payload (Mirai)", "value": "5ce46b8e984e825f2a87f78df9c30113c13be779", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599864, "uuid": "ade14a1f-a238-4371-bc73-cc1e1f7eda19", "comment": "Malware payload (Mirai)", "value": "d2e4155b35ba73b4e4636b3a668f29b396f4d90d7f67cc48d0db3bd25c58574bc1a243af8dee63c4048abed1e220567d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599864, "uuid": "46e1c961-f36a-438a-8878-7f0bc2e38918", "value": "T1A5357F52FF082527DE090AF066FB2774F752246381F4D1323B042FAB586267998E7DDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599864, "uuid": "4fca6bd5-5de0-4c00-90a3-6e91ce3811c1", "value": "24576:tSTMu0ymJkK22BBP/5+TELntZX5J38ZawsFCzs6pu6:tSTMu0ymJkK2wBP/5+TELntZpJ38ZTRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599864, "uuid": "433e7c5d-1a92-4a91-b864-91fd797a3651", "value": 1122936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599864, "uuid": "91edc579-53d9-42aa-a01d-1180eea8abfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599864, "uuid": "ea608d3d-2d0d-4f40-9678-2992c25bd849", "value": "powerpc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9e1239-4df8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778586613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778586613, "uuid": "9563c4ae-bf73-4a66-82d0-94cfc86e932a", "comment": "Malware payload", "value": "ad8b7fb79aa74527aa508ea5877d921b", "object_relation": "md5", "Tag": [ { "name": "84-32-22-13", "colour": "#B7BA80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "topayapp-org", "colour": "#2E5A88", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778586613, "uuid": "f18b2a52-1155-40a4-9a33-e0c54526ad17", "comment": "Malware payload", "value": "97b82200d13463908f34da60a3d1fc92d92706e8044ed73935b567d28df5c7ba", "object_relation": "sha256", "Tag": [ { "name": "84-32-22-13", "colour": "#B7BA80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "topayapp-org", "colour": "#2E5A88", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778586613, "uuid": "95cae00c-7976-4a27-b497-79869dd2cd96", "comment": "Malware payload", "value": "cbc5c0053b88043f702349149efd45a1d94cf9f2", "object_relation": "sha1", "Tag": [ { "name": "84-32-22-13", "colour": "#B7BA80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "topayapp-org", "colour": "#2E5A88", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778586613, "uuid": "3bc4bdac-6af0-4d9d-ba43-b6706341c242", "comment": "Malware payload", "value": "a4938ec852391279330dab217cb4d27ea51eb2b43ae3f24a3d183322428cd3c0d97f408523d23ac92ea075618cc7f50f", "object_relation": "sha3-384", "Tag": [ { "name": "84-32-22-13", "colour": "#B7BA80", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "topayapp-org", "colour": "#2E5A88", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778586613, "uuid": "ad8cd6a4-119c-4a24-9486-710a516337f7", "value": "T14126F047B89040FAC5AED134896A5222BA707C950F3157D73B51B3F82FB2BE86E79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778586613, "uuid": "f6ab158b-0895-4fc5-8ea2-e833717f8218", "value": "29c78be06b08f1034fb52a93199307ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778586613, "uuid": "89545fba-ef62-4664-b574-11eab9cedd8c", "value": "98304:8FGd68EFMIM0f8ARXaxa6kR5XbEgEk4B/:8BrFxM0f9RK9c5Yl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778586613, "uuid": "9ad7d35a-9c4b-444e-b157-3158845d7633", "value": 4764160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778586613, "uuid": "9df32d16-5b5a-46b1-8437-70f20962f257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778586613, "uuid": "4f946772-1df1-4824-b175-c3c60761e186", "value": "97b82200d13463908f34da60a3d1fc92d92706e8044ed73935b567d28df5c7ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9098b085-4e48-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778620899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778620899, "uuid": "279089c1-63ee-4bc0-80f4-93d85620c566", "comment": "Malware payload (Mirai)", "value": "b7fcfeb40fcbc46369e3f7756115abb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778620899, "uuid": "4eb1c374-76e3-4324-8cdb-e96a414893b3", "comment": "Malware payload (Mirai)", "value": "97db30bd8c76a4e1d92c050fcaf8174b010e07f50d3a4b70f37158d179c5d3b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778620899, "uuid": "a100758b-2cf0-4b3a-9219-a96e1a838e21", "comment": "Malware payload (Mirai)", "value": "67e65a966a8013572429b0594f7641cece1c952b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778620899, "uuid": "9e45c0f9-7220-48b8-8bac-844c6777ce09", "comment": "Malware payload (Mirai)", "value": "6ee5a88ff8dde54fc62b2c140fdbc57c65d0a8b464ade3e4dbac1e38f553920fd3449cb814d9680a9a06cb1bff410c6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778620899, "uuid": "a543db2b-0e44-47ff-8110-fbeec0a3a475", "value": "T15A730892FE81C941C5D529BBFA6F41CC338307ACD3EE72029E019A3576DF55A4A7AE01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778620899, "uuid": "dacc8b8a-9e82-4eb5-b5b1-4f2e7233897e", "value": "1536:yBoSrNjxYNyeyDVvDEOeulCjVmNiUoB6Orh0jEa07:qIyeab1j0V0i1B1ta07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778620899, "uuid": "7f1bd835-03f8-47a6-9ef6-3e343814a302", "value": 77460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778620899, "uuid": "212f0afa-a05a-4415-bcd6-3b4d56f0e52f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778620899, "uuid": "60af97b1-a617-4740-a1ab-53f208e7e3a5", "value": "bot.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd53837-4e43-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1778618531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618531, "uuid": "60eb1520-50f4-4d80-a281-3611231f805d", "comment": "Malware payload (ConnectWise)", "value": "5176752fb9673529f5307ae17fd8e08f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618531, "uuid": "c59bb110-2116-41f8-817b-c78b4cef90ae", "comment": "Malware payload (ConnectWise)", "value": "9a6ae055b83ba9b350ab693c4b58f13cc93b18c6b357ccc5898bc253333f8f6f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618531, "uuid": "72d0309c-7082-4c7d-a3e6-15a8eeec6c31", "comment": "Malware payload (ConnectWise)", "value": "e21809145f535eb9adc94ce66cdc45578c86b212", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618531, "uuid": "c900aacc-d405-42da-adfa-42c2d2b00ac3", "comment": "Malware payload (ConnectWise)", "value": "e7af9b9ee541cb63eee69a732a2159e2a33a3863f36150283215aec9481b4d81b0243d34b35e12f339b742c632d586fd", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618531, "uuid": "7c85725c-4b71-462c-a29f-314e806bd29a", "value": "T1E7A623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618531, "uuid": "a67284f1-82da-4f8e-92e5-2b063e2cdfd7", "value": "196608:7nCtVYqI5MvbWEpKkqVIJqKHnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkq+nCtO:DCXvI5MvHx5JtCXvI5MvHx6CXvI5MvH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778618531, "uuid": "3fe456b0-656c-473c-a88d-a23a0ebccd16", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778618531, "uuid": "35de7800-1c52-46d7-861b-3aa0e1a84223", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618531, "uuid": "a83b054c-1a07-4b1f-9ae7-dc3bb608e4d1", "value": "ScreenConnect.ClientSetup5.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188067b8-4e0d-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778595357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778595357, "uuid": "4ee6b8fa-1ce0-42be-8872-4806332222b8", "comment": "Malware payload (AsyncRAT)", "value": "e17d0e0420e26a6911435ee2fc9bd881", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778595357, "uuid": "c6bc9a0a-66ed-46bf-a22f-dbd819b20fc1", "comment": "Malware payload (AsyncRAT)", "value": "9b671e6219a487cfff8202a1372cf92229eb9c372cbf09d6f0822d441a703aca", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778595357, "uuid": "aec30f40-7caa-49cc-8a74-63606021d5c0", "comment": "Malware payload (AsyncRAT)", "value": "2378a5c6efc3c43a3c6d3f453e4a02ef109e9761", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778595357, "uuid": "eb4b9f34-cfff-4163-995c-357c54bdf14b", "comment": "Malware payload (AsyncRAT)", "value": "838eda44f7db4c07254669fa7a069983ce02e22fc284c0d3b3c9f428fcd9e1da3960b46106271bf42dc28babb908fcdf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778595357, "uuid": "ed6fbaf0-c65b-4291-b62c-3162abdf6d52", "value": "T159232C0037F9822BF27E4F74ACF26146867AF5677603D54A1CC442D74A13FC69A42AFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778595357, "uuid": "8bb34971-ec5c-482c-b4b8-1f7ca4c28018", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778595357, "uuid": "5772c93e-b6e3-41b5-a896-f3b223d75bd4", "value": "768:fu/gbEcT8A03OWU8hhQmo2q90o0G5iF8hjKPI2KG9anLV0b/7fK5h5gjgLaimVM9:fu/gIcT8XG25Cv2KCaLib/bIhKsmimet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778595357, "uuid": "e9ff9c34-666e-4f8c-b2c4-9b3ebee236b8", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778595357, "uuid": "e9ca702d-5a21-4ca1-b623-0f56e6af53df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778595357, "uuid": "6f597a59-29fd-48c7-8f5d-59a2777bef4c", "value": "noityeubatdau.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b4b10e7-4d99-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778545701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778545701, "uuid": "8c2eccd6-e071-44ef-b180-86be1591b5b7", "comment": "Malware payload", "value": "8901d860805664114494f7d2612938e6", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778545701, "uuid": "03833a6a-9ba8-4c14-b317-ba55f90899b9", "comment": "Malware payload", "value": "9dff4c782d0dae42c5aef8a755da13a2ad9b7ac2172d0e2753d6cf145d7e3e64", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778545701, "uuid": "7d79923a-fcb8-4541-b21b-dfe72c6e20f0", "comment": "Malware payload", "value": "bfffcd150b4f29ab9d9ad87fc02d8da20f304ae7", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778545701, "uuid": "793bcab7-37f1-46bd-a59d-373a422a1e3f", "comment": "Malware payload", "value": "2df3dd7b1a1c7a3fcefbfe5352dfd723a99ae755697aa56f18a670dfe528b647d62ed49ad33ec6d46ef3a32522257b40", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778545701, "uuid": "39a4a164-9ce4-45df-b4d5-81a42f329445", "value": "T1F8D3D0CA99DE8CEC4B1F2028351F7D03994FA357052DD980FADDAE913F52AA071AB5D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778545701, "uuid": "6197b1be-627d-44c7-9105-981da73d5003", "value": "768:kmCxfZ7PCMt1ckWcdfMuayauZkn+3XbN6TYCJ8yKZlZmzivQOy7aqRe9088eFv4O:NkzMRLjQdbCvHUEuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778545701, "uuid": "d5a11b73-7f9e-426a-81a5-7a0f56b0e89c", "value": 134882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778545701, "uuid": "f79c90ab-84c5-4a86-865f-7ed0554c68e2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778545701, "uuid": "79e8fe4c-8762-402c-af10-f9602c79f3f4", "value": "Europe_Project_Backup_487.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3b7f0e-4db6-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778558324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778558324, "uuid": "705b45bb-abca-40b6-8682-be1bc7a64d17", "comment": "Malware payload (AsyncRAT)", "value": "e8591768b06041469ee0f771690cd1ae", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778558324, "uuid": "89e10a6c-9236-4c1f-a5b5-1bd427326bfe", "comment": "Malware payload (AsyncRAT)", "value": "9ec0777164bfb8981553f9beec161e092b05ffea560ef90d0d5333797eade5c2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778558324, "uuid": "7f928865-d247-44e1-9087-94abf3998396", "comment": "Malware payload (AsyncRAT)", "value": "1e1367291443fbb57404481a72db9a02e002534b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778558324, "uuid": "539fc8f3-530e-4946-a93e-b0528312ac2c", "comment": "Malware payload (AsyncRAT)", "value": "bbd02124662c1b590ed5652eee9944c3853143d6e9b3e6cf2fb260e0b2728e23bde66bd49d3f3091482f620b0d52d49a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778558324, "uuid": "4c6076a3-5084-45fa-94f0-ac978ba46153", "value": "T15A835B042799C915E1AD4AF4ACA2D6B002F59D332412DA1F7CC47DDB7A9EFC199032EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778558324, "uuid": "75bdaa19-4bfb-4a7c-b5a1-be00c7ea2cb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778558324, "uuid": "3eb0144f-e36d-4c30-a67c-dbd329459a4c", "value": "1536:8vDjSFPixiEVHMZGbbzwduGGck7TxfHIIId7VclN:8viFPixiYHAGbbzZIIIdxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778558324, "uuid": "d4427853-28b4-45d1-bbc9-e4957e75507c", "value": 83456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778558324, "uuid": "95b7d905-73b9-4f72-945c-447ac1a43e0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778558324, "uuid": "c786d71f-9fcf-4bba-8bf8-987e5d6af7c9", "value": "nexusflow.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04774ae-4e15-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778599128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599128, "uuid": "e4c4d703-3830-4bcb-9521-17767891dd91", "comment": "Malware payload", "value": "82e0374b5fa4f302399c8c90d33a722d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599128, "uuid": "6bf42e27-c547-48a7-a160-fe216c488d4f", "comment": "Malware payload", "value": "9f254e434675671ff63b3e29c4ea62972a13abbe706746e2262b902b2b503efe", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599128, "uuid": "de4d4531-df57-4c09-b1dc-9720c638e270", "comment": "Malware payload", "value": "b152a3b93e1cd0265023be9ff866ec4a1ffc6403", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599128, "uuid": "78269b18-d032-40b1-ab29-93e84855e3d2", "comment": "Malware payload", "value": "c05418c1e0b8ddb1746b1a6e52c139865b0d55f0f04c440ba755fd8cbdb1a625b1013dce39c123cbcf876323a09ff26b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599128, "uuid": "cade4cf4-b632-43c8-a63f-4f8eaa62209a", "value": "T1C4926C0FB9554319D5C00434A1B2877FD6BA9876338454EFFBD88ACA1B682DAF83215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599128, "uuid": "540f3c14-cefe-4e62-8215-bca21c51889b", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599128, "uuid": "8ba9c974-8f69-4a4c-b48f-b492312d8123", "value": "384:IIkj7VlvadxaizO5wxDSZvu98t2rFJ/Bwav8U9cpG:cax3qAUG9o5a0UkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599128, "uuid": "3ab5889e-f681-417b-a2aa-e07fe763eb32", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599128, "uuid": "702a0203-305f-434b-a4b0-b1b30e345b08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599128, "uuid": "7bc3dff2-f1b0-4f26-a0d7-df445ffebae2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0ec24b-4df5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778585404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778585404, "uuid": "c9c959ce-520f-414f-8084-0a0f0bc0da05", "comment": "Malware payload", "value": "f0b242b6b044d65cfc5a94cf15a59592", "object_relation": "md5", "Tag": [ { "name": "103-43-8-214", "colour": "#6EFBCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778585404, "uuid": "14df2d88-9bae-4954-84b0-31fe879a7e82", "comment": "Malware payload", "value": "9fd86d809325890245608d08cb4e0ec19215e588f8c91e9b26efcacf4427851e", "object_relation": "sha256", "Tag": [ { "name": "103-43-8-214", "colour": "#6EFBCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778585404, "uuid": "10ba15e8-4929-482e-b876-2a4acc081427", "comment": "Malware payload", "value": "8bc9192c1a4bdec09f6abc99ea197ef1dc54e335", "object_relation": "sha1", "Tag": [ { "name": "103-43-8-214", "colour": "#6EFBCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778585404, "uuid": "b6eface8-cd94-4283-b967-4f112f2fac33", "comment": "Malware payload", "value": "86470418ddac0dc03a41234933d4ac25ce3622da8a7c2e3143614efb70ef8c881f154b1060c75074d107c6211a831a85", "object_relation": "sha3-384", "Tag": [ { "name": "103-43-8-214", "colour": "#6EFBCE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778585404, "uuid": "df002ccc-7752-4c7b-acc3-ffd1064d4c06", "value": "T16771B58160541AF2D94CE37FC487B8A5FD4EB248A2C84B0F0798D81A2FB107BB0DD613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778585404, "uuid": "d41d2543-c9af-468c-a755-4ea2784942fb", "value": "e82dd51b077167be63c004bed23d0c1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778585404, "uuid": "64b5ff3f-911f-4744-9565-3fa3e2ae90ab", "value": "48:6IZUBQYxZul2EywS6D67jk7QLzgzIzQz4zAzo157D9N9XM/geu3ahr0/x:2BQMZ7EywS6D6f++D9vXeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778585404, "uuid": "1da4c486-7f60-4e76-82df-c2df9b9575d8", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778585404, "uuid": "186d2f96-b0a0-40dc-b869-97b2a64404ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778585404, "uuid": "8f455c67-24ea-430b-8a7f-dd95e7e62f83", "value": "9fd86d809325890245608d08cb4e0ec19215e588f8c91e9b26efcacf4427851e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6cdd3b-4e1e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778602857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778602857, "uuid": "4d08d43f-31fb-48c9-b3cd-5c544008cd75", "comment": "Malware payload", "value": "8280e45285c3b3077f686cc08ba7b10c", "object_relation": "md5", "Tag": [ { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778602857, "uuid": "e99f6842-d7e1-480a-aa26-6bb7a9648809", "comment": "Malware payload", "value": "a02c7cb4a3c8839199de4c74d3f11eb55f8b934cc2784b99090b2719fe40783b", "object_relation": "sha256", "Tag": [ { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778602857, "uuid": "dbf02702-8908-493e-981b-cd2f36f61082", "comment": "Malware payload", "value": "28a127f4331ed540c34b41d836ee2ea549579526", "object_relation": "sha1", "Tag": [ { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778602857, "uuid": "f45d5a2e-d6c4-4f88-a4ac-875f93088ede", "comment": "Malware payload", "value": "47ae1f846b634d09772eca56a77021e667561342c3cc5500b50d7146362627fac62b7a8370bcfadf9b140e666baa088c", "object_relation": "sha3-384", "Tag": [ { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778602857, "uuid": "9e80f967-bbc0-4bd5-871a-bba5d66e9648", "value": "T16582D51677B854B74A835BADD9DDD20CAA2D863B201E6D20F4CCC384EF2161E47E47E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778602857, "uuid": "0f5cd96b-e620-4888-9499-3e9813bf0888", "value": "192:bMVbnidJG1hen1gTzWAEhbmZbe5bIkQqbzY9wG/bnbQm0OvmAQlsDbSI/mSIkFmm:bMVA5nu809wGIyEsnOt/oLgi1Ov5eb4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778602857, "uuid": "46ac3a88-affb-44e0-a647-be397d9f5a6d", "value": 18719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778602857, "uuid": "3be253f6-fe94-4eaf-b408-1b12e5853ccd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778602857, "uuid": "921f7b49-96a5-4db6-991d-6978f85cf8fd", "value": "a02c7cb4a3c8839199de4c74d3f11eb55f8b934cc2784b99090b2719fe40783b.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783be295-4e0b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778594659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778594659, "uuid": "4773c6fa-5008-4425-abcc-a2e75cca9507", "comment": "Malware payload (Mirai)", "value": "779962e5d1f1fe4205012fa572cd77ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778594659, "uuid": "a65b5f2a-3554-495c-98ac-dd9a3fe7bb4d", "comment": "Malware payload (Mirai)", "value": "a050b114cb95884607be7db5c38b8d6fc581e44e1ef313c702fb9a851021bf9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778594659, "uuid": "71e2ddba-9e51-452e-a9bf-69ddb9499cb4", "comment": "Malware payload (Mirai)", "value": "c60352b08794b511c349ee62c32679a67f852010", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778594659, "uuid": "621d3a10-596e-4ea4-952a-e2cb39906e9e", "comment": "Malware payload (Mirai)", "value": "0ef359f8d79918d3f901375873cb8a004aaef2dac786acc90403974978eba2e6e7f64786f8ae1a049516e219de6eafd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778594659, "uuid": "e6300062-b6b8-4bf0-910c-77d84e55bde3", "value": "T12A341902A8528A53C5C21B79BB5F46593733AB34D3DB7302DA28AFB42F476DE0E39511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778594659, "uuid": "d5bba14f-fd23-4ad2-a20a-21d28d424dd1", "value": "6144:XAUxYxpQZDff/avM7s7f/OyC2DoIuy0nmW2hVDZI0/16O7Nc:XtxVZrf/aEg7XOy/oxnmW2hVD60/16Oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778594659, "uuid": "3f59c0cb-4f2f-49cc-a8e6-777d78eb0f00", "value": 234578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778594659, "uuid": "e0665eba-99ae-4614-8d27-97fd5baef5be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778594659, "uuid": "94c7d2b7-c83b-4006-bd5e-d7fc3c36d287", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad9c0f6a-4e0b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778594748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778594748, "uuid": "76448e33-89db-48c8-865d-48799e1c6dc9", "comment": "Malware payload (Mirai)", "value": "01d681aa0e9de339949e843c79b8fac7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778594748, "uuid": "9c0ded8d-fe04-4000-a189-d2453e649d98", "comment": "Malware payload (Mirai)", "value": "a2235a8c25bd749e10d6d08bbfb1ff9022352dff5c494b034423c6ceb354413c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778594748, "uuid": "d8c9de9a-0609-40e9-8877-3e70aee4402e", "comment": "Malware payload (Mirai)", "value": "4e292027c5ed54b7f6be6dda7054f0e72296c63f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778594748, "uuid": "9a00c6df-9abb-48a1-8d03-a2c29b61c9a7", "comment": "Malware payload (Mirai)", "value": "1d17c0cb3037e5be0f1946985f2708cba46fa6a175c27ae37bf3f6e2a6671b9900c6fc4c8899bbb0bf8f43e349f6de17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778594748, "uuid": "0da2b8ff-ec20-430f-afca-a52d6b2aa8ab", "value": "T1F1243A0775D08DFBC4C68BB50BD791328933F8291B26664BB7A8FD951F0EED86A1C604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778594748, "uuid": "8d8e480a-06a3-4f17-a7fe-78c409a44fea", "value": "6144:6tfnzv+YCUqesPcLrFTxpkvKHg+heN9KAM7pNNle:6RnjC69kvKHg+heN9KAM7pNNle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778594748, "uuid": "d3f78177-2ce9-4553-9447-38c091b90f26", "value": 221204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778594748, "uuid": "54f7fc98-e302-4482-9e30-edf4c23aa2e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778594748, "uuid": "5f47dbc3-16c4-47f9-a84d-baf299e4206b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e71469d-4e48-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778620895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778620895, "uuid": "a6123079-778f-4c2a-b88e-7804bd99af33", "comment": "Malware payload (Mirai)", "value": "b0b34adbfa81ff2921cdf1d10bdd4a54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778620895, "uuid": "55b70d06-9a49-49c5-98b0-31984fdc57b2", "comment": "Malware payload (Mirai)", "value": "a26f8385f8269f7a74c4340222c8fb3a9207e016d5c58dd566ff98963203d26a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778620895, "uuid": "caeef2b9-ad40-4f87-a14a-61b1f292a4bd", "comment": "Malware payload (Mirai)", "value": "f53eb7e5ae2a2b5448186ce2588b8253a1766342", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778620895, "uuid": "1116fb54-dbef-4972-b5a3-cfb408d995dd", "comment": "Malware payload (Mirai)", "value": "5f72c5a2b31250fa94a8397a8560bcd70fbc1dadb95cd5eb7645a1f8c1cbc0d4b578db0163ed559c5d9d82691a964a96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778620895, "uuid": "60e07dfa-89f3-4211-8a82-f32762d4a5e1", "value": "T1A3536D85F743E0F0E94B0671111BA3BD8674EE225018DE6EDB947E77AD32A12E21B71C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778620895, "uuid": "2edbbead-a233-4a30-ac3b-e19479455267", "value": "1536:bHU2QGqp7NRUS31EJxjVWo2gnPrZP7tE0mr:b0pGKl+L5LjFHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778620895, "uuid": "c166b7f0-ec95-45f2-8c03-4511d47c20c7", "value": 66456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778620895, "uuid": "56168b39-dbc3-4cd3-a785-9e34be43fee8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778620895, "uuid": "c615e675-a6ec-4109-9be4-e7ecd13ec7de", "value": "bot.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b0e925-4e16-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778599372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599372, "uuid": "56672439-4e23-43fd-b18c-953e4fa42bfc", "comment": "Malware payload (AgentTesla)", "value": "a64b88886eb159809acf533b4ffd23df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599372, "uuid": "cf0d8dee-8f5e-4118-9987-fbabbba3eb4d", "comment": "Malware payload (AgentTesla)", "value": "a2b77c33ea165b0a7b753e41a7b9bc0c626cc323feb031203cf3d52e3f750f9c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599372, "uuid": "e0ffafba-19e1-4278-b1a6-2faaf171feca", "comment": "Malware payload (AgentTesla)", "value": "5658db16e8b944ce20fb293617e26caed77cb687", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599372, "uuid": "9c201750-13b8-48ea-89d1-c30c82370df4", "comment": "Malware payload (AgentTesla)", "value": "c4e039c45075b427aa767baca7a3010530a20aaeffac43660d1754b07bf378ddfc2110ea6d61d89d3579f1847e850bb1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599372, "uuid": "289fbed3-9178-48c2-bedf-9d540a1ec5fe", "value": "T1ED45CF2D368F495CD5A1DB788F333BD41770C47658F2D35ABF8C5378A62A6E09A8C242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599372, "uuid": "d96e3ba0-8d6d-418e-83f6-67ee9bbfff66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599372, "uuid": "161d3a13-3086-4021-b541-da5d29af1836", "value": "12288:zkiAJBBfe7MYBUwo92piHlMmau1ouSl1rFumN2H8+9VL72BrgbkNEQCvoGFvxGtY:4toAPCmQui1rBgc+90HEQCvoGF4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599372, "uuid": "c2c5ded4-1e19-4e96-8059-c626a5105fa1", "value": 1276416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599372, "uuid": "c07b4aac-0433-4cb5-8ddb-d4b5c94d1947", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599372, "uuid": "ccaf98f4-972a-4d52-9ecd-e6b0ff43898a", "value": "recibo de pago anticipado.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc91e9d4-4df2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778584036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778584036, "uuid": "85c36e42-0691-4158-85bb-7ccdc97e8912", "comment": "Malware payload", "value": "1881b808eb173227d086225baf90e79f", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778584036, "uuid": "df03702d-300c-476f-8271-0846566b9eba", "comment": "Malware payload", "value": "a3784a1502fbe0546f7195706a40628ec7bbe9825b0f54dd7ab7a8713874d65b", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778584036, "uuid": "700b98fd-e159-420d-9db5-1f74ed3a5791", "comment": "Malware payload", "value": "ffa4a8ad64916613371d37f68c14a8fc13cddc3d", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778584036, "uuid": "3c01381c-8c0d-4b5e-835a-a718b7376e11", "comment": "Malware payload", "value": "d5203fc47c48a4e9b88ce7aa3620be5dac1419ffbc8f29b6ba4da4adf9f67cebac4fcad0b079dfbe991057b9e2ad431b", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778584036, "uuid": "cb6d1fa7-20e8-4ad3-b0fc-857a3ae116bb", "value": "T1A7714352D8492A33C3C351A94962D56573ABBC43D30788B879EC83A16FCA136C0A17EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778584036, "uuid": "ddd30196-d4c7-487a-8b82-1aab9b21d2d2", "value": "48:VA8P+BVcS51u4gqGPKUvwT8E07imDmmYu9ptpJX96o/K7dcFz9UepP22y+PHS:VA82LyCUoT8E7mDminpJJ/Gi+D+vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778584036, "uuid": "30370c95-ddb1-4e67-9c1c-f3cd0ae6d582", "value": 3729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778584036, "uuid": "7556ea07-c90f-4cbe-93c8-9b5fefe96313", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778584036, "uuid": "f4b17e9c-57dd-4c73-8019-21e1803d28c1", "value": "roulette.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e59d5c9-4e42-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778618211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618211, "uuid": "8cf75c6b-a678-4b1b-86bc-c3fe4b03d041", "comment": "Malware payload (Mirai)", "value": "7f77dad01cbc5ea8620081ebd680289e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618211, "uuid": "18028e25-b4cc-43ba-8111-d276b033e7c1", "comment": "Malware payload (Mirai)", "value": "a3c5303cae42b07769a28210574260834d1bd8d1179442e341dde0a2cac7daf3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618211, "uuid": "897ac10c-df1f-4713-b991-bf086165d313", "comment": "Malware payload (Mirai)", "value": "ee225948d1418ccbaaabef9063b0807606aed6bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618211, "uuid": "5aa81dca-c142-438d-9eee-3b1ab9bcf25d", "comment": "Malware payload (Mirai)", "value": "fb4847956af7b598021d10ef88f2692d7aee17b854ea2637bdf2bb920760c18dda151e7a1d2105641ca385ae109b2559", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618211, "uuid": "66d6b359-1ba4-4500-8b71-187520ea9b1b", "value": "T1A76302CEC8E43E8DD1CF293D9556B9B14B5C29DC3921904D536C86978F2EB97A1CC0A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618211, "uuid": "7c0fbf20-c51c-4ef2-ac2e-a13c5dfac63e", "value": "1536:9flMl1rXikAlkL9+es3IWDbM0VxxQ//UDHhkHqHANO:41rSXkx+esj1Vxxi/UDHhGzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778618211, "uuid": "6a327310-ac5c-4d74-a858-1c957a7fce59", "value": 69684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778618211, "uuid": "35fc0e6f-79d6-4a0e-9696-547ce0d50d1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618211, "uuid": "9fd540ca-3c7a-4d05-8fc8-80bb71068361", "value": "SecuriteInfo.com.Linux.Mirai.9833.12197.9381", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeea9ea9-4dfc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778588308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778588308, "uuid": "5f1d91f7-26c0-4856-8254-534a481aeb37", "comment": "Malware payload", "value": "e7976be8a2f6dbe2ff9f39703aa7115a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778588308, "uuid": "3cadd82a-3548-4e31-b4c8-e6f1dcdf2948", "comment": "Malware payload", "value": "a464fc665f3c380c70d724b8dd20fcfaec823a40dde38314ca845410891241c1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778588308, "uuid": "7188f0f2-eb50-4185-afa9-c3ec53ccee72", "comment": "Malware payload", "value": "58f74e4c86fc78d650319d74174dc9a25d77063d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778588308, "uuid": "de7ad3d8-0410-4a82-9f5e-0d47e33ab002", "comment": "Malware payload", "value": "04fcf460a36c88fa8e031a2a08b61bb2b5df0d3b0f029e0406d0442f1e5b1eafd9b907da0bf3ef2fec6e70e0f0525959", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778588308, "uuid": "a645c08b-2b51-40e4-a156-e1a18dc642cf", "value": "T1BDD097E280A30170B0774C52F5C3B400720893BECC928D2EBF8321BA2E38796F8C02C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778588308, "uuid": "9d9a3c40-d562-4b2e-8cae-e7c94db7ace9", "value": "6:hTuDuYEg8kpj1udQBo/AulNXYq9DG+NjVsNXYrkJ:VuD4kNkvPiq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778588308, "uuid": "88f5d10f-86e3-4c99-90aa-1df6e9c4f676", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778588308, "uuid": "5277b728-8a8b-4341-94fb-27e2a1f6c17a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778588308, "uuid": "6f2d4302-47dc-43ab-b1ed-6a94c1c582b1", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d9e5b45-4e42-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1778618210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618210, "uuid": "0399f0b3-1708-4126-9aa7-460ff97d8eb2", "comment": "Malware payload (Gafgyt)", "value": "27097cbe98b2c03a014132f520727b9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618210, "uuid": "63d66776-ac8d-408e-a0c7-7f6b2aa43a8c", "comment": "Malware payload (Gafgyt)", "value": "a6aaa6d204930abbc84c850c5080c30fc37ac80112b05e781dbf5178acd356df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618210, "uuid": "3372e3d8-ff30-4e1f-a656-8e83573e1038", "comment": "Malware payload (Gafgyt)", "value": "b31be56467255d9752b5d83f49482863e213bcc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618210, "uuid": "18ff487c-621e-4b99-a306-d3d18ca80bb3", "comment": "Malware payload (Gafgyt)", "value": "aade8647db02bb560690dcb824e67d513b1371d7df51ed8c2ad418883312d82ec051555a8c28661ab3f06cfe8856fea9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618210, "uuid": "0b1c2e97-7e11-45ed-83aa-a615a1dfd27d", "value": "T1D163F236062987FBDE1EC53389D003492F309EF2F85EED49294D8F2B859616C31AB48D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618210, "uuid": "1bc021c4-c65d-4569-bdbe-8ec98ff1c68f", "value": "1536:qt7QDJGm+vLj6pPuomXVGNwy06iDf5kZPD7VEWV:+aAoktGWJ6CBkND7VEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778618210, "uuid": "9bd2b885-2e24-4d42-84f5-9b3244ae2f30", "value": 68380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778618210, "uuid": "b70bbd21-7dba-4ab4-a604-d5c3c334dedb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618210, "uuid": "58f84fa4-927f-452b-9360-8cca2a920f52", "value": "SecuriteInfo.com.Linux.Mirai.9833.21227.15231", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a73ea5f-4e17-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778599843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599843, "uuid": "b4c55664-f90f-4136-8aff-4ea6b49413d3", "comment": "Malware payload (Mirai)", "value": "1ebf4b65068077fc45dbc684fed77c77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599843, "uuid": "0a8592f2-bfa9-4d82-9d13-7f278ad52c24", "comment": "Malware payload (Mirai)", "value": "a789cfaea68b2ae7c0ccbe8e63931eba81e50f131440c0795f58b31d5a9774ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599843, "uuid": "2f1494e8-7ac7-4b9f-b46e-55087f7a818c", "comment": "Malware payload (Mirai)", "value": "a5dc203fd15b45e514011907027087ae2bf3ee2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599843, "uuid": "613ae0e1-b277-4445-ad5a-60b52427b738", "comment": "Malware payload (Mirai)", "value": "9067881822992854822ad84a53f09fccfac3da25df54bd4d3df00a7b2208bda8f7ad697c7a8bfa14408006877b13f347", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599843, "uuid": "9fde89cb-69df-4b8a-ac0d-73aebeaccc81", "value": "T131F47D98E783D4F1F65340F0025EDBF21974A11AA027FAF2EB84265774737A22F5622D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599843, "uuid": "1b8fd368-3bec-49f6-8e2c-37bab4df9e97", "value": "12288:d96qzOZw7/xS40QhW+hmg/dpucmHjjh0a5uSClMhvhekBmyoTpgy/KKohhhOYxp/:P6ZZw7/84HhW+h3i50a5uSCehvhekBBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599843, "uuid": "ad421ce5-981c-407a-902b-7462d910ff1d", "value": 784372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599843, "uuid": "8a734fdc-af39-4697-860b-07aaec7f1f4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599843, "uuid": "c5b22aa2-2801-4a66-8335-0f3051539813", "value": "3atoNational.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af836e64-4e16-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1778599476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599476, "uuid": "569bf1f4-204a-4ed2-a41e-e3d1472b3eab", "comment": "Malware payload (CoinMiner)", "value": "230b0bba80002726ad7a77bb0bc0c757", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599476, "uuid": "0dcbcbd0-b4fd-4313-89df-9fd3fa342a8b", "comment": "Malware payload (CoinMiner)", "value": "a79af189dd8f2557c849d99e791231df053f5a70d4088cf5f8b61ed3bda48154", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599476, "uuid": "fd985d19-ecba-49d3-9a83-2a9f15d78725", "comment": "Malware payload (CoinMiner)", "value": "835f7be4833517451d0646f751006f60634fa0c8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599476, "uuid": "de426f70-de1c-4deb-88a2-af51954114e6", "comment": "Malware payload (CoinMiner)", "value": "141c797c0147eaf8da3f3a96ad2a9fc90f7790a066e42a2bbe4b0386a41cd22f7ffe7399b426fc9246a5fcf9e968255c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599476, "uuid": "c1ff2325-aea0-4e32-9840-cb5218f1833a", "value": "T13022FB197E4A4331D3A089F85875834B553D2623E783E3EFF373959A46663484C41D6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599476, "uuid": "fb16dc1c-4c79-4d68-ab87-f329eaa6ba2e", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599476, "uuid": "dc4157a2-32f9-4b03-92cf-06ffdf1ba11d", "value": "96:mBOdVoGYz/J4hvFDBWdCaD4DbFx+ZQnBpsTVwNYspKPFJxGE9mZ2FFhxC7tCEore:Mwo1wFDBFx+enfNKPFJxTEZmFhSor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599476, "uuid": "a94a3b14-423b-45e1-8a46-d9f53bc64395", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599476, "uuid": "c9d39433-6aeb-4a06-a950-7903ff22c97f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599476, "uuid": "dd2599e6-8729-490a-bba0-1342054e81b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dde37d4-4de4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778577972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577972, "uuid": "a90385a6-41de-4285-8628-2938cb07f2d9", "comment": "Malware payload", "value": "06501516f662e84ba0784aaf492d1af4", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577972, "uuid": "946689fb-185e-4578-b38e-a41949107a14", "comment": "Malware payload", "value": "a8e78082cefd7fe622734eaabea3d5b6299829e0ac4b3361819532c3a8cf7f6e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577972, "uuid": "637d1b7e-bab3-4093-8420-5cee3a732148", "comment": "Malware payload", "value": "bda540e62ad2be67d5ccc521a950061410cd049a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577972, "uuid": "c66c07f5-98b5-4909-8c74-cbdbbe08cc0c", "comment": "Malware payload", "value": "e7229cd20afb2126a82eaed0b8dcb3670467999acfeb07c0608bc7296e02f04c8224757912a4e7df55800ec5ba05700f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577972, "uuid": "f15a0c07-8a4c-4a51-b0dc-21dc8afc1247", "value": "T107F53BF06F462A8F22CB07154212A5716DEE77FF22B74C169A7A323E1CF0C9C5925972", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577972, "uuid": "ff46f64e-6829-4166-b660-05e22815d808", "value": "3072:bC+TrUA/kOD1Qoni4JTu256ok+EsqZOb7Zb5LYn7ZVAz91bdAh2nUxmap6OjJMd6:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778577972, "uuid": "3d779570-3eff-41d8-82ea-2bfe1ab2338c", "value": 3588543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778577972, "uuid": "c848329c-e5bf-4a29-94ad-1d9e3cd8d83c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577972, "uuid": "537bce48-299c-4f3d-9892-c051d82d229f", "value": "GroupTour_22People_3D2N_Request.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af05dd04-4e36-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1778613219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613219, "uuid": "d1ed4c7e-f7f0-46a7-9197-cfc136f9e20b", "comment": "Malware payload (Gafgyt)", "value": "2a93cc2f1f9471d1d1c940f7636ecb27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613219, "uuid": "a8117fde-acc5-42cd-a2ed-5b6312772f04", "comment": "Malware payload (Gafgyt)", "value": "a91f6fb11ba97942349399c650644deb30aa4c1fb2170fdca2268e1dc43738a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613219, "uuid": "1d38dc51-b132-4103-bd89-0527d75fc682", "comment": "Malware payload (Gafgyt)", "value": "ee755696fe83919dd4b58760cc65ddad06cc4f55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613219, "uuid": "409f6cdb-6a56-4604-974b-4d87b7b4c603", "comment": "Malware payload (Gafgyt)", "value": "c67d42b96215c8f8f7f779d0deda77942407857a4966ce82dd0ef30b0683c2ae984c0439bab327deb0906c823d0d7c88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613219, "uuid": "07211442-359e-4533-9015-3e7d50333f28", "value": "T165934923ED125F0AD20BA4F060F59F351F22B8FA89975AD9E065DAE46543CCAB015FF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613219, "uuid": "b5d8a8eb-f424-4752-9e06-d5bdffd63401", "value": "1536:m2hGraninXVZsKIdkS/ZD2iI4WCPG68Lze15hsZanmppm:1yauXVZzIBD2iI4Wn6Z15hKampp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778613219, "uuid": "29a1965e-1c53-4cb9-8eea-b088f501ed0c", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778613219, "uuid": "7b6a513c-4a2f-4058-b59f-7ec157b6ee3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613219, "uuid": "00dbd9d9-2e00-4384-b094-24b4ab14a1d2", "value": "FBI.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d200f866-4dec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778581495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581495, "uuid": "ce91b6aa-a527-4434-9f2b-187d787073d9", "comment": "Malware payload", "value": "8a674a3c2c8a60026431e2398273b069", "object_relation": "md5", "Tag": [ { "name": "jicinvestments-monster", "colour": "#D62FD4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581495, "uuid": "698536ef-070b-4926-a363-801feb4e6126", "comment": "Malware payload", "value": "aa4ceb7641d5f44fbb1f4b2dd6a4952059cdd909d14b2d21dc1f0b49af0b16c7", "object_relation": "sha256", "Tag": [ { "name": "jicinvestments-monster", "colour": "#D62FD4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581495, "uuid": "58baa769-f7fd-4fcc-ac0b-6fc4513e14d5", "comment": "Malware payload", "value": "f7ad2fbb0ec4012597e95a1e89b814417ae521e0", "object_relation": "sha1", "Tag": [ { "name": "jicinvestments-monster", "colour": "#D62FD4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581495, "uuid": "88d88006-6eee-4edb-a6f4-c13656c387f0", "comment": "Malware payload", "value": "6db97afde44cc33d6b4707d4f91d5f0550adf6009012b23a05afde11ff49ce1ecb60795e5158e6c1854d685a436512db", "object_relation": "sha3-384", "Tag": [ { "name": "jicinvestments-monster", "colour": "#D62FD4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581495, "uuid": "e865e35b-112c-41d4-a4ca-202bf0304585", "value": "T1474184D97EC85C84F3BF422DD77B9ABFA5131A99D89ACE1C011C82C23E21AD17E45852", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581495, "uuid": "6b08340a-500d-4202-aa5d-71c990ffc02d", "value": "48:fxJ8X6zmjrbMym07DPjRWmU+hSHH0PLTo0V+uMVQz:0B/LiYq0fo0bMVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778581495, "uuid": "07977773-5f27-43b8-9392-6a7450359242", "value": 2163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778581495, "uuid": "021d5b68-742c-4979-b0b8-facf61e093df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581495, "uuid": "797b62ad-df0e-4440-a349-75b1b85a390b", "value": "aa4ceb7641d5f44fbb1f4b2dd6a4952059cdd909d14b2d21dc1f0b49af0b16c7.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3529eb-4dee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778582130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582130, "uuid": "d5acc82c-1a09-4619-81c1-d0f7f75cbbc0", "comment": "Malware payload", "value": "833fd59ebe66a4449982c6d18db656b4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582130, "uuid": "7f14f875-3d5e-48c9-9bcf-5b8e4242083e", "comment": "Malware payload", "value": "ab4fcadaec49c03278063dd269ea5eef82d24f2124a8e15d7b90f2fa8601266c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582130, "uuid": "cf866f66-d57f-4cf8-8742-6670ee9414da", "comment": "Malware payload", "value": "12ed9a3c1f73617aefdb740480695c04405d7b4b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582130, "uuid": "b025007a-6d06-4255-ad72-b0335a7d8da6", "comment": "Malware payload", "value": "a8fa63ff5ce1f8606e1bfeadbc26b4b1aa3b423e9b07f8c57e8d54e71fd1a0ab0de79657030d38ae2e6636643d22f5cd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582130, "uuid": "eaf7f63b-7516-4568-ba62-e183c3ee0baa", "value": "T15DB5A444B3C0789023479FBA771BB0D6E56E08ED7899085BD214FC90B9B6717EAF2934", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582130, "uuid": "398b6f6c-d13e-4345-92f5-5ba98e4f325c", "value": "49152:+4uRIKCnhiCJndm+8I3N2vfiQPIDPsMTNC1PZXCSpcyKaHeBirVYpgaontsN/97o:M4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778582130, "uuid": "24e1718c-c64a-43ef-a28f-7ce15ff075f4", "value": 2341681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778582130, "uuid": "1e1739d5-e224-4ae1-909c-68768920a21a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582130, "uuid": "38723bc9-a2a2-42a6-9afd-2663ee53b3d2", "value": "router_init.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99071075-4de4-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778577964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577964, "uuid": "71a78165-50d2-46e3-801d-a5fe4aa49473", "comment": "Malware payload (RemcosRAT)", "value": "467c05049eaeddf19bca65b1f7c31e81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577964, "uuid": "70dd6826-fdef-49b8-a41b-70be9a37be10", "comment": "Malware payload (RemcosRAT)", "value": "ab7cc5d3f736c595cbe049adf4d3503296ad3cc0e3dbc32e079800e46bbfad2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577964, "uuid": "0c9331ad-9792-4ea6-8692-f6641ffc256c", "comment": "Malware payload (RemcosRAT)", "value": "d3ea9897abaf8c1f2b4e48cd365a0b5abb8db76e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577964, "uuid": "7a8c5a68-2600-4846-a9d9-294f4d48d40a", "comment": "Malware payload (RemcosRAT)", "value": "f35b6ed8d98f46fc0b04c4f67555aa2a5a891b43aff770110dea2e93a28801bdb438a60c8e9af74422844dc8dbc22afb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577964, "uuid": "ea94131c-8889-477c-a81f-17252e0d1048", "value": "T10A9308477F0641B2EC6112B06688A762DBFDBC221649ED57C394E1833DB4F8AD06973B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577964, "uuid": "8fb4b462-035e-4eee-bb13-4139cabcdbb8", "value": "622b0d08efa212b00b0382e18e94b6f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577964, "uuid": "d85328ae-bcd6-4333-b3b9-b817e4109b33", "value": "1536:Q0qM8jTeFe66F4+rGRsXjxR4VE3OPdOzq1z35Vm/S+MR:fqM8+466FzyRsXVR4V1PdOz+zDmK+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778577964, "uuid": "b4238509-b30f-451d-a88c-b524259b9036", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778577964, "uuid": "b228d05a-1ab4-410d-bedd-3347d128cc2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577964, "uuid": "d20b943d-62d9-4fd4-a43a-105b79809e9d", "value": "true-religionjeans.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89e96ea-4df5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778585399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778585399, "uuid": "e657c1ba-3247-4cc9-a2e6-2486c7d03589", "comment": "Malware payload", "value": "7e7a51d46ca515e9ca1006c3f3bf76c5", "object_relation": "md5", "Tag": [ { "name": "103-43-8-214", "colour": "#6EFBCE", "exportable": true, "hide_tag": false }, { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltstrikeBeacon", "colour": "#01FB6F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778585399, "uuid": "122e1f04-a32f-4c23-8283-434aa5785aac", "comment": "Malware payload", "value": "ac443b7d7bf80fb030fc74025d0faa98db26cd98bf9e8c524383eab7c9893796", "object_relation": "sha256", "Tag": [ { "name": "103-43-8-214", "colour": "#6EFBCE", "exportable": true, "hide_tag": false }, { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltstrikeBeacon", "colour": "#01FB6F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778585399, "uuid": "b3f6e207-6e6c-476b-ab17-6fe1c500af02", "comment": "Malware payload", "value": "3e6faa6680bdbe0c746491a28ccefc43022850c7", "object_relation": "sha1", "Tag": [ { "name": "103-43-8-214", "colour": "#6EFBCE", "exportable": true, "hide_tag": false }, { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltstrikeBeacon", "colour": "#01FB6F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778585399, "uuid": "e2ee969c-698e-444e-9a0d-d5d8d249f5ae", "comment": "Malware payload", "value": "6c4aa4ce71f16420bd9362c6849fa7afbcc399fd14020dc7a7fe8b981990a6eae392a692c652d852d5923ac769d5a644", "object_relation": "sha3-384", "Tag": [ { "name": "103-43-8-214", "colour": "#6EFBCE", "exportable": true, "hide_tag": false }, { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltstrikeBeacon", "colour": "#01FB6F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778585399, "uuid": "963eefb5-9fda-4285-86cf-b981e696b1ca", "value": "T1CD3423B54D1AFC05C93C072692A7337A93F69A426ED9694EE2BF2D84301C5B9007C6F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778585399, "uuid": "a11f7ee6-088a-4517-8dfd-58c94d6404ae", "value": "6144:/m9oRig8/YVL+BgU09kKcsv+Rbs6wiClSahZxsC4agfxWF:ovj/YVKhskKyyhiCoYN6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778585399, "uuid": "2e057822-2782-4e85-b193-e9fa4c14ecc8", "value": 252349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778585399, "uuid": "b3d3f2d9-ffbb-4349-9bc5-cfb6d5c78859", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778585399, "uuid": "5ed0de9a-2860-4ab8-add9-09889f264674", "value": "1a1c96fd7b3cc88b3d4d7ddf1659f51cd9e2e4df71fc6e50e5b7705c7a09d3b0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac30fd31-4e2e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778609778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778609778, "uuid": "b1b06803-38fe-4e8c-a15e-be001d0bf086", "comment": "Malware payload (Mirai)", "value": "034b801ca4967457a15ce8e8766510c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778609778, "uuid": "d958638a-791a-471a-a3c6-08dd3a3d3ba5", "comment": "Malware payload (Mirai)", "value": "aca6f7f80afec749626b5d3f97256e49b31718ea6bcd8514b4d143ee917f17c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778609778, "uuid": "afeb1843-552a-40c9-a9b1-d0c857760b19", "comment": "Malware payload (Mirai)", "value": "15253d309a03d73269d0621ea762a000c7455257", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778609778, "uuid": "281138bb-f96a-463d-9edd-6764b0d6ec26", "comment": "Malware payload (Mirai)", "value": "8081551dbce3c3e799ceb96659fb7458dbbe839708d51bdbb88b64f3b07dbfad2a1dc69d25bc1822acc77daf6b0a7c90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778609778, "uuid": "708efe46-f930-4045-a9e4-6354d4e4ed8d", "value": "T16714A60E6E228F7DF7A8833447B78E25975833D623E1D645D1ACD2142E6078E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778609778, "uuid": "00aa2418-5971-4cdb-b860-e28dd8c8b7f5", "value": "3072:AUC4QQPwPf7ersp22cTfbK+uEu9UrMHR07LC8fK5DKaKfRy:JQQPwPzersp22crBn0RUCukDKaKfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778609778, "uuid": "8468dc92-9b4a-410c-b9b0-6e28a1483bce", "value": 202404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778609778, "uuid": "8993d353-c03c-44fa-aca7-8a6a9243bb29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778609778, "uuid": "01ee5da1-16b3-43fd-9d4e-bc69c3b5a061", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "473c29f4-4dfe-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1778588993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778588993, "uuid": "d0ead115-1a46-48dd-855d-103cfe35a515", "comment": "Malware payload (ValleyRAT)", "value": "6caeaf0e58bb53ca6493ec177090fe37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778588993, "uuid": "05ebf3bf-ede9-42bc-879d-a19882575aff", "comment": "Malware payload (ValleyRAT)", "value": "acc5e3bbfb6047f470cfd4827dacdf11965676d99a1b85e850863529d11e16a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778588993, "uuid": "32263392-1d8c-4eff-b2e5-5854f14b72f2", "comment": "Malware payload (ValleyRAT)", "value": "dbd7430e71efe61dcdf9e476b89620dae4c4d0aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778588993, "uuid": "696ff304-6a64-4bc7-8b25-c788a713dbb6", "comment": "Malware payload (ValleyRAT)", "value": "73e7a4a27103799be6b6323aa822432753db6cd1edfe45e84ce5efa59fd47f07e367156cf64ef7c69c5b7c1b62b9c989", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778588993, "uuid": "573f404d-38b4-4410-b1c5-3b446038189b", "value": "T13AA51A62E67990E9E3ABC038D3175F63FA30384D0224BB7787D4C6713B14E289A5D766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778588993, "uuid": "cdcc9bd7-26ab-4f1c-9056-d32330da7c4f", "value": "d6aa8d99ba1821514e30d10fefe534ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778588993, "uuid": "c8207135-36c9-4b46-8b10-21242d56f73b", "value": "49152:2/Vq/NpZAaQg0h/vBzCSlnS+FzviUZbEkwbH5JbdD4DyyhmdX9w18pX:z1dX9waX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778588993, "uuid": "5c472119-5c4b-44c3-9422-0890399c68ca", "value": 2216960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778588993, "uuid": "f3f09b15-dbb0-4b15-9cdf-f79c935145cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778588993, "uuid": "5254cbf3-716a-4e08-bd00-50c16dfefc31", "value": "2026 \u7b2c\u4e00\u5b63\u5ea6\u8fdd\u7eaa\u8fdd\u6cd5\u901a\u62a5\u4eba\u5458\u4fe1\u606fpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6920171-4dcf-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1778568967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778568967, "uuid": "45321fe7-03c2-405a-bdc1-5bcebf005ec4", "comment": "Malware payload (NetSupport)", "value": "b17b606f606db99c537400a4e74246c5", "object_relation": "md5", "Tag": [ { "name": "147-45-45-238", "colour": "#0A07CF", "exportable": true, "hide_tag": false }, { "name": "95-85-246-53", "colour": "#A58116", "exportable": true, "hide_tag": false }, { "name": "booking-static-assets-com", "colour": "#C3FF4E", "exportable": true, "hide_tag": false }, { "name": "img-pulse-cache-com", "colour": "#9E63C0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778568967, "uuid": "ca0640cd-89d8-44e7-aed9-814c2b7bd101", "comment": "Malware payload (NetSupport)", "value": "aeb00742bc7f53f1e1f3bf18ad8a0cb92a3c45df6ca19196afe18ec031fe4272", "object_relation": "sha256", "Tag": [ { "name": "147-45-45-238", "colour": "#0A07CF", "exportable": true, "hide_tag": false }, { "name": "95-85-246-53", "colour": "#A58116", "exportable": true, "hide_tag": false }, { "name": "booking-static-assets-com", "colour": "#C3FF4E", "exportable": true, "hide_tag": false }, { "name": "img-pulse-cache-com", "colour": "#9E63C0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778568967, "uuid": "10b31932-05d8-44fc-baac-cf62e0a7a999", "comment": "Malware payload (NetSupport)", "value": "ee216f93d06f860589d7289be6a251f242ef00b7", "object_relation": "sha1", "Tag": [ { "name": "147-45-45-238", "colour": "#0A07CF", "exportable": true, "hide_tag": false }, { "name": "95-85-246-53", "colour": "#A58116", "exportable": true, "hide_tag": false }, { "name": "booking-static-assets-com", "colour": "#C3FF4E", "exportable": true, "hide_tag": false }, { "name": "img-pulse-cache-com", "colour": "#9E63C0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778568967, "uuid": "df4324a1-69f7-4f50-aa38-7677429eff28", "comment": "Malware payload (NetSupport)", "value": "9fbca5dff8c546a3543c66427752df06256e94ee33ce2d44bcaf1a0a997854844b2cf22caf37653a7fbbde57fd2f40d2", "object_relation": "sha3-384", "Tag": [ { "name": "147-45-45-238", "colour": "#0A07CF", "exportable": true, "hide_tag": false }, { "name": "95-85-246-53", "colour": "#A58116", "exportable": true, "hide_tag": false }, { "name": "booking-static-assets-com", "colour": "#C3FF4E", "exportable": true, "hide_tag": false }, { "name": "img-pulse-cache-com", "colour": "#9E63C0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778568967, "uuid": "617b7f23-70c9-480c-88e4-19a2e3ca9f80", "value": "T116B5330EA3144BC7D895987AFC321BBD44789E7D635BA3BCA30C726D19F128192F5E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778568967, "uuid": "127640f9-dd60-4234-a546-5fc6a4c8ff0b", "value": "49152:O0AhFM7RyciLvMhWumZPH1BgCiNPnS/0IB2JFoBqrHoc3L0:EhFuRkb4WuIH12C4O0ekwqrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778568967, "uuid": "3a8ada9f-67a0-4c4e-a0d2-b0c1403d2943", "value": 2330624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778568967, "uuid": "113b3095-c611-4af0-837d-6b400862d8fb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778568967, "uuid": "19b407e5-627e-4880-8f3e-e29d534323a5", "value": "installer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc73cc23-4e44-11f1-a769-42010a9c0008", "comment": "Malware payload (Loda)", "timestamp": 1778619308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778619308, "uuid": "52094c82-ff3f-407b-ac7a-08b4d0093028", "comment": "Malware payload (Loda)", "value": "53c542dba9e03c249db8c94197ec0b9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778619308, "uuid": "327a73a2-184c-43be-b2ea-1b8be614c5f6", "comment": "Malware payload (Loda)", "value": "aef5d87417b0bc08dce6e43a6ffc6f215dd726f5495e1e010198b048c5383114", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778619308, "uuid": "d9253b3a-ec83-46d2-a721-03097d915251", "comment": "Malware payload (Loda)", "value": "e0ab3db6243ee0aed9a59554293ded29e30d2a6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778619308, "uuid": "92c7a5d5-c96a-44ed-9fd7-dbed25b3c905", "comment": "Malware payload (Loda)", "value": "c9fb012def2173d078fac82aa49ee20ea7e890edc3337f823298472756e3100b1b263588b2e0bb0acc9f3d84558f18d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778619308, "uuid": "693ad96d-7305-414d-bce1-ebf2d209e427", "value": "T12D763342B39818EAF467A13DC0435508D7B27D525BB0D76B27E0662D2F1B7A03E3E768", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778619308, "uuid": "1eec3d2b-c2f9-475c-8a12-531819e3ee5e", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778619308, "uuid": "97953e6f-e051-4c53-9778-654265ec9a1b", "value": "196608:yv8ZkCPlPdQmRJ8Qnf2ODjMnGydS0QpPQd:aqkCNPdQeF3MnG30QpPQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778619308, "uuid": "cb62dbae-9893-44a7-9848-32fdfa59bd9a", "value": 7431312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778619308, "uuid": "416ea54c-dc39-4a87-8465-8d5e9b4f5619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778619308, "uuid": "4859d4c9-c46b-4036-9c72-dd59f0c07d26", "value": "xaef5d87417b0bc08dce6e43a6ffc6f215dd726f5495e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a7bacb-4e37-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778613365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613365, "uuid": "d0430224-c659-4704-bc6e-9498a6ec9cb5", "comment": "Malware payload (Mirai)", "value": "60d00a2ffc4d0105999d309c8907dea5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613365, "uuid": "268e4442-d8a0-4b39-bb7a-429749216ba0", "comment": "Malware payload (Mirai)", "value": "af5e615151678527fee4a1df9f400f7ce645c4a7639a1f75d3784e9b13ac222c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613365, "uuid": "5ee82a83-d012-48a4-a612-23e538fecc4e", "comment": "Malware payload (Mirai)", "value": "618660bd9a3607e5f03e34a434539a06e6b50f6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613365, "uuid": "87d2f270-c20a-4992-acac-45afd0e64180", "comment": "Malware payload (Mirai)", "value": "b713dc7db19ec17513b579af48aef61964491499f890d395e51443417de50fa20fec928ec9d2a39a5bdf2888c183b333", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613365, "uuid": "2ed122b1-a8c2-4c1c-a62c-41304f097935", "value": "T184B30966F910EB3FC40E93306DB3C75056D52CB12E925A7D32A4EBAC6E3416B1E4B5E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613365, "uuid": "1c074577-6e5f-4d2e-bb40-f780c9d1f03d", "value": "3072:8qScukPCJ2XZ/OGpD8KBvicoopw2tcFPmH5hZ:8muhJ2p/tTBicouB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778613365, "uuid": "b5ea8c54-6e93-442b-a439-c96e088a07bd", "value": 113372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778613365, "uuid": "747116b9-64fb-47fb-b5c7-4b78ee2190ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613365, "uuid": "2651b3ac-c998-4129-a135-e4b571288af5", "value": "bot.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf271bee-4e11-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1778597382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778597382, "uuid": "c5f1b7e3-00b9-4b8b-8b46-de0a07662216", "comment": "Malware payload (Prometei)", "value": "795741814ee528d2e1be0453351010b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778597382, "uuid": "be8bd491-40be-4f68-9ec5-396cefb2cfc4", "comment": "Malware payload (Prometei)", "value": "b0637e542f7957c60c27a82f62bb79ab199729cafb964b17f8c6fda1617a4926", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778597382, "uuid": "ac51e3af-5e65-48da-8e7a-004cb1855f4f", "comment": "Malware payload (Prometei)", "value": "5fb6b79adeae7db1249b720ea28251daa3a7646e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778597382, "uuid": "331742b6-49e0-4cb3-9319-3259b79b9342", "comment": "Malware payload (Prometei)", "value": "d7daf34b1c9822994fffe85cb00e78cc9c770dd9faab37cd37dbd84e94ac8b1594b8099af4cb0d5fab3de51517335041", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778597382, "uuid": "2d4b05cb-a8db-46f2-abbf-6f8f919b4467", "value": "T14474C07775B8F15EC88517328F62C7C293993F908D93805F7EB4530F29268A91A35B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778597382, "uuid": "9bfa976f-8ab7-4bd7-be78-1fd2d1a0b65b", "value": "551920a564f0da077e7c568c1940defb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778597382, "uuid": "1e950738-a1b2-4092-b65d-8ec88f82b098", "value": "6144:fRzeTJQJfChxxTnECpq9XkCnNNCoo/iSq9opz5Pv5Pi12dwyi:fJZJfChLjE4q9X7HGqZ9opzvi1yi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778597382, "uuid": "e780b90c-0668-4a88-a0e9-ed2e3ecad49d", "value": 343026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778597382, "uuid": "bd6897e5-9dfd-4125-a3c1-2ced30b178be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778597382, "uuid": "efffef61-d7a8-4328-978f-0eb9a6c92da7", "value": "b0637e542f7957c60c27a82f62bb79ab199729cafb964b17f8c6fda1617a4926", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720eac9d-4e51-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1778624713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778624713, "uuid": "418ad29c-188d-4836-bca3-80250f6a08e5", "comment": "Malware payload (ValleyRAT)", "value": "0c2f1bf11e317001cbcabcbfb02e1b66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778624713, "uuid": "90042d68-81d2-4ac3-8d63-b8cd96468f1e", "comment": "Malware payload (ValleyRAT)", "value": "b19633c79f345c08f5cfb2d04cad60391608dbc23e4b29adf312ee3eb6e9bd0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778624713, "uuid": "1248eb04-49ca-4d56-98f5-8a342ee89cd0", "comment": "Malware payload (ValleyRAT)", "value": "b6bd4ee36b7c5ff11dbcd50963d9cf6560268fb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778624713, "uuid": "697ed729-65ca-4b43-9cdb-04131a96eb0c", "comment": "Malware payload (ValleyRAT)", "value": "36a680721f00ff43cb3681fd56b973219160112ca32b89967e31e452815e5478b5d4c54fbdc1f04a7501e07e5d95f697", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778624713, "uuid": "c464a339-3419-4a0a-9ee5-f6cdb0da5ad7", "value": "T177548D45F25C88E6D0E3E97488D72722E2F2F4110F6A7B4B039612315F6F2A49D2B79D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778624713, "uuid": "cfe50fdc-778d-4eb1-9746-d47c08799658", "value": "08e7a7a545245c46c9640166cab94d3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778624713, "uuid": "a965f473-a934-46f7-b41a-09ce7d765902", "value": "6144:8JCRhSCDRTNIo9A4GUBnB5NRCkt5mGrxGkP1j:ECnXlTKobnyAp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778624713, "uuid": "220f0ef0-cdee-40c7-8a2d-f97490917cfe", "value": 305055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778624713, "uuid": "47bfec07-8ecc-4a05-8ae1-a54253b76739", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778624713, "uuid": "19654586-bf73-4bd3-b61d-565b3ddf4dba", "value": "0c2f1bf11e317001cbcabcbfb02e1b66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e08bbdb-4e16-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778599232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599232, "uuid": "928f75a8-82ec-4b01-913a-d40d3a83c1f9", "comment": "Malware payload", "value": "f46298a6e3b9afbbd62dcc42c070aa7a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599232, "uuid": "6d8f681d-4718-4910-b062-82c3be34716f", "comment": "Malware payload", "value": "b1fdc56d8d5c4d1f3081370c32f7f1da971a6376c5d317bd9d858568d1056c6e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599232, "uuid": "b529fa6a-a1cf-4098-ac79-fced5d2b6dfa", "comment": "Malware payload", "value": "dd4537b9157e7cd67d0c9384ed5166fd5b8db789", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599232, "uuid": "29a86c24-4cba-4707-95a5-53b86b0239ca", "comment": "Malware payload", "value": "b0b399316a011f78c950071858ae6dfcc0d5640fa7eaab11b3aab6759de7f4db1a056958dc924dc74ef332d6d317e399", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599232, "uuid": "b9040323-8cd7-4a02-b5d2-2702354a59b3", "value": "T16F927D0FB9518315D5C00474A5B2873FD6BA5476338454EFFBD88ACA1B682EAF83215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599232, "uuid": "af68e180-96c4-4e9c-b9ea-09ddeb4a9d1e", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599232, "uuid": "ddae07b0-14c8-4d2b-82c1-116a276d4378", "value": "384:BIkjLVlvadxqSDO5wtT0vu98t2r6H/Bgav8U9caG:tqx3600G9oga0UnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599232, "uuid": "22f694dc-0422-4467-9640-606e83e1b3fe", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599232, "uuid": "9d518f6f-199f-4d3e-8c8e-6eaed775243e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599232, "uuid": "2935feef-1206-4556-9849-d5422bc8f7c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abee36fb-4e0b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778594746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778594746, "uuid": "151424e2-58b8-443b-bc11-00768c508c01", "comment": "Malware payload (Mirai)", "value": "1f2b54bef18792b43eeddc9b6222aa91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778594746, "uuid": "e2e08bf2-bc69-4fd6-8b04-2c37c4e671e5", "comment": "Malware payload (Mirai)", "value": "b339b9e0254115ad4128c31ed18461c083d4a9d13c219c1c2a19e8b3c756f01d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778594746, "uuid": "d1fe77aa-d38f-4e86-a5f2-7a852d101b7b", "comment": "Malware payload (Mirai)", "value": "c336074c96a2fdb44ed0cc94d2187a40a61d8daa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778594746, "uuid": "d052a808-8c14-40fc-85a0-63f6ed84578c", "comment": "Malware payload (Mirai)", "value": "31688ef619125beb01633f40e3bd9ec8da6b9098a0ec954bbb96f735b4b7d0c4f6b8898892ac289d113c2b4327221aa0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778594746, "uuid": "916bd7ab-c295-4efa-aab9-d1a3b9dede32", "value": "T150C35BC5E793D4B2D8430B7001ABE7395631EC621329CE2BD76CFFB65F22682B546618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778594746, "uuid": "bc2b3dfc-a59f-44fc-92a9-3217e508807a", "value": "1536:W1MXVwBrNbNOQLbDLkYpgbsxZ5S8g7Rkl9bdzUJ31Q6tNB5cz8r1l9FGnBaUUkWG:nXa1Nb1fHzxZw0Wu84zU39KUkWfSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778594746, "uuid": "caf9bbe1-b11b-4bf5-abf8-88938463cfad", "value": 119444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778594746, "uuid": "bf8e5f4b-44e4-4b63-b65d-007cc6aa2780", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778594746, "uuid": "34c830e3-55a5-4715-9686-30c45c44e25e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5591dfb-4dd5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778571569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778571569, "uuid": "b3dbb6cb-54de-4b81-b931-d3a26267e978", "comment": "Malware payload", "value": "b153f5b11a6821a9cfe5efdb8e132a8b", "object_relation": "md5", "Tag": [ { "name": "212-34-142-145", "colour": "#B8CB35", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "jarfsync-icu", "colour": "#C9ADF3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778571569, "uuid": "65096d5f-e30a-41ed-aa70-64c8160e8247", "comment": "Malware payload", "value": "b3f3f76f4607dea2c7998a939d10ed50ad779057503fda3f232dec0101b709f8", "object_relation": "sha256", "Tag": [ { "name": "212-34-142-145", "colour": "#B8CB35", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "jarfsync-icu", "colour": "#C9ADF3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778571569, "uuid": "c46feced-63a2-4f47-a2ac-99af1fd3f47b", "comment": "Malware payload", "value": "8f948c1badb12fdcd1d822dfe41138984c9b2735", "object_relation": "sha1", "Tag": [ { "name": "212-34-142-145", "colour": "#B8CB35", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "jarfsync-icu", "colour": "#C9ADF3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778571569, "uuid": "a77f758c-dd64-4934-962d-f0d102923998", "comment": "Malware payload", "value": "6d34c9dc75168607a4bd96dc2eed2b200cd8e189c29b3e62d18330de6c965a3844a299ce5c9e07e8bf58f3042b9516f2", "object_relation": "sha3-384", "Tag": [ { "name": "212-34-142-145", "colour": "#B8CB35", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "jarfsync-icu", "colour": "#C9ADF3", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778571569, "uuid": "27f636c1-eb66-420c-a527-acc6683a66b5", "value": "T1B212AF25D634DDC6F4C8FA7EA53F56595F7200F3A34BA3670C80A417EE1A0E56718670", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778571569, "uuid": "05fef31f-bd62-4e3c-9446-73fc7982cf35", "value": "192:6rEkGAsG8Uno8Tv6EjdcKESKSnHmsS+hetlsBdLkiO36TZyU5N:+mA5rv+DI+teduKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778571569, "uuid": "f680c189-cd21-41f6-8c31-1f838b19b29a", "value": 9075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778571569, "uuid": "4000bf2b-6de7-4f06-b211-42f06edd7393", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778571569, "uuid": "c9e25749-7db2-451c-8d25-e3f0674ae574", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117a742b-4e43-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778618538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618538, "uuid": "92fedbb9-f8e3-4b8b-8991-f75b7e313eb3", "comment": "Malware payload", "value": "4dd9f65844f8f525df307a9ece24a3e8", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618538, "uuid": "8786ae6f-5f2f-408d-950f-450c73c55155", "comment": "Malware payload", "value": "b447ab97766d95e32c0ceb820c94d0869b431f7278c0f6d2672c58d6722fd962", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618538, "uuid": "de2d9831-d700-47d8-9686-b807a031a7b6", "comment": "Malware payload", "value": "84bff586ea2374f1b01f6f4869dc36f1e9dd28c7", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618538, "uuid": "f2138129-89c1-4445-9394-989eb1dc818c", "comment": "Malware payload", "value": "2e8321eaf7bba2d19595edba13cf921836dfeab7c80645b178120cbca029dc02fa257bb010b1b861450759f768945bd7", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618538, "uuid": "c12853a3-dfc8-4d24-a0e6-c05a43e8fb05", "value": "T1C1169D27E3C812D9D42AC679CB459222EAB2BC124B31A1CF0695375A1F77EE15B3F701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618538, "uuid": "d724181b-68cf-4d9a-846e-61e0af01b54f", "value": "98304:Vp2WiSvhJpDhq47aS0HN6yR/sNvsa2kApVlP:Y0JpFq47aS4Nx9sJj2kEPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778618538, "uuid": "b8a0f24a-53c2-4b7c-9cb4-9f2fd654e52a", "value": 4145152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778618538, "uuid": "f0cb41ca-15bd-4ec2-8cc7-71b5f876fef9", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618538, "uuid": "72be31e1-2b36-470f-8e3a-a861a0e28631", "value": "471-00942 - Nameplate & Drawing.dwg.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0955325-4dfa-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1778587506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778587506, "uuid": "8ea46db6-e617-4269-bdfb-168acb70326f", "comment": "Malware payload (DCRat)", "value": "abef7b4e5993d62b8ccffd3a7a951be3", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778587506, "uuid": "ec892c72-c372-468e-a4eb-b1d571a55dfe", "comment": "Malware payload (DCRat)", "value": "b5507c0876b636624bb193212240bc4beb5e4570cfe2790394280cc1b840d478", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778587506, "uuid": "a21dab3c-d05e-42e3-bc77-c504d9db5244", "comment": "Malware payload (DCRat)", "value": "21805cda8b5959849a099dc8d4add54384b29735", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778587506, "uuid": "a19fccb8-fd69-4fe3-ab37-c9f4265ef11f", "comment": "Malware payload (DCRat)", "value": "818b6ad9a2ee96628d404e8a55ff14a085cc081f2e7aad55e4361d3b1f0bf42a6692855b78bdd2be50e1cea19968b211", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778587506, "uuid": "70a7fc33-a7a1-4021-a2ed-e60ec1c927ec", "value": "T191454B017E84CE22F0191633C2EF850447F4AC91AAA6E72B7EB9376E55113937D1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778587506, "uuid": "4d445cf8-0e25-4732-b7a8-e7ec2edd53d0", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778587506, "uuid": "d1dd8797-7738-484a-865b-128a120f1f62", "value": "24576:U2G/nvxW3Ww0tIe8SeGxY344J2Q2pkgw6ns4BYOLntp:UbA30Ie8Si3lbP74BFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778587506, "uuid": "960ecd1e-7bb5-4b03-a760-6810386d8e63", "value": 1229078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778587506, "uuid": "9ab3c6c7-4ca5-4616-adc8-88828314bdb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778587506, "uuid": "3f01a4e2-f9df-48fe-8ef2-3742807cd2ad", "value": "fatality.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7c4188-4de1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778576711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778576711, "uuid": "daef154c-030a-42ed-882b-a1420d1f004e", "comment": "Malware payload", "value": "5ecb8ceb79db28f731d17a23cd25dc13", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778576711, "uuid": "be2e7c8d-03e5-4363-a46c-1835e9272800", "comment": "Malware payload", "value": "b58aa6d33ab6bbf3eabe8309e35b79769d3395681aafcec55418fa97fccdb5c9", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778576711, "uuid": "b1644b29-5790-450b-8e76-46ff0e96d7ef", "comment": "Malware payload", "value": "a004dc92ca572520a57a5f01aaf71c12d25e8bdb", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778576711, "uuid": "dd5826e3-73d2-42da-a3cb-9eb7b8f4000e", "comment": "Malware payload", "value": "650b8e6979ff8ca029839ff75e4158c1343ce5de9829e8461fa3aaaba15b13002114db93c04aaafb67ad03472ee7e885", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778576711, "uuid": "87d03574-04c9-4052-b6db-29d19b404f0d", "value": "T19D171207B3A481E9D46AC138C2979323FB76BC8A1721B6DF17D05A652F27BE01B2D315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778576711, "uuid": "0ed3cc8f-cfc4-47a9-9696-1480b83c6749", "value": "393216:SgxnPBp9qNMyqvY/WdrAQS5RwtfDMUKKVb7Ay:SgxBpyqvOWI52UQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778576711, "uuid": "d8db285a-6585-4da0-9593-135e0fadac75", "value": 20250624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778576711, "uuid": "0c62ed7a-938a-4bd3-82ff-4f4e7a631974", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778576711, "uuid": "93c547f6-38fa-41d3-820f-336e8e8d3ca1", "value": "Personnel-info.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c5b550a-4e34-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778612302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778612302, "uuid": "bc021e67-5baa-439b-86b5-c73d3cde56f2", "comment": "Malware payload", "value": "0c6dea4af329917e4228f6446861eae5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778612302, "uuid": "92ccc4d6-ab02-402c-84a6-28df61c3e292", "comment": "Malware payload", "value": "b6de13bd810c1cbce2107587a49e8e1277e8e40dac46fd6d9adb2978a209e5a0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778612302, "uuid": "6e5cd387-71d8-46d5-b2e7-67bd48351704", "comment": "Malware payload", "value": "e083198acc78988e0a2b1be2efaef53d6c3c7390", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778612302, "uuid": "fbf47477-5c41-4dc4-a70d-2cd77a92a226", "comment": "Malware payload", "value": "850e01a222139ea7653fe2ea8066ab4464d69e92e114cbca0b6ed4530b19213a9d9f6bece5ed27882a1e0a00c307a15d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778612302, "uuid": "4791d8f8-7a56-4184-ba79-c8372a5ffd18", "value": "T144137D6566913C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778612302, "uuid": "b3f4361c-305d-4786-b27f-1c5c6ad82edc", "value": "768:bcXRWNGxV19GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bQlxMco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778612302, "uuid": "2e269d01-9b2b-4205-bb9d-65a1c2408a69", "value": 45526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778612302, "uuid": "6c510f0c-cf9b-4e74-a8bf-c7b32b906dad", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778612302, "uuid": "3009d170-339e-4d70-852f-3edf024f7af1", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a07c19-4e1e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778602864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778602864, "uuid": "bdbcaa08-77b0-4b19-8153-04b0ee4cf7b3", "comment": "Malware payload", "value": "ebc61ae7c91eabf8c984256a5c6636cd", "object_relation": "md5", "Tag": [ { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778602864, "uuid": "deb51697-c764-425b-90e4-8cc614ffc49e", "comment": "Malware payload", "value": "b758dd6c1fbe1275192786a30255f33a7f9a3c3752c0a1c7827ea5e24d8578fc", "object_relation": "sha256", "Tag": [ { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778602864, "uuid": "2651d3a9-1568-4bf7-82ba-af4732b727cb", "comment": "Malware payload", "value": "aaa9e3e3b74b3da06f94ed33be10822f141621fc", "object_relation": "sha1", "Tag": [ { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778602864, "uuid": "3e268e75-894e-4c1e-9598-90388e238137", "comment": "Malware payload", "value": "bb6e8ca11b43128c72c102722b83ec39076d5c17e79ef0d009e16b6ce443d7ac844bd2138a65eb2e1801d78ff6c7ff45", "object_relation": "sha3-384", "Tag": [ { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778602864, "uuid": "91cada64-ac47-4912-98b5-82154294aaff", "value": "T16682E82A7AF54C77018636A8E1CDD30AA319C12B50182E50B8DCD7C6EF6153B97F9BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778602864, "uuid": "9fb70b7f-f07e-4031-8420-39b687cfdf0b", "value": "384:ZmrmAdZ7RLhsiyklVED2dqnEeYWoLg5VURWzTlGEH4w:E9RLhsiyklGK8ECoLgTYWzTlGEYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778602864, "uuid": "c9d2c3bf-cf37-4b6b-88fa-0f933c528550", "value": 18687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778602864, "uuid": "72bf7b95-81fd-4ec6-8c6e-ba001d06c9d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778602864, "uuid": "7f0abb59-325d-42ad-ae6a-ec205a1cdeaf", "value": "b758dd6c1fbe1275192786a30255f33a7f9a3c3752c0a1c7827ea5e24d8578fc.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420983a6-4e3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778616472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778616472, "uuid": "5f2560ef-3d42-41b4-97ee-182964141958", "comment": "Malware payload (Mirai)", "value": "3bb207fd96748b84e8ec52560be5f7f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778616472, "uuid": "aa0bacd9-3e91-41dd-a5b4-cf52695efafe", "comment": "Malware payload (Mirai)", "value": "b77db801fcbd630712b6928e311c22eab6632bda4b1fd94f69d35e29540b96b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778616472, "uuid": "4ed3af3f-eca4-4a40-bcb1-2053086c844b", "comment": "Malware payload (Mirai)", "value": "9f303fb08f26be4e26a0598d9710e38e465f3ce2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778616472, "uuid": "45075b76-a56a-4d42-97f9-1adc028813cd", "comment": "Malware payload (Mirai)", "value": "4d03eb7160cd3985185ae7728d580d3bc9c96e974b1cb3bab33a87e2b5f1a3000327066cd2e3c5d52a0c8b7f106d87e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778616472, "uuid": "008920f7-a68d-45a5-a6af-8cf2e3233143", "value": "T16044F8066F910FF7C8AFDF3702EB0A11248DE41727A62B367638E978B60A54E55D3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778616472, "uuid": "c2c51bcb-accc-4421-9698-8b2e3ec930c1", "value": "6144:i2Rkz0tl1LV9kpBw3AOgA3a6yB1hWF5NqohWUkzn7MwA0:im60tjVip+/yB1hWF5NqohWUkzn7MwA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778616472, "uuid": "96446b4d-7df1-4dc0-9842-1c77deef942b", "value": 261444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778616472, "uuid": "1e379fdd-e4ea-407f-bb61-ffda8cfd3725", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778616472, "uuid": "2f1bc577-64f3-4b6b-8c0f-e938a490c1a0", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2faca52-4e36-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1778613226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613226, "uuid": "4d7be9c7-2f28-452d-b564-34d193074090", "comment": "Malware payload (Gafgyt)", "value": "83c3e909d0d8098dd635fe9dd186f286", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613226, "uuid": "02e6e478-af08-4aab-a421-5f7ae831d466", "comment": "Malware payload (Gafgyt)", "value": "b89a43ed345c5ccdddb2b8cab501b565d55b70bc56b5f3db045a6a259bf10654", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613226, "uuid": "e0c5e557-c772-4595-8591-f1ce8868785e", "comment": "Malware payload (Gafgyt)", "value": "baecd6826c4b1963e547d32c4aba5dcb8e3cc9f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613226, "uuid": "d5a105ef-30b8-4501-b121-2aac4d8ed44f", "comment": "Malware payload (Gafgyt)", "value": "3c6476ffd66444ce5a7319a03bbd3a4702af2aa95fa34b34ad2239c689d52bbd6f25bcc7683336e54b738c37cc801fea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613226, "uuid": "660e2b47-eb29-4fbf-9392-1fe62b51b1be", "value": "T127B319037B0E0F83D1573DF02A7F2BF1979ABEE215A4A184651EBDC062718B32595ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613226, "uuid": "9ecfdcac-2513-44a8-848f-4767fc19871e", "value": "3072:itISYiaM5Gj8iOnrEZfODakSFG2wlu5h7pLg:iCSYmBrEZOdYG2B5h9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778613226, "uuid": "87eb0a8c-6fc9-422b-9343-289aa10d2827", "value": 107848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778613226, "uuid": "43191400-c85a-4706-9896-cdd16df64917", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613226, "uuid": "90069bc7-9e2b-4f49-a4ca-849899bf1f99", "value": "FBI.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ff141f-4de4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778577740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577740, "uuid": "0f451237-ed23-4b9a-931d-0ffe7e4eb17e", "comment": "Malware payload", "value": "f89a8a42360b60dade7353ad7311151d", "object_relation": "md5", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577740, "uuid": "08dd71d0-4baa-48e6-a1b6-544c7c2edcec", "comment": "Malware payload", "value": "b931528fc859e028b3d4290064ce1fbb4177f323e0f2f127ea00aaa64f8b6c8a", "object_relation": "sha256", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577740, "uuid": "12e11538-0046-4d0a-87ee-184a631e583c", "comment": "Malware payload", "value": "6a588108c0a0983698976fbd91bb8a838c2b2f7d", "object_relation": "sha1", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577740, "uuid": "154db13c-9a19-433b-aa39-b7c601292601", "comment": "Malware payload", "value": "933430ae3bbe22899f6c4f5b95d42d73af9b7a9835d6796b1cc95cdfc920c3163ee7c017dad01e74593d33ec2a65cf08", "object_relation": "sha3-384", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577740, "uuid": "63f1189f-863c-4f1d-8f32-892a5e2e6e5f", "value": "T12527230E81154E11E6CB6FFD62990237953CF0346D1E55BAEF70DFA018A36A256E3EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577740, "uuid": "3ad72254-528b-427c-ad04-6c9f2e70fcda", "value": "393216:iI575UKV5EgPnQt7o6u+vV9r1UFbNXvUbG0dWPCiKJ4seCo14+:iy75rV5XPnQt7o6XV95ib9vUbzdi/hs2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778577740, "uuid": "16ece65f-c9c7-421e-8f88-109de4f94235", "value": 20629834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778577740, "uuid": "922f3dbd-ff99-4054-b859-81309194d4fa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577740, "uuid": "63f16290-a80e-46ad-ba50-197bc8c3289e", "value": "DCM-T1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06bbc79c-4dd3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778570417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778570417, "uuid": "89141a3d-1a83-4314-9919-61b457402571", "comment": "Malware payload", "value": "4b3f84f9c65ae828fc6c053520a11072", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778570417, "uuid": "d968b9d1-08ed-41c8-b7e5-2b035e02b275", "comment": "Malware payload", "value": "bb0ea887058fc79c9e32ab1c863af8acc70ad0ba333acfd37d772ae29d9ef9c0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778570417, "uuid": "3770ba06-b2bd-43f6-b4b3-c22dfdc13b77", "comment": "Malware payload", "value": "75726b0c251c201d12bd0e90a688e747a2c1dbc8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778570417, "uuid": "5ffb0309-4a48-4036-97d9-73a289bdb67f", "comment": "Malware payload", "value": "dfc814d025098ab296de1a89a693b688901a7615c0f9305c38c6dba759f62b40091942bae4bebbfc176540e69ccc7baf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778570417, "uuid": "01ca0f88-553e-41a4-ae5f-ed540ddd9cec", "value": "T12F137D6526953C25AE99883B5C7E2F0CBDA983E1304491DDBF8A3CF18C15A9CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778570417, "uuid": "e993504d-1658-47f0-a59a-89cdb49ebb33", "value": "768:bRs9NyXsZztCi9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnB:bWHusZGc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778570417, "uuid": "a29fbccf-6c6f-481a-b827-46c37948d844", "value": 45528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778570417, "uuid": "1e29fc1e-f072-4eb1-b333-6bb122ee869b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778570417, "uuid": "18ade2fb-4b6c-4462-a887-b50480755fac", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508f3811-4e39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778614349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614349, "uuid": "fed4fc34-c579-4638-a5cb-07205bd14ffd", "comment": "Malware payload", "value": "ef1778d0f4651e4e67dc6ac5f685481f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614349, "uuid": "bb287a54-9820-45b7-847e-d76873e55587", "comment": "Malware payload", "value": "bce51ac5fe85ed0dcc91b0b4980c6bbb424816762b0a232c7a53c23038e51b8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614349, "uuid": "5463934e-0102-4ffa-8cec-dc3f5dfcd57f", "comment": "Malware payload", "value": "a4f6fb788af16c6c3509eb29ab207553b1fcdbae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614349, "uuid": "747874ea-2a03-404d-b3d5-46dad7973162", "comment": "Malware payload", "value": "86251a2cb682e24d91655f5df1970a03d41b739546a3d7919b26c76f14f34dadb9a8f616ad3428fa8535f604dccb31d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614349, "uuid": "65744c24-2c98-4437-a164-35eabc1b8a53", "value": "T18E530194D23888BCD1E024334B3DA526066F49E0D4EE79DD364AAF6D94C16CEF672069", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614349, "uuid": "72ac55e4-9182-44da-b465-ac4446d6d15c", "value": "1536:dDzMrANKhKq4anAn/62xhPzP1TBiE81R9iiLO:+rl2/6Wxz9g1ziIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778614349, "uuid": "d8d2c10a-84b9-49c6-b354-636f1b2a54f4", "value": 61368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778614349, "uuid": "63417eb8-6dd1-4485-8f3f-6266f50c6474", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614349, "uuid": "72558391-1ebf-4559-8f3f-50973b08c165", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f5e0f2-4de4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778577772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577772, "uuid": "b68c547f-0f8e-4d00-ad4d-144e05b99f94", "comment": "Malware payload", "value": "e9c95a10e99a29480fef3c0b020eeb4a", "object_relation": "md5", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577772, "uuid": "564e19d4-e1fa-449d-8a48-d89ff7081539", "comment": "Malware payload", "value": "bd12ed0b473e0f61b6b1445a97fc7b7ee028e555020c95537de7b9cc056b7187", "object_relation": "sha256", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577772, "uuid": "807d9312-2d87-467e-ac98-fc1356947d5e", "comment": "Malware payload", "value": "1300d96065236ce617d172c82410245c081d75d2", "object_relation": "sha1", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577772, "uuid": "b5659df5-04b1-4095-af39-034f8c9a8da8", "comment": "Malware payload", "value": "201bc186b76986ac5a9832b3c76c54211f8416649c48045e6751b8e60cdae7ab3425bd0b4ee5e1a2bad9823f9cd8ecc8", "object_relation": "sha3-384", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577772, "uuid": "e697fcac-4f6d-4743-98c0-a63167d104bf", "value": "T1D4879EEC42957A627258A4DBE9360890CEFD2B6BB20CBC3D61C6A4573C71E7F60C4593", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577772, "uuid": "54feafea-af75-4080-b57e-b43df5392fab", "value": "1536:QQab+zBYX1kbeabe3bI6zD1sUYdBYaMsrTj146/DyD5F9tSwB/xKYWQ0:QQPOX1Ss3bIIImsrTjO9PUCQYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778577772, "uuid": "7d62baed-6fa9-49ab-9b99-b7a0fb76ff78", "value": 37865191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778577772, "uuid": "48887fe8-491b-403f-ae6a-d9a9d6baa221", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577772, "uuid": "cba8fd8a-4af3-4481-be21-7659441439a9", "value": "prt (4).py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d5a007-4de5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778578364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578364, "uuid": "ab6c404f-011f-4e1d-a054-5b6cc9888132", "comment": "Malware payload", "value": "30c29af108b0b6a9706b7db0e339e529", "object_relation": "md5", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578364, "uuid": "37eabd4d-1370-43e4-a5ba-6e81c6beaef8", "comment": "Malware payload", "value": "c1b59cc25bdc1fe3f3ce8eda06d002dda7cb02dea8c29877b68d04cd089363c7", "object_relation": "sha256", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578364, "uuid": "84bcb714-303a-4c65-aed7-5dc84bb8007d", "comment": "Malware payload", "value": "d50e9bb79b2087149476fed36ba93a3c240549c7", "object_relation": "sha1", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578364, "uuid": "2f9469da-862d-423e-8541-3baa33705158", "comment": "Malware payload", "value": "584051bbcd12b8865effe6a28267203f36647d9e6a45dbf7eb71f2d2f3799d9504d4ab9a9898b63bde19fe034935c2a7", "object_relation": "sha3-384", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578364, "uuid": "99111c6a-64f5-4168-acf1-fcc8fc4a463f", "value": "T170F73370DAAF4C57D9B9203B0F1269E38C1AA97F4D1D1A4A653347763CF48A7CD2881B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578364, "uuid": "32f72a0f-7f3b-487a-b131-9808fe1e9f8a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578364, "uuid": "37fa3dcf-90d6-4c28-b724-023ce5c44579", "value": "1572864:Xx0rPpI1CnBmoBE+UThHLzWSLd++N93G3yLiUIGa37:UFzBEfTAMA3yLiUIv37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778578364, "uuid": "d774dd5e-edbc-4e36-b4ab-75272793d2eb", "value": 73655972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778578364, "uuid": "19697378-557a-44f0-9e54-bafe0627be1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578364, "uuid": "37e4e530-43fe-4b70-b6d1-7e347b7c75d4", "value": "c1b59cc25bdc1fe3f3ce8eda06d002dda7cb02dea8c29877b68d04cd089363c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984b088d-4e2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778609316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778609316, "uuid": "4c86750d-47c3-43f0-aa58-7f62aacc8b73", "comment": "Malware payload (Mirai)", "value": "f45520d584726bad387e85c7ae18cba9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778609316, "uuid": "ecf70e02-668c-4802-9914-6d6e881b632d", "comment": "Malware payload (Mirai)", "value": "c2a7db9aeb063c7627883ce7baa87642deb3ab8fe97dba80f340e295fb00e506", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778609316, "uuid": "0086424a-40d8-4981-83b6-1b175574987d", "comment": "Malware payload (Mirai)", "value": "5bd7a5a59453ef7de256759d7e94246e72bc126f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778609316, "uuid": "24a0f8d7-9a14-44d3-a027-6cc46f00c362", "comment": "Malware payload (Mirai)", "value": "783e1e7e0f0788f750837d91930071639fe3b54c715e23468d1bdf3a5e0c2bd6506c5ba1e39df2ce59008b547846010e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778609316, "uuid": "4cb413d3-484d-4aa2-8089-1f2a29abc775", "value": "T1B1E32A02731C0A47D2632EB42A3F67E183EFDAD121E4F644255FAB8A92B1D331585ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778609316, "uuid": "e1369633-2361-4061-94fa-52479849f3d0", "value": "1536:sRNQUJyp/5ctNypPaQSxfVWWxKL9dcCpFzeBKsuvADMBstKGMx/aKqr9xhMs:sh4faQSxJxQlFKBjnDVms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778609316, "uuid": "30be4308-670b-4fa4-9dd8-ea17675ae058", "value": 154516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778609316, "uuid": "58a7c3c4-0fd2-4a2b-abbe-7c554488d597", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778609316, "uuid": "5b56b5bc-4408-4209-903a-a2057ff753ed", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5130b81-4e03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778591406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778591406, "uuid": "9b04fa5c-498c-49c0-a771-d9a86d77771e", "comment": "Malware payload", "value": "86ce1b45b62341d08309a96788c155f4", "object_relation": "md5", "Tag": [ { "name": "cadepeter-com", "colour": "#C3D01B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778591406, "uuid": "d2f4c1f2-4260-4f25-a67d-5356ce20ba94", "comment": "Malware payload", "value": "c48c62f812f6df3773143b99f198d681232f7054658b164ea6ec079dd3355c61", "object_relation": "sha256", "Tag": [ { "name": "cadepeter-com", "colour": "#C3D01B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778591406, "uuid": "518c6951-1fd7-4398-89cb-f7fbc44c7466", "comment": "Malware payload", "value": "2e7991488b70ed86708439e6013e3a1816cfc57b", "object_relation": "sha1", "Tag": [ { "name": "cadepeter-com", "colour": "#C3D01B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778591406, "uuid": "03ec2c1e-2d05-4150-a191-11f5e419d238", "comment": "Malware payload", "value": "5c44992ad1afcc6452d37d9c38876cb0242f3f24fc5ff576a27660cc962a1408a584b5602e3d68f00ff3b86fdc3ff22d", "object_relation": "sha3-384", "Tag": [ { "name": "cadepeter-com", "colour": "#C3D01B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778591406, "uuid": "d297bc00-1937-491a-bc2f-c35db2b2853d", "value": "T148512A2A93E35DC7D4CFB471A00FFA1B575AA350D1921D4C5F6C1D12764026CE8A3BAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778591406, "uuid": "e8cbb5f2-4c30-4e0c-9db4-ccd816a4bee4", "value": "48:95Dj6DPTq64UM04PTTT/zVY8DSLl3W/cq6GlFbS4LiBadzWAZOKbock4nKjsg5:G8TJSh+96AJoeWOOKbFcsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778591406, "uuid": "35f56545-3365-4248-9c8e-8f39d5d6ba25", "value": 2993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778591406, "uuid": "905a7f8a-7e2e-4d38-9ee8-4d7173fc9539", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778591406, "uuid": "f3c75706-b8aa-4c18-a8f1-da3fa78faf85", "value": "39959141492818434939.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d67857c4-4dee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778582362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582362, "uuid": "59241809-7f92-478f-a4dd-e297da276f35", "comment": "Malware payload", "value": "e20042f9ef0fb461cb10e9abf6e501e5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582362, "uuid": "e6882ab5-6aaf-4b53-8a10-e9088b67c99e", "comment": "Malware payload", "value": "c58f445ef2ce70f2259f31e22d1a8c848a50fece9299d433bd45c3be3478041c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582362, "uuid": "07e5c2ed-c40c-43c5-a618-8b9cf1c19e88", "comment": "Malware payload", "value": "57272b4d1c184de9dd81bbe0a7e8178c462f6197", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582362, "uuid": "c812faa3-b744-4b59-bd52-fa0f0c12e16e", "comment": "Malware payload", "value": "225fb971e7e969c8139129e6e0c6a2dc64c294fe1ac86c576aaf3f83058f033494d37f378ca6a6d904292744aba7ef04", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582362, "uuid": "bba09514-863f-45ca-9b3c-a630f4b55836", "value": "T144F50F4495E238505303B6786B0FA0E4F337085B0CA8BD1BBA4C6598EF5D92EDEF15B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582362, "uuid": "b1d279e1-caf0-4eee-98f8-23cc5d9bd719", "value": "24576:BQBGNGmR/AXPVOXIPiq65iLRHbYJvOD6QPex1ZZ9l3q4wsEd:qGPRPd9l3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778582362, "uuid": "88dbd4d8-f931-4a6a-901d-15788e69e186", "value": 3586296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778582362, "uuid": "a7e31541-9172-4eab-9077-d6b94d03d2da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582362, "uuid": "0d84da91-062c-4450-9c44-b31ac8d2ad83", "value": "3 router_init.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4119ca6f-4e43-11f1-a769-42010a9c0008", "comment": "Malware payload (N-able)", "timestamp": 1778618618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618618, "uuid": "b62f56f2-c098-4abb-919a-069a298696b0", "comment": "Malware payload (N-able)", "value": "41143635280107c87fed9142ab23f8ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618618, "uuid": "f03a621a-339e-4017-9337-b5bf2c3166fa", "comment": "Malware payload (N-able)", "value": "c6a3043ab5fc9ef7a0fe2d6b59c57e568fa4ea5a6e5a2c54e63c142c17c5e833", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618618, "uuid": "ec6d9934-dbb3-4fa5-84b3-63c5d40c6023", "comment": "Malware payload (N-able)", "value": "379135c0e8538d993b20014cc89b4792733bb9ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618618, "uuid": "c1d7381c-20c1-43df-92fe-55dff0212486", "comment": "Malware payload (N-able)", "value": "2f260f3f6640dc6d6b3b998e69fd0d6de6a6ca352eca8f96e3174e79b6db1addc87c87e4081ec225432162d50e9df3b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618618, "uuid": "c2392b97-4cde-42e1-8c9f-e397b03bdd0e", "value": "T19C26333338ACCCB2F96025305EA8536166FD6B181E34505F73BC4B2E9F2B6C5454E79A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618618, "uuid": "cc7cc495-46bb-4270-8cdb-5bb1e09d5cb6", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618618, "uuid": "8bd168a9-2d3e-47de-bead-0488fa28e793", "value": "98304:/LAslASG6OHPzNnwyle6JMUjVjl8CfN34gDmBUrgFMkFTd0:jLU1Ls6DjX34gSVNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778618618, "uuid": "711fc927-9c81-4678-bd52-1403dab73f83", "value": 4429288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778618618, "uuid": "924a97dc-c17a-4952-8ed5-7696f2b30425", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618618, "uuid": "f273ec67-3c6c-4414-a295-be5f0ed5d8bf", "value": "Adobe Installer.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0e7f91-4e08-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778593217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778593217, "uuid": "971df2e3-43e8-4d8d-982e-879f7153f755", "comment": "Malware payload", "value": "8381c31ece08ffcfbb7a199c50edb96f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778593217, "uuid": "1f58cd90-803d-40bb-8fb5-b43d9e137d71", "comment": "Malware payload", "value": "c6a3e7230435d51bcd926318da5d12070ccb2016daa612decd22da3b75954fa0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778593217, "uuid": "2f86681e-370b-4925-9173-3ffd2020f81d", "comment": "Malware payload", "value": "e75974911fac60f5f68a537fd5fb787b92e48998", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778593217, "uuid": "830f6a4d-0abe-473c-8fdd-1b84e5d3df06", "comment": "Malware payload", "value": "edc45f0d78829b7c0ab08779c38bb5a74a369c333b7595a31dafff82b982432066aa5dbaf74feb36fb24952e66dcdc98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778593217, "uuid": "261acb14-0fd3-4074-8d17-8f451fcfb1f7", "value": "T1E094239EFBBA39C5CDA138A895A5CB4B8ECD0B5A54BECA050CEB419C03E5113D922F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778593217, "uuid": "c4482352-f291-4b87-ab2f-ee4d49bbcb9d", "value": "12288:VoJw13Esa1dWMz3omHXwxWvDQB1F2tt78NpI1jJ:VoG13EsScEPHXMWvDa1kt78gn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778593217, "uuid": "2b627ca2-d672-42e7-800b-d6097a9f794d", "value": 418598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778593217, "uuid": "bcbae9d8-d59c-479d-90ab-f21e079ac862", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778593217, "uuid": "b904eaac-1a60-43f0-aa48-4bab346ca229", "value": "pty10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cd364ad-4dfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778587714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778587714, "uuid": "5384829e-2058-4f8f-9ac8-a8236aa4495f", "comment": "Malware payload (Mirai)", "value": "340c604ad39957041fbf7c3dec2fef87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778587714, "uuid": "2d987c33-af68-4727-b508-80192078c207", "comment": "Malware payload (Mirai)", "value": "c6ab73971267e248c3ca5e5b5d0b8e007091b09c621915152a144c5b64e0fff1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778587714, "uuid": "44b02407-44a5-4dac-ba28-33255e968672", "comment": "Malware payload (Mirai)", "value": "a87ce468092ee6ab0d2ac11e91c58e2680583d18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778587714, "uuid": "e4d94001-1b25-45be-9272-da89f92f5a11", "comment": "Malware payload (Mirai)", "value": "3b685850c11a3f953a39d6f0a7f85a2fddba1d0e00fd579f89f8a4c184e3d9e20c07d45d6c42d51339d2ba88725fe382", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778587714, "uuid": "5c4c175d-4174-4413-bb00-82fc46182a87", "value": "T13EE37CC1F743D0F5D91A41B0B067E732CB32E539202BEE53D769AE36AC62541A61B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778587714, "uuid": "4850ec6d-58ef-4067-86ec-ad3a8a1e4855", "value": "3072:MC2IYGPV8XPWecwUTJnwYgVfzFttM8yU/V+cMB4zvAwHWszJ8+MgGWC5:MC2IYGt8XPddUTJnwYgVfhtm8yU/V+z1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778587714, "uuid": "bacf0f30-abe8-4a24-9802-1ba00719daf7", "value": 150120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778587714, "uuid": "5b159df3-d930-4db7-96d9-231628b70058", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778587714, "uuid": "9cc88cff-8638-45ec-8bfa-81b53ac22f3f", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67cdc479-4e42-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778618254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618254, "uuid": "33a916e5-ee0e-4e78-a473-8ec51721ad45", "comment": "Malware payload (Mirai)", "value": "03890286c3bc07794a148fb37e4ce3ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618254, "uuid": "47c0daf3-06ef-44d1-98e3-e531f8b3dbde", "comment": "Malware payload (Mirai)", "value": "c6f451dbde33d2363c4321c3db3f10d1bc2b6c6022534ffefc329515fc77b086", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618254, "uuid": "97957c73-ffc2-4f71-9335-94a8d58f1279", "comment": "Malware payload (Mirai)", "value": "b6b97713629cb6e273988a2d98b2639110b6c7ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618254, "uuid": "335238bf-3ebb-4f72-82d4-de70b90c0d38", "comment": "Malware payload (Mirai)", "value": "7f14c691716e04755cb8239d310fde2c1cbe78e761e7cc9bca5adb34600073f9fe8f4dcee75a870707a7eada8ec30624", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618254, "uuid": "cdeda97a-e911-47f4-9cc4-60978b06e810", "value": "T11B24E80AAF510FFBD86FCE3702E9070529CC655722A43B7A7674D528F54A90F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618254, "uuid": "24d43c27-0cf8-4e51-912d-f36b01bf6a99", "value": "3072:QfAcPEzzpiZMvZqLM9CwmXuRa8uBZ2+0JALm:QYc8zzpipLMMwmLhk+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778618254, "uuid": "da59f9f4-c9d1-4094-8478-6c8415a59589", "value": 220220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778618254, "uuid": "60dbad8e-a7a7-4477-bdb7-7ad347ac9571", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618254, "uuid": "5ca68732-cde6-4123-8707-0e8a81e2ceac", "value": "SecuriteInfo.com.Linux.Mirai.9833.12197.9381", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57453646-4de8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778579571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778579571, "uuid": "8cad8254-9a5a-45e1-9ce6-6782c4267f35", "comment": "Malware payload", "value": "3cb4b728f93b3e97220d8a93edbb2458", "object_relation": "md5", "Tag": [ { "name": "84-32-22-130", "colour": "#27840B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "l1-topayapp-org", "colour": "#255475", "exportable": true, "hide_tag": false }, { "name": "topayapp-org", "colour": "#2E5A88", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778579571, "uuid": "f385f506-46a5-4253-b419-656ec6d9bcb8", "comment": "Malware payload", "value": "c8b496a060a2f4cc654657dcf13e79755ed3c355516cbc086f024b33f2253f75", "object_relation": "sha256", "Tag": [ { "name": "84-32-22-130", "colour": "#27840B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "l1-topayapp-org", "colour": "#255475", "exportable": true, "hide_tag": false }, { "name": "topayapp-org", "colour": "#2E5A88", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778579571, "uuid": "4fa7646c-ff86-44d1-a01e-3ac3cb8f78c2", "comment": "Malware payload", "value": "6d0478b80257cbcea8a78eb2c9b27c8252cad0a0", "object_relation": "sha1", "Tag": [ { "name": "84-32-22-130", "colour": "#27840B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "l1-topayapp-org", "colour": "#255475", "exportable": true, "hide_tag": false }, { "name": "topayapp-org", "colour": "#2E5A88", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778579571, "uuid": "66d7f920-0a2b-4abf-b897-ef4cc648330b", "comment": "Malware payload", "value": "4828b9fd5d91e87c745f583659e5bf45198fc26cf7e9c7bc2948129dd23f76afa39afa6b7ad991e6b8a589a90c41c1c6", "object_relation": "sha3-384", "Tag": [ { "name": "84-32-22-130", "colour": "#27840B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "l1-topayapp-org", "colour": "#255475", "exportable": true, "hide_tag": false }, { "name": "topayapp-org", "colour": "#2E5A88", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778579571, "uuid": "25f488bf-75fc-4e3f-8463-899f41a0834d", "value": "T1F526F047B89040FAC5AED134896A5222BA707C950F3157D73B51B3F82FB2BE86E79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778579571, "uuid": "7a35ecc9-3c09-4750-a772-4d5dc1bb65be", "value": "29c78be06b08f1034fb52a93199307ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778579571, "uuid": "3d7e6bab-d8ca-4215-82e2-dc279f664bed", "value": "98304:kFGd68EFMIM0f8ARXaxa6kR5XbEgEk4Bu:kBrFxM0f9RK9c5Yl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778579571, "uuid": "3c5234a6-ccce-4c33-b908-3be22461e25e", "value": 4764672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778579571, "uuid": "a8b1ccf6-3c40-4177-9f65-91d05183f7a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778579571, "uuid": "8b73d8ef-46f3-4cdf-bbbe-282107abc0a1", "value": "ws_windows_amd64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fdc9248-4e48-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778620898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778620898, "uuid": "939513c3-3f49-4a8a-8b76-678f1d63dd79", "comment": "Malware payload", "value": "17a2656c39b1525c3620fc3cdbba1bac", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778620898, "uuid": "5f7c459e-cb54-4032-9d88-b3a1ae71f7f7", "comment": "Malware payload", "value": "c913465e7ac92380d0c398953097b917475e3a0e07d53d46763e57576556af76", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778620898, "uuid": "35b265d0-ca29-43dd-997f-9e2d1a9414f5", "comment": "Malware payload", "value": "5754e7c5a741fcfe23e655c2731e51ffcd5da9f7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778620898, "uuid": "e2a78c6c-6f82-4352-b2c1-2c54dba3e290", "comment": "Malware payload", "value": "296092f91f160ab1ea80d3bfbb063ebcc0b19a1e13e1277f65ae4dcd98f632a60944de2460e78ea749eb35e9f284c209", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778620898, "uuid": "6f15ff9f-f4c6-47c6-84ea-bc3ed0d578d5", "value": "T15F0170CB24140FF3C20ADFC6F6588852D107AAF4E7D7877A916308933C8B780B916A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778620898, "uuid": "78de1a74-0e94-4459-a73d-c70cf128e1ea", "value": "12:gvuv2cy99DVGUKCFK7cgGUy4BRGUpC9+qVGUYe3bfGU8zHwTwsj7:kGTQgGiRGwGGSfGZHw0sj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778620898, "uuid": "876bb8db-c44a-4994-87ad-81e6461cd594", "value": 826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778620898, "uuid": "32c0df97-3e3f-4521-928f-c5eedb172421", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778620898, "uuid": "f6e65d94-8703-41ef-9d4a-88a4cd67e464", "value": "testload.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70572cd5-4ddc-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778574459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778574459, "uuid": "8ef7889a-e06f-433d-a204-eaba35efbd72", "comment": "Malware payload (AsyncRAT)", "value": "205c50815c0ed630c18bb30c701cdf5a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778574459, "uuid": "d82398f0-5d34-4046-be43-738666e7d924", "comment": "Malware payload (AsyncRAT)", "value": "cb52555f764752d30b0587817a4673797f495e9511bccf92fdce1e315765657a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778574459, "uuid": "989bda06-48bc-4397-b97f-b8b552cdf018", "comment": "Malware payload (AsyncRAT)", "value": "0c6e351987527e1aedb9629b167e523327ab1aeb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778574459, "uuid": "3e99b628-17fa-4346-90b6-115a73e713ca", "comment": "Malware payload (AsyncRAT)", "value": "0788efa6308111c4250cc51075aedf86a43302bdcd8008ad45fcc77da8019fdd2eca48503a31caeef75d2aa8deaef767", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778574459, "uuid": "8929b849-7b37-4b9e-88e3-0e8a71f3248c", "value": "T198E23B4877E04312D9EEAFF02DF2710A1674E11B9D13EF5E0CD489962B67AC246507EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778574459, "uuid": "1dcf036c-c093-4abf-9b48-db0f1db45bdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778574459, "uuid": "868f9c50-e90e-4a88-9ed5-8fff682c1352", "value": "768:v0dT+x9p94AvGFbO75mCDFo9jOZROjhmb+:CT+xt4A+bO75mmFo9jOZROjA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778574459, "uuid": "c0f1bf84-dbd0-49af-8d47-c68d46eb0cfa", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778574459, "uuid": "03370e39-68b9-4152-a3e7-bb22aa4ec4ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778574459, "uuid": "06f9c91d-0438-4695-89a3-12b226e59453", "value": "ru2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ad491c-4de4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778577762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577762, "uuid": "ddc52308-b6cd-4ce5-9e20-04c357e583ac", "comment": "Malware payload", "value": "dab37b1a3a7788b40f87934f9403e0dc", "object_relation": "md5", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577762, "uuid": "c0cae374-31e5-414a-8a8e-5944683f440c", "comment": "Malware payload", "value": "cbed15e3ec19f048d9a0dd0e6d19f4ea1f588a31cc5a6f4108e1991a97f84501", "object_relation": "sha256", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577762, "uuid": "2e0d3cd3-7d4d-47f2-85f7-d7d7df45cbbb", "comment": "Malware payload", "value": "0d7367b8c7cc320e4fc5ef1258ceae2b31263324", "object_relation": "sha1", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577762, "uuid": "6dae8dc7-01ca-4b9b-b95a-7d8a53504909", "comment": "Malware payload", "value": "fa3df2ecabd412b9348cbb58bb2c9800f16927ee7cf4e88a510fb03a4309431cd39ac311b5c8b6390eedc974253a8452", "object_relation": "sha3-384", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577762, "uuid": "3e17a166-7216-4db3-aaa2-61a613535d78", "value": "T13396C6E5900A92CDCC2DD8B8995D64FE65AF8FAB1C0B87DE7E69F863542CD34F101A04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577762, "uuid": "99b6e683-60e7-42e3-bae4-6e8e9fc6efa3", "value": "49152:X7o1QCqI2JCHhGQbmDMKjs5j2LsPuawPG5VqUIfhH4/wvGTA3OAI:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778577762, "uuid": "9909eba2-cae4-4a87-bfbc-32dfe69f75a9", "value": 8628408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778577762, "uuid": "e4bc3232-7fd2-4147-888a-fad82a5d148e", "value": "application/x-bytecode.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577762, "uuid": "1b5f12fb-be0b-4825-bf1b-e7741f1407e4", "value": "sim.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee9a614-4e3a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778614722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614722, "uuid": "01f0468a-808b-481d-9cc8-07553e92a7bb", "comment": "Malware payload", "value": "d122729db3a9a5a21675d29940629be8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614722, "uuid": "6a34bc53-7428-49c3-94f4-14c18ba116a9", "comment": "Malware payload", "value": "cc35df80c23120031d360338d3ab93e475a3a93f7730b486fe48fca147fe6e72", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614722, "uuid": "7b860de5-26e0-4702-aedc-4a8ff2f7f381", "comment": "Malware payload", "value": "7efcfbba7130527c7d0e67106443bd53c47484f8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614722, "uuid": "6c65479a-87b7-4369-855a-e37962539701", "comment": "Malware payload", "value": "1e288bd803b1fa79e047a545be13f3ebd6f7f5cffc54c79f2243f43e12aaaef48f67737425ae58e4e1e2d80020199da0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614722, "uuid": "5b42495e-f8a2-48c8-be67-551d558c0efb", "value": "T1A5A6F15E9384D06ECB985C7ED4083309B89DD9DDC568784A6A788FED4A470E2DC683CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614722, "uuid": "4b286e2d-1b4d-4159-aff4-cbdfb020d1eb", "value": "89cbd0d03f658f7b76d6cfbf08bc6fa4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614722, "uuid": "6170cd8c-fbc6-4d61-8388-81ec54ea90ef", "value": "98304:8GWJQTUVRNpB7kVqdNBaj0e1OPEoeOSfP/ZQHdra/hfmKz/nKyCXRlHiB4K/ZpOC:ywKRR7kVGdat0GhOOKyEo4WiY0cf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778614722, "uuid": "4a222c80-c250-4df9-9c0a-bb39ae5600c0", "value": 9613312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778614722, "uuid": "e246ee75-ff32-4171-813f-9672951c1fd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614722, "uuid": "5a26ead7-0993-458d-8bcf-fb6ce87851d3", "value": "google_ct.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f793a9-4e24-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778605495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778605495, "uuid": "810957f0-232a-4420-b1e3-480bd66c01a0", "comment": "Malware payload", "value": "a65082252ec43b16ebe8ee69ab6c0fd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "steam", "colour": "#96A986", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778605495, "uuid": "e8aa6ecf-8452-41c7-9ef4-b514ab5fef96", "comment": "Malware payload", "value": "ce12d366e445692302ebdeb61257797e56927b3bb25703da12a95339ec151e82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "steam", "colour": "#96A986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778605495, "uuid": "84ea5d4e-ccb0-49d9-8a39-62e5c0999da5", "comment": "Malware payload", "value": "901693980af656049f5fb44e5c1bccbdda8a9459", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "steam", "colour": "#96A986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778605495, "uuid": "36fced79-81bc-4345-83ad-b43cdb134987", "comment": "Malware payload", "value": "276da71e480787de6d677ab1f75181b52d990ec3593fc052453956af82ae1732f9e67199cc2363df00d6029e137f717c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "steam", "colour": "#96A986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778605495, "uuid": "7091949f-2143-4b32-9b47-36caaaec2afa", "value": "T1FFD46C1F259363D2F865923398BE22525B7CAB031B6964C7C48872784FB37C61C766BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778605495, "uuid": "086ea79f-2344-49fb-82ea-8f5c7cb8e17b", "value": "2d82fa1cacd790ed7f75ad395579b8f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778605495, "uuid": "b5f4a426-74f5-4078-9ac6-c8c96603973d", "value": "12288:p80yLkgVMJqTn14P0cvAsnlDCP49xxmG79:pLyIUMJqT4LvRH9KG79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778605495, "uuid": "87391d97-7c32-470c-b0da-c63a36e6af88", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778605495, "uuid": "34503913-1358-4f2f-9992-78fb48ddd69c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778605495, "uuid": "09be2270-12da-49d6-a762-106184893120", "value": "steam.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13866b9c-4e39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778614247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614247, "uuid": "837a0f07-b978-4cfb-9c7d-333d84df9e1f", "comment": "Malware payload (Mirai)", "value": "bf862d9acef04543648d16676c5efa60", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614247, "uuid": "6c9f5401-7dd8-41b5-85a6-01678cf2fc4f", "comment": "Malware payload (Mirai)", "value": "ced89c75b2a41664b91d881528f173c3076420b7d27c2f135ea063b15f968ebd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614247, "uuid": "ff7a0515-ef3a-4cba-af7a-06f05de634a3", "comment": "Malware payload (Mirai)", "value": "65d71450d76653c1c917544514aa81c33c688f37", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614247, "uuid": "819dbdfd-e0a7-41db-8b3e-1b6ec7a2c2c1", "comment": "Malware payload (Mirai)", "value": "83669ed1323bc230fd1b9ab0ea17b55739970340d4dcc6e5b00bad923d1eef0306ea190dfcdf1863e5edc69943b50cac", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614247, "uuid": "35d73ee6-2882-4296-a35e-cfe5e9071e20", "value": "T1061106ED15B1897754599E42F1E34D28A40E7FE021B56E8CF6FE2C362C58C01B12AF11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614247, "uuid": "a12fa388-6b45-4d81-8eb2-d1bc06630923", "value": "24:lrM6WBCQ05pELMk0a1PjwV8LiWtflXWZoSWuVLifWYDKY:Z/GzMpza1BN5Mibb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778614247, "uuid": "27799460-4f8c-4fe5-977e-49ead5800b69", "value": 863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778614247, "uuid": "028e88f0-8e67-4d72-9c70-61fa311f9b5a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614247, "uuid": "cf748de8-a5b3-46a3-890a-8813193a2927", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9bb60a-4d96-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778544229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778544229, "uuid": "c7e934e7-61ef-4cd1-b488-843f5b2586d1", "comment": "Malware payload (Mirai)", "value": "f5db0e21d290bf7b2d23959a530f2e3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778544229, "uuid": "000caf4d-819b-4fbe-958f-c9d5ff24d44e", "comment": "Malware payload (Mirai)", "value": "d03dab10036fc5967786b13a2f5ef4d71f330eda1a575e0b6f62ae38c96361b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778544229, "uuid": "5718ae3e-c9cd-4e90-8757-eccf5f6c0b22", "comment": "Malware payload (Mirai)", "value": "8d5eb820059fc9e7f8166c72b1689a673c2292b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778544229, "uuid": "efefe9b8-cef9-4da4-b1a1-238d7b6b4486", "comment": "Malware payload (Mirai)", "value": "3210c996eb1dc3ff55bb77c2ab84ef5e910f9092fd08f7d44e26be5b401cc69eac615b9faad7339b444bf7f083757285", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778544229, "uuid": "06469164-7151-4b41-a10b-c120a5049a73", "value": "T1DA043945B642CAF3E5834FF612A387614A32E8391B2FDA42F33DBCB45E11598F51A61C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778544229, "uuid": "ac414d26-a675-43aa-a4aa-c834c8a577ca", "value": "3072:TJrJpKkM0ojxj36JarmHPUZz3avArw6mX3PGpR1ko/LdpCMLBC:TJNpKkiuUCsZ2vATmX3PGpR1ko/LdpCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778544229, "uuid": "c92cc70f-3cd8-434a-b552-8986ae4d1772", "value": 184094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778544229, "uuid": "0878d017-530a-42d4-b069-e1dba502d5e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778544229, "uuid": "9d4fc001-b7ca-4eef-915e-91d46f8a7264", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a5e66d-4deb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778580971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778580971, "uuid": "fb9bd61f-5863-404f-873c-01ba0fba3517", "comment": "Malware payload", "value": "804c116cf9a1259d537c96c12a1f39aa", "object_relation": "md5", "Tag": [ { "name": "43-160-218-11", "colour": "#697238", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778580971, "uuid": "377e7c4f-8224-487b-8704-ec5cbc564155", "comment": "Malware payload", "value": "d054598e18bf1386315c1f850886b833bc856b9aa51b6ce48bc5c5738ade0eea", "object_relation": "sha256", "Tag": [ { "name": "43-160-218-11", "colour": "#697238", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778580971, "uuid": "93b46e0c-cd58-40ae-be99-c70d07583490", "comment": "Malware payload", "value": "8a5637db21b8339bb037416b77f6f03026549aec", "object_relation": "sha1", "Tag": [ { "name": "43-160-218-11", "colour": "#697238", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778580971, "uuid": "3d2fbca5-a299-44f2-a5b3-9898745cbefe", "comment": "Malware payload", "value": "f7482a7ac9c8499873ce559f94638d42a6fc51c3d9c5adb125fa1be49646fe7687c55f7c4eb2098b99a76abe026a4d32", "object_relation": "sha3-384", "Tag": [ { "name": "43-160-218-11", "colour": "#697238", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778580971, "uuid": "efe2f6e1-a26d-422b-9cd2-35f3910b054e", "value": "T164F2F12BDF551929DF179D34F3C402212137C57D066A1B261E83BC98BF567ACAF41178", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778580971, "uuid": "5c5a32eb-3da4-401f-841e-73a67d73dc60", "value": "768:mwOvHCrpeuMHMN8/MrR+24vE6KcdtRFGv/jG9J40:iEJ8/QRYvndLwWJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778580971, "uuid": "1cb9c3c3-9981-4322-82e1-5ff83549cc8b", "value": 37339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778580971, "uuid": "4f008139-4401-4f76-add2-c2c193014af7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778580971, "uuid": "ef91341a-98c8-4c9d-8fc7-68ad2cdd3b3c", "value": "d054598e18bf1386315c1f850886b833bc856b9aa51b6ce48bc5c5738ade0eea.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827e5495-4dd1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778569765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778569765, "uuid": "f3b1f6d9-24e2-4223-bbc0-9382afe9d248", "comment": "Malware payload", "value": "257f6d137da3907657bafddcd8b0d56d", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-apartuk-info", "colour": "#4E5A4A", "exportable": true, "hide_tag": false }, { "name": "XLoader-v0-6-8", "colour": "#0B1578", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778569765, "uuid": "fa342167-b8fc-4119-bd16-e91d141c8b90", "comment": "Malware payload", "value": "d212111dc2ea26080e21cb1eaad7af688b72fe6ed3e0fb841f8a36100e2b5380", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-apartuk-info", "colour": "#4E5A4A", "exportable": true, "hide_tag": false }, { "name": "XLoader-v0-6-8", "colour": "#0B1578", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778569765, "uuid": "d9bab76e-1292-44bd-9fe2-4aa04746690e", "comment": "Malware payload", "value": "70c5001592fef7aa26919dbea61163c1bda24152", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-apartuk-info", "colour": "#4E5A4A", "exportable": true, "hide_tag": false }, { "name": "XLoader-v0-6-8", "colour": "#0B1578", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778569765, "uuid": "1431d92f-0f18-4a58-885d-b7877b256558", "comment": "Malware payload", "value": "565844fdd294ba7d712e9cace58bbb0475e83941a5be7c4476fbc3082848b42a2000d3769625b18e7c104b3079449a94", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-apartuk-info", "colour": "#4E5A4A", "exportable": true, "hide_tag": false }, { "name": "XLoader-v0-6-8", "colour": "#0B1578", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778569765, "uuid": "a05704ad-17e8-446b-b817-57f187b40977", "value": "T1FEE423B40EAB77077EC0A1127457D8CB112C16A05A34BD683E1DE5DA85CF1EDE8B2A37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778569765, "uuid": "7d618df2-da6d-475d-ba99-f1fcf42ecfe5", "value": "12288:6dmj7iA6nchJVvZ/DJ+30bn1MITKbCE8RE8IouTVwNx2j699q6KMFkmIC1Yoyf:MA68R5MQKaRrILWGjQ8yT1xC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778569765, "uuid": "107d8b4f-e183-40a4-90a2-30e9a8662dac", "value": 711317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778569765, "uuid": "1a6cc5bd-8d68-408f-ac65-2cc891d851ee", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778569765, "uuid": "780ce9f4-7dcf-433d-b905-b9ac4da2dc33", "value": "Quotation#21567.PDF.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8668c502-4dd5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778571490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778571490, "uuid": "d105528f-1169-48d0-9108-ebb83748a388", "comment": "Malware payload", "value": "eb2e4ac72107a00cfa40f83a716d5366", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778571490, "uuid": "acea4f86-d733-4460-8d59-ebf194491334", "comment": "Malware payload", "value": "d23bd7a2e0e225c5637525681059a45fb0da46bdf4ee5bbeb4f2566795279f31", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778571490, "uuid": "201b4f57-2807-4dae-9a88-1c28e27c3aa3", "comment": "Malware payload", "value": "6221f09a79d8903f7c2a4f5d3241123f193c2f66", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778571490, "uuid": "f8a4e7db-98c0-4ff9-89db-3fbb11408e93", "comment": "Malware payload", "value": "a75f203a2b074dfe0fae36108cbbd1d0116f2869f1aee8bf1c9165137f58f2c063d56a0ef26eaaedc1e63756239fe6af", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778571490, "uuid": "f4c4536f-a6da-43e5-9867-fa761df99d31", "value": "T186A533D73F49DCE8F9728370B45311E5DC90F54C603526A2E176B3B323AEA3A6A845E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778571490, "uuid": "104b89ac-2d3c-4730-92f6-c4f464762e25", "value": "768:Nggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggl:lh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778571490, "uuid": "aecb32ed-6fcb-4622-b2a3-19a2183e9d45", "value": 2205980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778571490, "uuid": "7cee4c5e-93b4-445c-b17b-62b27aa215fd", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778571490, "uuid": "a14fb686-35ff-4041-932f-314fdfc2f16d", "value": "889017950847.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a2e84a-4e1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778601625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778601625, "uuid": "44d56e46-e321-40b3-9d7d-7475d511c6d5", "comment": "Malware payload", "value": "8ab77bb18fe85a214bdfe167261b47d7", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778601625, "uuid": "05b1b325-f5ea-4524-acd6-1ec50ab35f3e", "comment": "Malware payload", "value": "d346ef393a21b3aaffd3991f27ef12b0142c828097b94d59d4ba997477df7fce", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778601625, "uuid": "6ba1a9d6-c956-4414-a689-5dc4dfc9023e", "comment": "Malware payload", "value": "2915599640d699a20a888c8aa47ae0465c1084b0", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778601625, "uuid": "00a9a59a-d867-4462-9ec7-90964e159602", "comment": "Malware payload", "value": "d66b820797b2dfc55cda62d56cfc98871bc0c50dc8f89fe53974d3720085335f85ef8f16fc5a65bea7d0d64304d338c4", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778601625, "uuid": "8a0b4658-c051-4edc-adf9-7de455af21af", "value": "T175879D6DA3C82799D726C6398604AF23C1F2782247E6A0CB46D717071E779D34BFA631", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778601625, "uuid": "83bb6766-b2d2-4567-9b1a-0d4b1fbd1de8", "value": "1adc8c0c6944a18ca6c02a00bc42b28a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778601625, "uuid": "e76be67e-9ba1-486a-8ed0-186d4b4b1863", "value": "98304:6EgMO8jFMXny+6LcusLrvxhlzxosTb0geQ0XptQ43r/Zb4iJeXrf5Gj:yMO8JMXnyt4uAvvosc1nbQib4iJIz5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778601625, "uuid": "fc37ea4d-7c98-4816-b96b-339e6c4c5edb", "value": 37730304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778601625, "uuid": "0fb299b3-855e-4d53-bafc-346d9150873a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778601625, "uuid": "01f31108-6bbc-4456-ad8c-ad4b4dc22175", "value": "2libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb27e28-4de3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778577679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577679, "uuid": "2e357622-1212-4a62-ac36-e049ae251666", "comment": "Malware payload", "value": "7b2faef64867d798653e4598917597bc", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577679, "uuid": "a79c637a-9033-45b6-84db-85bf9049919c", "comment": "Malware payload", "value": "d35a2ff1d2097d610b80f33096e9dcbab0c87d7396c2759712c952dd2dee659d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577679, "uuid": "3bba3f44-7405-46a5-a2f7-5acf06c4da93", "comment": "Malware payload", "value": "45652fc10ca9a98130741389057da09e32e30467", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577679, "uuid": "e13b9e89-9b6b-4d2c-a1d0-ddba33068ca7", "comment": "Malware payload", "value": "f2b744bb756082828ef57fb97cc536fb8a6ecba3591a5ad8909a88f12bbd98fe2cea9606f76da1539dbc3aad5f846259", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577679, "uuid": "edc03b30-c445-4283-addf-b46a4d519a69", "value": "T1D815F192DB672FDD3D340DCD042E6B4A48C8AD313D12C8F6AE9F140B8529AD65AD1D2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577679, "uuid": "9ae74be2-29db-4cbd-8606-adf5802ada47", "value": "24576:AiZ1wdOA5COA5IOA5T4OA5COA5cZ1wROA50:U5Q5q5W5Q5t50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778577679, "uuid": "9be7eae9-420d-4657-81eb-93be62942726", "value": 891367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778577679, "uuid": "ad83aafa-1a4f-4375-8fa2-cbea60099db7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577679, "uuid": "345386b0-c74c-4505-9d74-b3cb1774e950", "value": "ud(1).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42fb3250-4ded-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1778581685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581685, "uuid": "e7c90f02-dc84-42c3-86f2-f53fca5df7a4", "comment": "Malware payload (QuasarRAT)", "value": "f19aed6892f379c0a3ece0ece7056e58", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581685, "uuid": "06ab506f-7c4c-43bd-8d3c-cf28130318c6", "comment": "Malware payload (QuasarRAT)", "value": "d3934da67f5f053a6c519e8116442339dd11f2b7c4727e6f915e1ea2e5181395", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581685, "uuid": "5a77f741-5597-4ec3-b7f4-5074a8067870", "comment": "Malware payload (QuasarRAT)", "value": "3375548b62fd6a55e2a46e864753e7726f0af60a", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581685, "uuid": "919ce6c9-14c7-4eab-9855-473e9a2452d1", "comment": "Malware payload (QuasarRAT)", "value": "7929f9b9cd48a9cb7cb6fd18905609067070f6414fc89dd542c8f99349de9303c5ca75756f23862aa72ff21eec161848", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581685, "uuid": "395ebc2e-a3be-4238-9017-49469679f28b", "value": "T1CCE55A0477F85E62E1ABD3B2D5F0541363F0F82EB3A3EB0B5191677A1D93B4098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581685, "uuid": "de7095d8-e43c-4580-b4a8-89a2d340de8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581685, "uuid": "ec093570-0687-4f33-92b0-2d97ecbc295a", "value": "49152:cvWL82kyaNnwxPlllSWxc9LpQXRtmSmznFoGdjzTHHB72eh2NT:cvk82kyaNnwxPlllSWa9LpQXRtm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778581685, "uuid": "08f4be8c-270d-46a7-92b6-88fdf298e7c0", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778581685, "uuid": "350e5812-679a-41e9-992f-e29a34add577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581685, "uuid": "2c07060a-7fbb-4764-a698-23e9b1dffcd8", "value": "ChromeUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "219815b7-4e52-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778625008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778625008, "uuid": "ec5f1fb6-1a72-493d-8222-c4592b72df72", "comment": "Malware payload (AsyncRAT)", "value": "331fc21ec7998293459910328edd3dfc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778625008, "uuid": "350bcd13-4164-4a51-ace0-53c3f1642552", "comment": "Malware payload (AsyncRAT)", "value": "d39520f3eebb5fffe353dbed91958b9d61f70123bb9cfdd512da5177cfbbf2ed", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778625008, "uuid": "b3938f49-e820-4c50-83a6-1ce884cc3db1", "comment": "Malware payload (AsyncRAT)", "value": "4b1d86a64a987fbdb95dcc7dd5878282e759eab1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778625008, "uuid": "88694508-0c70-4dfb-baf8-45d59629d4d2", "comment": "Malware payload (AsyncRAT)", "value": "853abc748c5b7a43034c7079fd06caa033031618d8bd7184764fd20df838874db2a7473a728a787789cdb7c78db6a26b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778625008, "uuid": "94afb641-c943-4bd5-803d-0ce12866717e", "value": "T1F483E192F3B182D4EAF2C031BC116B1BE7F47099591066DF671D69491F33922BA2C3E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778625008, "uuid": "c732c615-aa64-4655-b117-8a455d52123d", "value": "1536:C2X99wX8SAnNUfFjD6lYv3mas8rbYD/yim/1y1ejY6yFOBW:/X9KXwNCfiYv3mv8rbg/yjgf6yFOBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778625008, "uuid": "8d5d8681-811c-4a0d-8449-c7141f97e052", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778625008, "uuid": "2ecb0347-001a-4713-897d-a5c3fac26f70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778625008, "uuid": "b237099e-4b4a-4b98-b1b7-870e3726dd5b", "value": "d39520f3eebb5fffe353dbed91958b9d61f70123bb9cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0cc9601-4e37-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778613625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613625, "uuid": "2f2d00a9-cd93-4a33-8775-90ebbf8902ea", "comment": "Malware payload (Mirai)", "value": "6350f2d2608b98c5e6aa31bd4775a620", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613625, "uuid": "02f6dff5-0c92-46af-a3b1-4211e67fd787", "comment": "Malware payload (Mirai)", "value": "d4ecbd093eb0f6645ebec514c044010e5e6ddae737ae008459ea0362e7e21a48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613625, "uuid": "de1a48d9-d66c-4535-b6c7-92e5312d010a", "comment": "Malware payload (Mirai)", "value": "62e6ad8354c1173c4ae2b40264c8839f1d6b6039", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778613625, "uuid": "5dc5f778-909e-4395-91e4-1d704218c5cc", "comment": "Malware payload (Mirai)", "value": "305d05f2a02cda0d0ada61f1feac5963ef757bb3ca3ef3842d7f467bdd04f2486a2bfacf4ece40920a07b3f7fd549343", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613625, "uuid": "417511e5-8113-48ad-b08a-50860c9ce73f", "value": "T1C3E30845FC414B27CAD622BBFB5E428D3B2917A9D2EF72039D216F20378695B0D37642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613625, "uuid": "d8b8b966-7e08-4f57-bac7-cc7f8f6e5487", "value": "3072:1cicJ3kEOD9YfwNWsUcW2P4Fkex9DLWveTSJhmn:1cicxOWsPvP4F1x9nW2+Jhmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778613625, "uuid": "6935bd0e-8eb9-4fd8-95d6-7a3d3e36ddd0", "value": 154400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778613625, "uuid": "62160175-68e8-4d56-9faa-c83197982b67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778613625, "uuid": "06dd3c4e-657d-44b5-afce-7e90d4fc223c", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca5fa6a-4e19-11f1-a769-42010a9c0008", "comment": "Malware payload (Loki)", "timestamp": 1778600706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778600706, "uuid": "6398a4d8-63ad-4b46-b989-7804b3ec82ed", "comment": "Malware payload (Loki)", "value": "ed7afd820cd75e547ba46eb45e370ecb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778600706, "uuid": "8336f2aa-50a9-45d6-ba35-f50dc8da3545", "comment": "Malware payload (Loki)", "value": "d5030b07278ebd86460b06d207ce1761b29837afda17515f31513795441edb40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778600706, "uuid": "e2fefff8-07e4-4922-ba2d-4e80460d81f1", "comment": "Malware payload (Loki)", "value": "b67a332b99c0774c05029158db6f0b3afea06885", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778600706, "uuid": "6a04e7e0-ab5b-4cbb-8b64-aba94f83cd99", "comment": "Malware payload (Loki)", "value": "ce8faa723a65bb6517e50746c6b73cdce9c2ad77e28f0f77adfbfc92742b7b72b61a498ce5d8cfcd993531f7db4ffb9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778600706, "uuid": "b1995a52-16e2-4a49-9e30-3c3176f97463", "value": "T15CA32A42B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778600706, "uuid": "7976a046-8a3a-4093-b1eb-de77148f2d1b", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778600706, "uuid": "db02df41-9943-48f2-b276-bdb5a7da6d29", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778600706, "uuid": "868d5c8d-4ac1-44b1-88c9-44eed698c65f", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778600706, "uuid": "dc838a97-b252-4b7e-9adb-39e818850226", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778600706, "uuid": "a7655d6c-b563-42d8-842e-d4e00ce0d519", "value": "ED7AFD820CD75E547BA46EB45E370ECB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8babd86-4dfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778587895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778587895, "uuid": "1138692a-8644-46d1-8cd6-0927d86eef12", "comment": "Malware payload (Mirai)", "value": "9b2bde010c02e622ed07d3952a438b81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778587895, "uuid": "4c6b4547-ccc5-4399-9b89-d65eafae4ec0", "comment": "Malware payload (Mirai)", "value": "d51d78b46d965fe3b0649651c5996d09b61117b366bf3b40dd3856fcb552d146", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778587895, "uuid": "48bb43ce-0f2d-4d7b-a5a2-f9c19490a25e", "comment": "Malware payload (Mirai)", "value": "07793c5554369266e73d737c786f4857b60fe057", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778587895, "uuid": "d4486a8b-64e8-4cb2-83b1-a859f1e1ee28", "comment": "Malware payload (Mirai)", "value": "ae74589b7558a4ca35a09572c3c41900a84e9602f57140c1e3d3d32cf2a3003504c8856a6d00c9212731c5519dd54c36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778587895, "uuid": "25acc561-f639-46f9-a151-8ab7e2890003", "value": "T16B145C02B31C094BD1632EB42A3F27E193EFA9A124F4F645755F9B8D8272D361485ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778587895, "uuid": "b5aba53c-1d01-4ecc-8f10-d65c27ca0593", "value": "3072:avdFTNNnyK7PQtADJeb7im/c4VXxg4TYNI3QY3qD2def:G1i7vRXxg4UNI3N3qJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778587895, "uuid": "c60de591-665c-42d1-9c51-8f4d46ebea46", "value": 204272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778587895, "uuid": "f2b7793f-15f8-419d-945e-49eff4c605b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778587895, "uuid": "0cdf0cee-e1d5-4a21-b6e5-1daa3c30f13b", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414f6bdc-4e3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778616471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778616471, "uuid": "d73a0268-1044-4c71-aad8-7a7be93b6fa4", "comment": "Malware payload (Mirai)", "value": "6f5d51b13d6f5e3e389baa34af302b7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778616471, "uuid": "a98cda3b-a57c-4e0d-baf4-ddb40e90e4d0", "comment": "Malware payload (Mirai)", "value": "d53291319c23d21800b611fa553e85175eb0e3e822daca51886e91aef0e9e6e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778616471, "uuid": "e4fb2b03-d59a-498e-bdaf-36b9ffeac2d4", "comment": "Malware payload (Mirai)", "value": "345ba50e2e62e807e44ca5fc6e04ed8fd51056c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778616471, "uuid": "566055c6-b4f1-4308-9af3-56ec853cc9b8", "comment": "Malware payload (Mirai)", "value": "39fa52aa8145182344e94518195311ad56b67f2f486a296639d0d274dcde1e7979067f48d28b960d0a05429c728c3109", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778616471, "uuid": "6047bf7b-e488-424c-b618-289e83f45e93", "value": "T108143A02731C0A83D15B6EF02AFB17F183ABED5119A6A544F62EFE845332FB15509F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778616471, "uuid": "fb2c7a4c-0657-4489-8297-cbdf4bc79f80", "value": "6144:P8f9gQqFmz/xKZN7gjZRlV7FdZmTK4+Ehj681A2hNNmt1:UVgQqAag1RlRVmTK4+Ehj681A2hNNmt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778616471, "uuid": "7f2dc3e4-6eb7-4bbd-9f11-b42fa35d578a", "value": 208360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778616471, "uuid": "cfccb474-272a-4d11-96a8-ed6a302b6b6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778616471, "uuid": "a880baa5-3ed4-4d51-aed9-f1326288d56c", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811cff9a-4d9e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778547859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778547859, "uuid": "9124c7f9-3bbe-400d-970d-5545f7dedb2b", "comment": "Malware payload", "value": "8b5ae327256614fb4bb9a0d02c86424b", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778547859, "uuid": "03aa166b-6eca-4e96-8ed4-c703c62c2765", "comment": "Malware payload", "value": "d5449f7a1351ffe3266524958cfdee3e9c53adbd06b05b686276dea18d4548ef", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778547859, "uuid": "759e0a2e-9f12-48a5-99c7-86bb9d048512", "comment": "Malware payload", "value": "248db27d1c2e831ec4cbc0e400332e1781545dff", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778547859, "uuid": "80b5240e-caae-4c2e-9bf1-7f29411d803d", "comment": "Malware payload", "value": "367505aea7295e23369104374c78494cad3573f7d9de34f2b3383d917033d7d8ce8f32ac2c39ba86e4b249cc4bbc2b28", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778547859, "uuid": "8c1ed514-06b3-4184-8a2b-e277f2a8443c", "value": "T13C664B92E1308CDFD82A45709C2ECB756D527F63F8A406971799FE1E2AF32421417E8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778547859, "uuid": "08737000-1eb5-47c3-a476-87a4e9be96be", "value": "39e785e547390198c9ae21b26708b19f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778547859, "uuid": "a75bdb5a-e858-4c13-b1a5-ae21e573af82", "value": "98304:S9rx923u62u7InCEE+wysPM4mlaw0LI60GBGrGrGWAuU7jPLQ:SFT23u66nTE+wBMHlaw0/U7jPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778547859, "uuid": "fd5e8672-4c5f-4eb7-93c5-5feef5ec8fc0", "value": 6651904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778547859, "uuid": "1a0f772c-e018-4478-b14f-a0df489fb10b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778547859, "uuid": "3c44722a-9beb-496d-afc7-968fa74b6e5b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b66f34b-4e12-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1778597483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778597483, "uuid": "82627878-12b7-4463-b886-3591fbaf0901", "comment": "Malware payload (Prometei)", "value": "f2c861de17ee0347d15d0a6e3444b31b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778597483, "uuid": "d9b84c94-1590-4ee4-9aae-16f1e488f9b8", "comment": "Malware payload (Prometei)", "value": "d6ceabe9620acdbac672dc9fa2250b52522dd83283a992c02cfdb952cf113a22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778597483, "uuid": "15ba673d-c1a5-4bff-952b-83a7e01e9f0a", "comment": "Malware payload (Prometei)", "value": "b5de5f2d55b0f4e364f613c7f87e1e46bd5b342a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778597483, "uuid": "6139b3a7-9e67-43ec-a47d-7c1196f0a194", "comment": "Malware payload (Prometei)", "value": "de1bb724eaf7bbca99ff3d1905ab6ad8b4d7bf1912c5a6cad2201a2df415bb13fea0f7d64a5022c0922f895dc6b716ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778597483, "uuid": "37e6394a-f22f-46e5-859e-12d489637618", "value": "T1B69423FBD6C0430FCF16117C277E6A22D2C6553539AD6AB0C62CF8AE0E792075944EA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778597483, "uuid": "67e15211-4224-4097-a4a7-efd33cff87be", "value": "12288:4h/taqLkdfH8ytYiflIw0BEmWVeygFurhCA:4YdkVLwKvyaJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778597483, "uuid": "2538f32f-a256-480c-92db-032179e66cd7", "value": 436276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778597483, "uuid": "40b08fdb-d296-4354-8152-93f850af17c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778597483, "uuid": "ef2aa97b-ec5d-4c10-98fb-d605f946df11", "value": "d6ceabe9620acdbac672dc9fa2250b52522dd83283a992c02cfdb952cf113a22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9148c7f7-4e17-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778599855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599855, "uuid": "17730cd5-7e48-44b9-b8c2-33a6b64544f6", "comment": "Malware payload (Mirai)", "value": "0537ea7665e139c9405939cb1d76fd03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599855, "uuid": "e17b8a10-49f2-4f53-9c2a-63595c183048", "comment": "Malware payload (Mirai)", "value": "d6e365ae65596fbff428fe4b6c09fdcb0e2a891783f07c24851db1dec456969d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599855, "uuid": "1803741f-b8ed-4c63-83df-1e563a463f1e", "comment": "Malware payload (Mirai)", "value": "2c77b28d1ee06321afa53394cdd087668afa6458", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599855, "uuid": "0845272d-da5c-4a5d-a9e1-9c0f1a88c62d", "comment": "Malware payload (Mirai)", "value": "e5bac67ed4dbd5b0f42d5305618a904c8ea1a1193e37465e23a68f6ac76ceeb3f024c69c71cdc2be4d46cc3cfb76656a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599855, "uuid": "0da4133f-ec97-44b5-b758-e2d067b95278", "value": "T144F46B47FF184562C9530DF02A3F43D9F3247A5340F5922A270F5B572622E3AAAD778A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599855, "uuid": "8e66e748-da85-436d-909e-0271adb44902", "value": "12288:kTxwrnBAyxYnyTQ5VJ6+ie9u+EfJtOCL2+Bl+Noptb7t6S2BeqKQg5PTepjCyjAP:kTIgu+EfJtOCK9ovfX2oWgv8Ar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599855, "uuid": "d24f8b6e-9fa8-462f-a6e4-77286c98ae7a", "value": 792372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599855, "uuid": "6eb68b18-9ac4-42b4-bb50-3081e9771e46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599855, "uuid": "43e8f05f-d474-4fd9-bcc6-02f771e78a98", "value": "3atoNational.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d809a9-4e19-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1778600715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778600715, "uuid": "e4f28837-5663-4d88-abb7-f3828bea4314", "comment": "Malware payload (ValleyRAT)", "value": "f0d695060176f8920457fc026b621e93", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778600715, "uuid": "d138b181-775e-4e31-a333-018f6035daae", "comment": "Malware payload (ValleyRAT)", "value": "d7c2fbd0015d33941aa0c2001ace11233ac0254ee3c526060e7cad48e5f705f3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778600715, "uuid": "4b83f48c-aa4b-448a-8a3f-e6c4ac5a2596", "comment": "Malware payload (ValleyRAT)", "value": "fb35f791809ab227b8eed4fc479e79d756c6da82", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778600715, "uuid": "4053af18-e3d9-4d62-9b7c-7b361d48a9ae", "comment": "Malware payload (ValleyRAT)", "value": "1bce68d04b3de42124761c0eab9d90c9f5981e41bc5021ef4bb423b247c37d51b83f57f3a61b6ea74a9fecad85080706", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778600715, "uuid": "c57522d3-41bc-41ab-b7a1-f13bd389f087", "value": "T12466AF116FC499BBCA13AB3C5912A06CB19E9C141BB1C3E3DEDFBDBA2C344514D28766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778600715, "uuid": "34d87f23-5696-4f46-b017-e0279b03464e", "value": "2906427f09ca80a891ca05cb0288033b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778600715, "uuid": "d22350d9-d5a9-40db-bde3-a46c290aa7a9", "value": "98304:IIBXj/fNFsLR0guwSlb2K3Wc2IjibriNWUdY70pEd+2MiV+UygQ:IAfs0gGbb3Wc274d7l8Fy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778600715, "uuid": "17d435a2-7967-4f60-919e-21403890d422", "value": 6675896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778600715, "uuid": "a030c367-8f06-4b84-805b-9ed9066cecb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778600715, "uuid": "d35537b5-45bc-458a-b2d2-afa782a15c7f", "value": "d7c2fbd0015d33941aa0c2001ace11233ac0254ee3c52.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae59f9db-4de6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778578858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578858, "uuid": "2bf90707-44e6-4695-92ad-e0a3fddbf1f6", "comment": "Malware payload", "value": "a2ad9af16151e118539447895a77f0cd", "object_relation": "md5", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578858, "uuid": "a35f92dd-2e53-4828-921e-ad9933a834a1", "comment": "Malware payload", "value": "d904260f11adbcca96bf0234fb45719bb79c526375ecbc99cb374d50364f8100", "object_relation": "sha256", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578858, "uuid": "94f7acd0-9143-4faf-8e32-413a6ccfe66b", "comment": "Malware payload", "value": "6ef86c8090028e04092fe3c74a2973606a1cad2b", "object_relation": "sha1", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578858, "uuid": "887193cd-fd86-4634-a8c8-d7058167be7d", "comment": "Malware payload", "value": "f4bfa05555573da3b8f7ad68165e843409f3b748b4713f3674e09e7ac465f4a0300ec2d7c409ac75d3310804334313a4", "object_relation": "sha3-384", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578858, "uuid": "cec90660-3560-4be4-84a5-c5856887621e", "value": "T14C318533DF6A54F5C38653D070E272CCA4AF424AC29B706410E89A8BF682F95455A327", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578858, "uuid": "f6f30f37-0e31-40f1-a718-21578011a250", "value": "24:BbnNn3cnpwzCpskgVvAz5qVsbxcF0cLwmLxdcTbuAKmAWFe0pWX0cLwmLamKjjtu:JZopXpsvvAtsSQtFIEmAWYMWXtWtPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778578858, "uuid": "8dc04502-2f4a-4769-808a-9f29f8b3b6a2", "value": 1787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778578858, "uuid": "26468cc9-7ef6-47ff-9d95-4dcf361e0b81", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578858, "uuid": "a618d67d-5630-40b3-a911-b020be9dbe97", "value": "d904260f11adbcca96bf0234fb45719bb79c526375ecbc99cb374d50364f8100.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6a7ba8-4e33-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778611708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611708, "uuid": "9a408531-6b0b-4df8-9399-f8135bf35077", "comment": "Malware payload", "value": "2d36014c028d86c3580a6ceb8237e601", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VileRansomware", "colour": "#FAA1F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611708, "uuid": "3a8f9aa7-659a-4553-b87c-46bb5dea6bad", "comment": "Malware payload", "value": "da8d89a25d0edc6186a9e70bca59e37a25b1f4ab84966ed1e4b9aa35d2c20601", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VileRansomware", "colour": "#FAA1F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611708, "uuid": "2832a9d2-0300-4f0e-ae64-e3e29be32085", "comment": "Malware payload", "value": "ebbeaa9bec4236bb95f7df853dfc60e1ee114b35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VileRansomware", "colour": "#FAA1F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611708, "uuid": "27cbbf94-0641-4b72-9d00-b87319aea568", "comment": "Malware payload", "value": "bbb69ca413fb6e0d1e352c9fdae1647f6cd1067d82d6b6459a62168625915c8d72360cbf8c82dd3025c5be39814be77a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VileRansomware", "colour": "#FAA1F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611708, "uuid": "95bcd93b-3365-4fc0-8e0f-dff99bf985f7", "value": "T1F5968C13EC6525E9C1ADA235CAB39253BB717C490B3223C72B90F2386E76BD06D79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611708, "uuid": "6d8fea08-a66e-4b0e-b29f-d558ce19f2a0", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611708, "uuid": "5caa5b17-939f-4277-a8d5-8f2dfb349c55", "value": "98304:eAq8oRMx8sT9dwumvBh8huTiETYesMWF9VLzzTO62Q0EwfisLkf:eIscx9MzK9VPfrpOiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778611708, "uuid": "19cb13da-10ce-4171-baf8-5d2a54dce1c4", "value": 9404416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778611708, "uuid": "793e8acc-9feb-442c-bb81-1c893a65d34d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611708, "uuid": "a05ffecc-95d6-47ab-8fb0-10a9faf34be4", "value": "da8d89a25d0edc6186a9e70bca59e37a25b1f4ab84966ed1e4b9aa35d2c20601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d9b4ab-4dde-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778575168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575168, "uuid": "ed307651-8af2-4c45-9041-5861b0f06c75", "comment": "Malware payload", "value": "99613b90e418ca2b9b614cb99e8427a3", "object_relation": "md5", "Tag": [ { "name": "11-0-30", "colour": "#876726", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575168, "uuid": "846bfc67-8238-472d-89c4-eec9d246ce37", "comment": "Malware payload", "value": "daa8a19f9cc2556d3f5484421a3d04f5c07ad993b2ae2275e5a1f0780e207131", "object_relation": "sha256", "Tag": [ { "name": "11-0-30", "colour": "#876726", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575168, "uuid": "567913eb-69a5-46c6-b5f5-ce0d06ebf11c", "comment": "Malware payload", "value": "d5b2d0a95d7c18e17078048cf618a56aca46de41", "object_relation": "sha1", "Tag": [ { "name": "11-0-30", "colour": "#876726", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575168, "uuid": "2f461e3c-a19b-4643-bfad-919012fee524", "comment": "Malware payload", "value": "59dcf18b6b48d00989576abe98b990e17096ee8e8fc40e25a9ca17852978b741a912ed1e94f46932fb97b29e66214b54", "object_relation": "sha3-384", "Tag": [ { "name": "11-0-30", "colour": "#876726", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575168, "uuid": "d53dc206-ed2e-49ee-afef-4c8e0bfbd9ca", "value": "T1B828331B404DC6F489D866E3AF67B67BB8A7CB71D3E4342E5A3E671F2151C400DA0E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575168, "uuid": "a3e1d25f-e350-4f89-bcce-f6881b0002c3", "value": "1572864:Pj0UyWmIBQO4q+LzSPZ4nBjBn5N1cEP9vqMiF2K6xO+ZWFiAx7mpkR+iIciH:P71mIBQO7KQZcjBn50EBiSWIc7/IciH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778575168, "uuid": "edeccde2-26c5-47f2-8da0-ef4f1bb71e9d", "value": 100649964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778575168, "uuid": "ec713e22-bb23-4697-a579-7b6d3dd06c09", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575168, "uuid": "03a69309-ce8b-4769-9150-49f446f861c0", "value": "JDownloader2Setup_windows-amd64_v11_0_30.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce2782c-4e42-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778618208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618208, "uuid": "1b9f7180-0507-492f-b781-6f4fd1a7adda", "comment": "Malware payload (Mirai)", "value": "acf45f02e13c2050000de12650d60922", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618208, "uuid": "80b68bea-bf2c-4439-bba5-d87813838e2e", "comment": "Malware payload (Mirai)", "value": "dadf243e75a6e6d232ab02a6ec16b36e2bf730812ab2900bf270e0c2774d43f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618208, "uuid": "858084d0-c0a7-47ff-bd94-26fcab925b92", "comment": "Malware payload (Mirai)", "value": "dcb815d83d62c5dee58c16787a7259194c3acffc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618208, "uuid": "21861446-631f-4c2c-8e69-cc0c78ca7b37", "comment": "Malware payload (Mirai)", "value": "d25e5b09fea123cdda00c567c6600aeb66c0ac1d44ba7150e70904df2366b680f121974722498dea9759d73d37f032fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618208, "uuid": "5abae615-4b50-4c74-ac39-73cebe71b8c1", "value": "T15543F1F4DAEE586092FD02B3EC52080F57F217F8937D3D2BE1412692BDB111EDA58992", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618208, "uuid": "787a20ca-6b7d-45fc-9ae6-5ad1ad15e77c", "value": "768:Jj3PanufxdHLLGK0wWcT/cnQ/ou6gMmT+PtwRu4KJqINOFXZwMW6Ob1G0hvhYcu2:Jz9JdH/Gw/T/cnQQF3ecp9WG1G8vo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778618208, "uuid": "5b1ad64a-7955-4650-ad15-57896853040b", "value": 59072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778618208, "uuid": "c5bc5a39-4267-4dcc-825d-81e4c4888ae0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618208, "uuid": "53231bf8-f012-4bb1-bf45-73ae36fc2b36", "value": "SecuriteInfo.com.Linux.Mirai.9833.10926.23042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12cd687e-4e39-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778614246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614246, "uuid": "41542349-2f0b-42f0-b64e-56fc6db3887e", "comment": "Malware payload (Mirai)", "value": "836681a29ee7a479789571e1bf4e19e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614246, "uuid": "21010d70-6c8e-4ab4-9973-e50638b95b6a", "comment": "Malware payload (Mirai)", "value": "db0d6a02fa1f8ee33187351a256fcefad967e8ed11ab1322e38ac51af7a9de0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614246, "uuid": "3968cb72-ca1e-4e8d-9743-c60b12cf9b99", "comment": "Malware payload (Mirai)", "value": "66229b1c2ac488d47c2d27c5dbd1cb7a115d8060", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614246, "uuid": "eb1a1281-b73a-4940-8975-8d195ff210ff", "comment": "Malware payload (Mirai)", "value": "0037968b093ae6099588215b48cd12f5a9ebb49cb39b7a844fda238dd8e910758a1dda1738d0ee186e3fdeb2c17606b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614246, "uuid": "09e31ecc-1aa9-43ff-9029-dae15d2bddb3", "value": "T13243F294922C0957EDE12263EC1C068BB79D24ACE231F1B359591DA4EBDE6C317EE0C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614246, "uuid": "b3ca635d-d0f3-4031-9177-de1341037b8e", "value": "768:C6AsvJtJS5lC6QyxEepJ316e8eJFNGxSIGIRQZ8RwSfzyi24WVhlta/1q12cicFj:csvJvSmNy9l826xxGAmkyi2ftaM4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778614246, "uuid": "aeb74022-e6e7-4fbf-b651-4adea11ba47e", "value": 59064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778614246, "uuid": "a23fa918-e1d3-4a17-8c15-3e337d983ac4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614246, "uuid": "18b54e1c-4d81-48b2-94a7-92c21814167d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f10b6f8-4ded-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778581598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581598, "uuid": "51870259-f2f2-424c-895f-46264f8d60bf", "comment": "Malware payload", "value": "3bdd821dfef2fd6ea58fd5fd7376e193", "object_relation": "md5", "Tag": [ { "name": "jicinvestments-monster", "colour": "#D62FD4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581598, "uuid": "f837c903-d34c-439d-bf69-d453121d0357", "comment": "Malware payload", "value": "db5d01c3d7806b12f10b8cd1a9b95b3084672a847b66ba11a785678eb2d7f034", "object_relation": "sha256", "Tag": [ { "name": "jicinvestments-monster", "colour": "#D62FD4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581598, "uuid": "0d4a3a6b-dd57-47bb-986f-b89d38036512", "comment": "Malware payload", "value": "c67ca64d83bd9f7a6b5ef40b7530380423979db2", "object_relation": "sha1", "Tag": [ { "name": "jicinvestments-monster", "colour": "#D62FD4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581598, "uuid": "58e36d76-9ee8-4d7f-8e33-783d75ea3d58", "comment": "Malware payload", "value": "dcd1a281f11c971c52b2833b85fdbc09a7696430057f1a3b6e397228ef46421aaf245ea291a88abcbcc2634b3dd1ef46", "object_relation": "sha3-384", "Tag": [ { "name": "jicinvestments-monster", "colour": "#D62FD4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581598, "uuid": "aa978f10-8a12-415a-84c1-a2af93f61a15", "value": "T1D22142A7224E0136DDF153B59C5096C2D70745AB810E77043DECA523AF72AFE43B9E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581598, "uuid": "1c6cb9c9-abfd-4c3b-ba27-8238882b2596", "value": "24:EwcY98VmiK2vL054XuAuZvJT0+KoIJIQNologCIRsBT:RcM8Qi7C4uZ10+KXJCSgdRsBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778581598, "uuid": "570d999a-5de6-4082-ba2d-6608590af027", "value": 1136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778581598, "uuid": "435cf0d9-baaf-47f3-a5ac-b0713dbf9759", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581598, "uuid": "bf4123aa-6b88-4952-b61f-36913815b699", "value": "db5d01c3d7806b12f10b8cd1a9b95b3084672a847b66ba11a785678eb2d7f034.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb8b03f-4e1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778601564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778601564, "uuid": "82f2c68e-52e9-4815-8337-8b76af661c0b", "comment": "Malware payload", "value": "1fe911e3a05f15764ea57c4e86d3e91f", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778601564, "uuid": "76696b0b-f513-4350-8802-73e9c44d2696", "comment": "Malware payload", "value": "dbd0d07ce0569aec3a2acb9ffa4dece9dc351eac16910e2f759fc55fff88ff55", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778601564, "uuid": "5792ca53-e118-4710-8351-f82a6dbafe7b", "comment": "Malware payload", "value": "9897dc771995383e6a64cf4448a1a62b610fdaf3", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778601564, "uuid": "475b0257-944a-4021-a1c2-a46746d8e938", "comment": "Malware payload", "value": "4c376c13f329ba7cf17a97106219fe7622208c3cba1cd8294abb214210de3b289cd7c3d1bbd0538c7c97f7e73083c558", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778601564, "uuid": "163ef814-ca6c-4d14-954e-e6fc02ae5a45", "value": "T185B092102560527ECF4FCE1A82D5C3214C2A301162B596A17A30862879446A9E26A559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778601564, "uuid": "5f574648-f68c-49c5-9283-8d3d63abd300", "value": "3:VSJJFIGFGMFI1oM3KAJJFId1sqPJH0cVERvBuIFjwMyHn:s8GFGMFI1R3Ks8zsO0cK+MyHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778601564, "uuid": "072186ec-6a4d-41ca-a001-1ba98ef0bcb9", "value": 117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778601564, "uuid": "da5cb05f-1a73-479e-a966-ff6ee79553f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778601564, "uuid": "ea48a2d8-d615-4653-9321-5d1845f41741", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241fab8a-4dde-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778575190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575190, "uuid": "beebbb6b-8aa9-4d64-92af-60bba400ac95", "comment": "Malware payload", "value": "83df1f9a42b0f04fb4ac7049a4e4d48e", "object_relation": "md5", "Tag": [ { "name": "21-0-10", "colour": "#7F6377", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575190, "uuid": "aa269d8d-8d2c-41d2-812b-0d17b50274d6", "comment": "Malware payload", "value": "dc92b9c36d4a0174c1101c3998d8a552f7e41e67ff3c5cb3286109855fb1977e", "object_relation": "sha256", "Tag": [ { "name": "21-0-10", "colour": "#7F6377", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575190, "uuid": "63cf741b-9eae-4655-bcad-356870825e5d", "comment": "Malware payload", "value": "152ca1d81af091fdec8c1b730279d9d92c50d551", "object_relation": "sha1", "Tag": [ { "name": "21-0-10", "colour": "#7F6377", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575190, "uuid": "00c5870d-caf5-44e0-8d25-e097c247e954", "comment": "Malware payload", "value": "d21d2e2453ecaf1b0e487b4a2aefe9c6c79de6a3953240a8761292fbb34ca377b0dee37428a0179a818391ba0a564246", "object_relation": "sha3-384", "Tag": [ { "name": "21-0-10", "colour": "#7F6377", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575190, "uuid": "3b03ec4d-48a4-4977-a510-9f71b311f422", "value": "T13B3833317958B295B8DD83D3AF7BB5FAECC6D3FB64B0721256B1A1A4068D8841F0113B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575190, "uuid": "24e502be-9262-4d5e-b30d-a4c682edccce", "value": "3145728:pu415zjdvZFrgZ24/59sSsbpyproCZy522KJ:p5lh65OFpyprPU22O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778575190, "uuid": "525fc671-eadb-4a63-8fbd-43d480780f0d", "value": 102778073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778575190, "uuid": "ec5b5cd0-9657-4586-814c-a8d52b272980", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575190, "uuid": "a1e90fc8-dca1-4265-a521-bbd0d301712a", "value": "JDownloader2Setup_windows-amd64_v21_0_10.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19917b17-4e10-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1778596648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778596648, "uuid": "991165c2-9751-46ea-8062-ea9627f05b18", "comment": "Malware payload (CountLoader)", "value": "bdb0a10682e0db3b20fd3127e2f211ee", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778596648, "uuid": "b867edd8-5df0-4146-bac0-6446de60f464", "comment": "Malware payload (CountLoader)", "value": "dd5bc1f3c56db9792affc212353942d18c89059f08d23c6626b67277a5ac4119", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778596648, "uuid": "2b3e32d3-5051-4c1b-9fde-09cce5290621", "comment": "Malware payload (CountLoader)", "value": "6658f04e924e9cfb9af07567815d5f559e1a3cd8", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778596648, "uuid": "d29eab44-57eb-4aa1-a65f-f65b99a9c534", "comment": "Malware payload (CountLoader)", "value": "155ef0282424bfdb24ef150ff8cd6d3c176d0f74135279477b6df86ed8237103e505ac8306307aa15bf0e472b8292696", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778596648, "uuid": "c6a658cf-4840-49da-bf70-9d5e5d9e0d1c", "value": "T100A61A11FEC640F3E1422B34E0AD77BF67296C4886395AABD9A07D1EE473B711833199", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778596648, "uuid": "290ecde3-d10e-4663-8126-a38f4618bc31", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778596648, "uuid": "4f1f4736-4411-41a9-b402-cf6270565ba2", "value": "49152:I9amjD+6mTH7Igbap71PtLr1m6mPmwG0bsu04GpMMMHo:EaUD+6mf8bLr1mJP0u04GpMMMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778596648, "uuid": "686172e7-8e8d-417c-934e-73fc83af7e79", "value": 10368512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778596648, "uuid": "b8c020a0-0b8e-4e5c-a5f2-81329b9457dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778596648, "uuid": "dabb07ce-33f7-4960-9f5d-2eafe3914731", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d71579-4dde-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778575146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575146, "uuid": "a2cf4ad4-8f5e-4f87-becb-afd68ae444ff", "comment": "Malware payload", "value": "d3b398a757b424f91e645985ade00516", "object_relation": "md5", "Tag": [ { "name": "11-0-29", "colour": "#7D90FC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575146, "uuid": "d3e73483-5a30-4b0f-b80b-94714ffc1fea", "comment": "Malware payload", "value": "de8b2bdfc61d63585329b8cfca2a012476b46387435410b995aeae5b502bd95e", "object_relation": "sha256", "Tag": [ { "name": "11-0-29", "colour": "#7D90FC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575146, "uuid": "2ce6f40e-cdd0-4eda-8440-7203a53729fd", "comment": "Malware payload", "value": "c5997e6a28a46041180780eb52842b668a65e4e2", "object_relation": "sha1", "Tag": [ { "name": "11-0-29", "colour": "#7D90FC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575146, "uuid": "e5bc7607-062c-4ca6-85c6-313428d08535", "comment": "Malware payload", "value": "b1380f456317a782dfae7fb57cdafa5cb3409f1aa2e728b12001660e5e4569a092626407b81660ea9b17da821271c3b4", "object_relation": "sha3-384", "Tag": [ { "name": "11-0-29", "colour": "#7D90FC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575146, "uuid": "1adde8e6-3ca1-44c8-a0d9-7c5310022d8a", "value": "T16018331C3F7EB7FDD8AC81391F33AACA49991F6D0754007B1DB2178A6B905A09DB046B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575146, "uuid": "4603454a-92ba-4355-8c05-175a5f312831", "value": "cebbab50025aad300d9290d50864f4ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575146, "uuid": "71d29734-98bb-43a9-a8f6-3447717a47a6", "value": "1572864:Pb2LmcWv8fxCPfAlErl4In8T1pO1jdedS9qFTJ1HloBWwYU3wqU:emXfsEb8T101jUsWTXFoVwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778575146, "uuid": "3efb0d90-6398-4b6b-8909-53bc62ac1ba5", "value": 87157760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778575146, "uuid": "05b6033d-cb93-4bcb-84dc-8d286b9cddb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575146, "uuid": "d36957cf-69a9-4813-a978-bfdb873eae66", "value": "JDownloader2Setup_windows-x86_v11_0_29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f5fbb5-4de8-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackShades)", "timestamp": 1778579495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778579495, "uuid": "347f5548-d88c-4300-a262-913b3adba85b", "comment": "Malware payload (BlackShades)", "value": "50731b702e6374207be1adb6586f8aeb", "object_relation": "md5", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778579495, "uuid": "793bd393-cc89-4245-aba3-810b55a8044f", "comment": "Malware payload (BlackShades)", "value": "decf4cea29ac723a049e3a698ceb3a5ef3770620bb194fcbf3785b6b11fd4b66", "object_relation": "sha256", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778579495, "uuid": "25b6d072-0674-450e-9fbd-393d157a21c3", "comment": "Malware payload (BlackShades)", "value": "322fcca26e55828c02b7faab71c93a95f4a82ee0", "object_relation": "sha1", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778579495, "uuid": "15f38c20-2245-498b-9b9b-833fa2c8ea53", "comment": "Malware payload (BlackShades)", "value": "b5fee16547c348c89bb60d1c29c62fa4e8c2078bc55f84d65dc4b279d639c219b75c14ec2b9b9e53dac798d909302844", "object_relation": "sha3-384", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778579495, "uuid": "03fa5fe0-37d8-4e13-9ba7-ccba16261a2c", "value": "T179358D2275D1F036D4B301725769AA715ABEBD310E319557A7C83ACE3A7C8C0AB3A317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778579495, "uuid": "698f6921-03f8-47d7-b443-cc7c825c7464", "value": "d94607e52ea4c2cdfc94e0d96c087fe7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778579495, "uuid": "7693f014-a2b6-4f58-a4f6-9a1489cdb435", "value": "12288:3qzcpVgUXzL0TTUKZHTNloEkOpnKgofuIwV6eAj0wZxxXMcEeB3paPcgmX:3qzcpKIL0TvZzNlNky0wVW0wZxTVgmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778579495, "uuid": "6428ef52-7ea8-46ef-bc06-fd47fb804d72", "value": 1120768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778579495, "uuid": "b8706f9b-bad4-4035-b48c-354b5f2e186f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778579495, "uuid": "5e519e02-fbc5-44ad-9842-6819b90d107f", "value": "duxfun.in.net.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55df6eb-4e15-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778599137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599137, "uuid": "cfad9173-78ab-4dfc-81d0-6ee7c0f2f54e", "comment": "Malware payload", "value": "b4db03a97a2e86d0e8c73bea2be2aa53", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599137, "uuid": "0e324352-5496-4d14-a8fd-61af6a707f64", "comment": "Malware payload", "value": "e1e985860d853b74d405d7024fd9c8df5e1605caa9d0e14284b7273056f9630f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599137, "uuid": "ebb27aa7-90cb-4823-a12a-afc2246bc2c5", "comment": "Malware payload", "value": "b4d75d6b4716dc453a16f14726900a4c88b0b8af", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599137, "uuid": "ae569a47-39e7-487c-9817-8e9c60ce798c", "comment": "Malware payload", "value": "3f8c5c6bf226d780f17da82b2abcb11653ee6a5924dca46dfc181d0b92b527d25887773902a482e9c0904c9b6d07c0d1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599137, "uuid": "df9579e9-35b0-4f99-a672-5bd826fe0592", "value": "T177926C0FB9518315D5C00474A5B2873FD6BA5476338454EFFBD88ACA1B682EAF83225F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599137, "uuid": "f16137b8-3768-4554-9414-15ea98764081", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599137, "uuid": "668defec-491e-4934-a59f-921910f1538d", "value": "384:9IkjLVlvadxqSDO5wtT0vu98t2r6H/Bgav8U9ciG:pqx3600G9oga0ULG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599137, "uuid": "10b111c3-b1a5-43b7-89ab-784becbae14d", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599137, "uuid": "1e29b02a-56b0-4768-8825-b4f83d0c73b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599137, "uuid": "c307cd6e-23a8-4827-a7da-5886f276e389", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf5ef12-4e17-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778599848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599848, "uuid": "2159ffcc-1290-4a9c-a50a-675dc313758f", "comment": "Malware payload (Mirai)", "value": "c6b95bc9232c923238d425e5c3e10388", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599848, "uuid": "82fdfa12-78f9-42ce-99e6-364bcc26437c", "comment": "Malware payload (Mirai)", "value": "e2599e664d42c2e5bd60b45aa676cc59ec350053821c101fc6d1c9a8ecb64859", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599848, "uuid": "89fb481c-c7a8-45bc-8ae1-460717374d32", "comment": "Malware payload (Mirai)", "value": "3e60eee275a4fceb177e215ac296f288f7f5d69c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599848, "uuid": "bbca7aae-909f-4bef-9431-d15fcc6df308", "comment": "Malware payload (Mirai)", "value": "419741da975ffad9871880e7e647e5d950280bb2a37085c3fdce8e6c320ec120c23d070fc5240db612dea2a0e33a433f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599848, "uuid": "6e882748-962b-457c-af26-d668bb4b0a65", "value": "T1B8D4AE527BF22225D1905638CB62C360B747A7A954E4070F9F60CECFEF562711A86CFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599848, "uuid": "c89276fb-aa5a-4f62-94cc-eed7edb2ff80", "value": "12288:c+BcNBzBgIk/K9GsPFI7WMdoA+poMXCgCzhyP4ZBTs5uh0vz:sXVHAsPFnH4zv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599848, "uuid": "12af305f-e3d6-47dc-9f5a-ce5ccee0b0f4", "value": 634200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599848, "uuid": "31a5adb8-db54-438e-bf86-324adf64db96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599848, "uuid": "3f800c00-cce8-430a-bb83-0e3d8456806a", "value": "3atoNational.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2637d79-4dca-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1778566812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778566812, "uuid": "de627926-8bcc-4c7d-88cd-83ee7870df16", "comment": "Malware payload (NetSupport)", "value": "cb04f21f53d0cfbf576070268b8a8719", "object_relation": "md5", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "jpgomd-com", "colour": "#EF52AD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pgrsv-com", "colour": "#2ADE9E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778566812, "uuid": "1e1fb68a-a0bd-4c12-88b0-89eda03a5244", "comment": "Malware payload (NetSupport)", "value": "e28bc04a6fab575541b384eb10794fb2f581a0e731f3236cab97009096c7a0ec", "object_relation": "sha256", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "jpgomd-com", "colour": "#EF52AD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pgrsv-com", "colour": "#2ADE9E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778566812, "uuid": "683ea6e4-60ce-4eeb-80af-a16ef41c5fd3", "comment": "Malware payload (NetSupport)", "value": "b71d927eb977f5b0b1c9ff5413cca9440877d6fa", "object_relation": "sha1", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "jpgomd-com", "colour": "#EF52AD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pgrsv-com", "colour": "#2ADE9E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778566812, "uuid": "671cf6ac-e79b-4ddf-816b-3263724c6b1d", "comment": "Malware payload (NetSupport)", "value": "35b8eb019e4fcfbc7ff67bb1acc02194bd28df4b778b4b3bef70484fe1d3f19b80291f77100daea1ded5c839ba4716b5", "object_relation": "sha3-384", "Tag": [ { "name": "45-227-254-10", "colour": "#0C80C3", "exportable": true, "hide_tag": false }, { "name": "jpgomd-com", "colour": "#EF52AD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pgrsv-com", "colour": "#2ADE9E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778566812, "uuid": "d2f0cb72-0185-4934-966a-3a5442a26baa", "value": "T105A5334A34B9EBB3D69252B1855D87BD2885FC146E340F294DEEBA3E0EF6555203CF20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778566812, "uuid": "23f39dda-9fa0-451b-be18-02cbf88c06c4", "value": "49152:J7Wf/rx7DIR2rEf+t8X3XNKznZbEbyyqJm9wYh5XyFDJNbUomn:J7Wf/r9s+OnNOnt13B3BDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778566812, "uuid": "ae91f24d-94c9-467c-89c8-78054ce106d7", "value": 2260992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778566812, "uuid": "46fdac75-9d28-43bd-86da-b1e04ad3658d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778566812, "uuid": "1af9c790-730f-4758-b986-b9f3b5310d46", "value": "installer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae2ba38-4de0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778576356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778576356, "uuid": "c830e08d-c878-4d00-9e6f-9b194c055887", "comment": "Malware payload", "value": "2e4b8542fe00ebbceb63301c19775ef4", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778576356, "uuid": "d1312662-dcde-4e16-993a-56b843ca0a7b", "comment": "Malware payload", "value": "e3a8ffb60de7d466a1b442446a9dc1ab379d8031b30b8ca7483985a15f27b0b3", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778576356, "uuid": "a1106acf-9aa5-4770-8327-ab04ec0289df", "comment": "Malware payload", "value": "d7b78b0e77fe563064ccc7a6b02e7ccefeb49237", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778576356, "uuid": "6476ba18-fbbc-4ff1-966a-ed9c77cdb401", "comment": "Malware payload", "value": "7b34ca7676dcdf37c22148d75e4ff948c59407720b8c40ab929c9bdb22f3d8fde4062cb2c5e602b6a61cf12750179f91", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778576356, "uuid": "1d71de4a-1f64-477a-ae7c-816058a5af45", "value": "T118446DB73795E97A0472E116F331C4824515CE3AA1E61C9E3C760346EAE0E12CF9E5EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778576356, "uuid": "507af801-ac50-4f81-9f1f-b4ff41fd0252", "value": "96:3XSXSXSXSXSXSXSXSXSXSXSXSXSXSXSXSXSXSXSXSXSXSXSXSXSXSXSXSXSXSXSq:FpyhtPBw1NzAtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778576356, "uuid": "0c4bc4bd-72cd-4d4a-81a0-2d6c62a9ee94", "value": 274355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778576356, "uuid": "f8d09459-6b84-4312-9b83-369a4c764c7d", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778576356, "uuid": "37c51dbc-9711-4482-9fc8-bb59df62df61", "value": "goodtimetowintheworld.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c95065-4e43-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778618542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618542, "uuid": "1ac51a10-7526-4739-91ad-15b693ac3b23", "comment": "Malware payload", "value": "d9bab69cbd9682c297109f80b4417333", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618542, "uuid": "3dbe8a6a-3713-4547-aa8e-9b6b500a8fda", "comment": "Malware payload", "value": "e3b59566fe98cc2e81ab5f517f370931b5e96371be2eb731f5aab3de1c1c0214", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618542, "uuid": "098fcacf-20c4-4715-92b0-27fc5e176114", "comment": "Malware payload", "value": "3cb53b22d241dca9aeb66a096b2bb7245ee1e74c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618542, "uuid": "311b494b-5349-40a5-bb9d-143b3ad41964", "comment": "Malware payload", "value": "83d96dc90847c3bf6057a95df6bb8b476bcea012d35cd32f54ac99b0324b75b6262b68e50baf37ba090dd5bf90b0adb9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618542, "uuid": "e5c9fa4b-af95-42af-bb2a-e63fe8d86f6f", "value": "T1EEC5AE65F3C822D9D82BD639CB459323D6B278124772A0CF069A171A1F7BED19B3F601", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618542, "uuid": "eadc1646-f1c0-4de2-8357-cef94ded7849", "value": "1adc8c0c6944a18ca6c02a00bc42b28a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618542, "uuid": "34a985d7-a71e-4845-a9c3-7f0505fd02f6", "value": "49152:JtHqrG7vnORYJBHzTqe3dzblhq47a0XA2lXwvUmHN6yR/sNvsa2kApVlP:xvhJpDhq47aS0HN6yR/sNvsa2kApVlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778618542, "uuid": "3c223d2f-40b4-4f00-903d-e5e7ede1fda3", "value": 2522112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778618542, "uuid": "b78579e1-041b-4dbc-8ec5-dd2f9d7f762d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618542, "uuid": "b3730d12-4291-47e6-a9b8-9def46ee5532", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa5bd3f-4de6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778578906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578906, "uuid": "e50cb56e-5b95-443c-b7ac-b95acd65cd64", "comment": "Malware payload", "value": "8f21152c46f9ce596c458637eb94a827", "object_relation": "md5", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578906, "uuid": "eab95a04-eb53-4b72-8360-f5c38882182e", "comment": "Malware payload", "value": "e40d228bce67e2dd514b3cbebd49f42eb6609d5b247e7cc4c2473febdd471f02", "object_relation": "sha256", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578906, "uuid": "674724f0-3684-406f-99e0-1bd7d2111fe5", "comment": "Malware payload", "value": "054bd68c453d932448c040bf65615ff6e38046e8", "object_relation": "sha1", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778578906, "uuid": "7824b016-fdc7-43d9-babb-c78f2d68a29f", "comment": "Malware payload", "value": "6618fb40145130c354e0a6e362b789879bea7ffca028a45be01a84a6b71fffd3428f16125d3e35df474666e6d702114e", "object_relation": "sha3-384", "Tag": [ { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578906, "uuid": "d22065d1-c58f-40b1-ab1b-b043a965aa79", "value": "T11A82D01EBD6EC666AFA52E50CB637F3556C0B79835DC77299305E3E0109CB448A4803F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578906, "uuid": "5d368652-f210-467e-a848-24e3bfc8650c", "value": "384:JIiCJ4/56/7y1Z9rx5kcrJAxo/Ge1VeQQ2kwHqWKFVZgWWyzPPXWUhlt:X+4/au1zxSURRVS2FHUFVZgGzX3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778578906, "uuid": "e5f40dae-2d50-4feb-becc-e07e98a10eb8", "value": 18395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778578906, "uuid": "e2b07bc8-3b8e-4680-9c84-c83684376473", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778578906, "uuid": "6b9e799a-890c-4db7-bf8e-6e0d490a347c", "value": "e40d228bce67e2dd514b3cbebd49f42eb6609d5b247e7cc4c2473febdd471f02.gzip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b557991-4e23-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778604999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778604999, "uuid": "cd166cee-5b1b-4140-984c-fa99c8f8dd87", "comment": "Malware payload", "value": "dbea99565e29b2f1f39892ce2855ec73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778604999, "uuid": "bc1aa914-ffad-44a1-b604-5b772c1a5769", "comment": "Malware payload", "value": "e463f87a0c098ff8bcbc4c262e9eddf3dea51148d2ba9d12c64addb21e2ff978", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778604999, "uuid": "0ed64f4f-c007-4c93-92a4-9d886e606053", "comment": "Malware payload", "value": "be549d82dc39e2d0733c9b40dbf8bb0949494834", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778604999, "uuid": "cf411012-acc6-4d7e-84c3-b454e1e04c27", "comment": "Malware payload", "value": "3d59caa2ab5909b3e5acd8ef0d112628f73843a527a67a09b2d2583c6cccd4488035c633328bd751cf41aa4c072b92cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778604999, "uuid": "c31067f5-ebec-4d6e-af67-176d85969165", "value": "T16F2512681663D517C99003358E71F7B816BD1FCEF842E157AFE8AD9FB62BB081C18192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778604999, "uuid": "bd0b3fcf-3e4e-49c7-a9f2-7af9a4701a92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778604999, "uuid": "f7c1f9ba-d1db-40ca-8adf-e08b1f160955", "value": "12288:cZIrKemgnnPWlYrriBjvvvTqagWQyA50UC/u3Xg/ATDnFMEzWRB55MYZLb0HT0M7:uIbmJlOi3yWM0xuKAtMYavOgVnTW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778604999, "uuid": "bcba7974-2c32-4b0e-b9d7-4eb68de47ee8", "value": 991232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778604999, "uuid": "dc96d4e3-c111-4f98-be35-73d44c74f9bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778604999, "uuid": "a4daf0e8-d2eb-4b20-ba15-70e7350527c1", "value": "RFQ S04-SQ26050120.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a6e53f-4dde-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778575220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575220, "uuid": "c57f151d-0c65-4dfb-aec0-37619c09e382", "comment": "Malware payload", "value": "ec99e2a51151117876e67635ed4e575d", "object_relation": "md5", "Tag": [ { "name": "17-0-17", "colour": "#7BBC4C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575220, "uuid": "62ac414e-ba59-4ff5-8eb4-5215a56320bf", "comment": "Malware payload", "value": "e4a20f746b7dd19b8d9601b884e67c8166ea9676b917adea6833b695ba13de16", "object_relation": "sha256", "Tag": [ { "name": "17-0-17", "colour": "#7BBC4C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575220, "uuid": "2e23be5c-92ae-481d-b85a-0091bdfb62b5", "comment": "Malware payload", "value": "ea6ca6e83692483c677fd4211e2b1744446cd325", "object_relation": "sha1", "Tag": [ { "name": "17-0-17", "colour": "#7BBC4C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778575220, "uuid": "f7d90a69-bab6-4e50-a34b-7911b57f0af4", "comment": "Malware payload", "value": "f2a62f5d2939097c551d81bfaef60abc3b0fceccc58779e059988855fda933d124c9e7988ce2c9b7946e5f92d3b423a8", "object_relation": "sha3-384", "Tag": [ { "name": "17-0-17", "colour": "#7BBC4C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JDownloader2Setup", "colour": "#133AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575220, "uuid": "7e42e010-73af-413a-af6e-004602856455", "value": "T17C18331C3F3DF2FDD9AC45382B73A68B089D1F2C575400BA1DB117CA6B915A09DB886B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575220, "uuid": "cf5048f2-f9aa-4f6e-b404-ac6576f37b3f", "value": "cebbab50025aad300d9290d50864f4ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575220, "uuid": "dc712765-5418-47a7-a9a5-21838a3f47a7", "value": "1572864:O6x+Qhuw190mT8UMuaki5JoDRwT9K2EKS9qFTJ1HloBWwYU3wq:3x+Qn19zMuaXg8tE7WTXFoVwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778575220, "uuid": "1e79fd92-148b-46da-a02e-053bac8aef18", "value": 86576128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778575220, "uuid": "0f31ceec-dc24-4c83-a6c2-56222d545276", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778575220, "uuid": "954585a8-cf8a-4196-8697-c3cfb6649941", "value": "JDownloader2Setup_windows-x86_v17_0_17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927ab677-4e17-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778599857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599857, "uuid": "b675145a-8dfc-4f53-807f-ba248bdeffde", "comment": "Malware payload (Mirai)", "value": "183da94fd317800dd7cd24d86d4d42b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599857, "uuid": "baf70f8c-fdf3-41f4-b047-7c98852fde12", "comment": "Malware payload (Mirai)", "value": "e5133eb822cb048c9dad307c3c51856979264eb1e6300fc7aa3f4db12f37d1cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599857, "uuid": "b10a28aa-5f3d-46f7-84e0-ad629cfd8cea", "comment": "Malware payload (Mirai)", "value": "aa4443aaa9db499b2c7e728e9ba1a4981863c6ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599857, "uuid": "62292cb6-97e4-4fac-9a04-96440bed51a4", "comment": "Malware payload (Mirai)", "value": "cada1de7da8e3e9512a039eef975a4bc62ffcc2f91e14ce7d5b61ae810281e7cc382ad38166a3f56fae8c48640b1f9bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599857, "uuid": "7a455b6d-5061-40ee-9a33-a078d23d853e", "value": "T159158D2EB2B3B5BCE00BC03457DBCAA15535F07522212DBB26C4DA353D6ADE11369B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599857, "uuid": "2097915f-0e88-4741-a642-c4e152667c5e", "value": "12288:jWUF6xNgUnAx+6Id4HjOSN3+SOlmE/GtOy0W0emOb85yuqoqEzayUH+cdPHX:yUwxNgUAxTTObj1zemP5yD5+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599857, "uuid": "fcda289f-3382-42aa-8667-9a19ded0242d", "value": 957256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599857, "uuid": "d5cd04fc-9c07-4bbe-9141-b9e45dbe15b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599857, "uuid": "09e6e947-3d05-43a8-a490-e3df08ffcd48", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20213550-4e16-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778599236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599236, "uuid": "a2a0b3ee-ebf6-4fd3-901a-ca30a35b74c8", "comment": "Malware payload", "value": "d4795ce0a47450a5100c9b168f0223a7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599236, "uuid": "c5e3284b-2823-4d7e-a8c4-c009d89a20b2", "comment": "Malware payload", "value": "e6ea57f23dce9a11660bce743a2a52da539c855b7a91a92c21101f27f19152ce", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599236, "uuid": "db132917-c623-4309-bc9b-1f0beb262c96", "comment": "Malware payload", "value": "9ed204bd895edc5e5e82ae96874f9b797807e6dc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599236, "uuid": "cc1724f0-db78-4f11-82d2-8c5844af9edd", "comment": "Malware payload", "value": "80358f66b52699c45f7edd3f3d94d8b050d60700eb9b9d30504b2a9627075bd2c40feca9183130f62931ff571ad8d52a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599236, "uuid": "38db1714-cac4-46d3-9b8a-8294bac274c2", "value": "T1C8926C0FB9554319D4C00434A1B2877BD6BA9876338054EFFBD88ACA1B682DAF83215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599236, "uuid": "deb4cea6-b41c-4ed4-9159-f7b157fe2fe6", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599236, "uuid": "68981ac8-dc67-4fe5-aea1-8bd6225887e1", "value": "384:dIkj7VlvadxaizO5wxDSZvu98t2rFJ/Bwav8U9cbG:Jax3qAUG9o5a0U2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599236, "uuid": "851f3d4e-6559-477c-b3dd-7a09bf4491d8", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599236, "uuid": "13642758-f5e8-4876-bd7d-0d1bc7b1a044", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599236, "uuid": "fc208600-a827-4621-8b82-14c923ac3cea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662fcc43-4e42-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778618251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618251, "uuid": "8f4268a1-4f5e-4484-a4b1-f3dac1d2b8d5", "comment": "Malware payload (Mirai)", "value": "6dbfa8fb7430d5962fd8ed5192a40b9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618251, "uuid": "a72625e9-cdcf-4ee4-babe-3f801108031c", "comment": "Malware payload (Mirai)", "value": "e7ce663484ce6e9cc290956abe0c527527a304cef57b52a6064c060ee310df3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618251, "uuid": "66a48af9-7e98-4ab1-a3c2-f2d57188860c", "comment": "Malware payload (Mirai)", "value": "a4a9c03b381d92f055f4db6b43cd2ebab4ac6e63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778618251, "uuid": "76b79c22-d2cb-480e-a934-e415ee41e11c", "comment": "Malware payload (Mirai)", "value": "688c4e007154e61edf63960f8f1825d9419423c92b135ae4ee22bbedacf16f707fc588df082df8050dda33bf62be4d6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618251, "uuid": "287b7703-0b93-4a5e-b7e1-036e95b54bf4", "value": "T1AB24A71E6E229F7EF368873047B78A35A76933D626E0D644D1ACD1105F2039E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618251, "uuid": "998f0398-43c9-4d39-82d0-fd69b59ab2ff", "value": "3072:wPTadiAl4/U4aRySrJz/cU9PS9yySo6HIk+f7JlyKR:wPWdiAm/U4agSFfcIyGHC7J4KR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778618251, "uuid": "35c706a5-b5f5-434d-87f8-2e4eae15ac46", "value": 217084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778618251, "uuid": "5ddb8222-b623-4468-b04e-3347ada5c725", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778618251, "uuid": "89a07f95-b8dc-4c3c-96d2-292a11300c39", "value": "SecuriteInfo.com.Linux.Mirai.9833.21227.15231", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7680e22-4de3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778577692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577692, "uuid": "17f98f08-0737-4876-849c-de65af099566", "comment": "Malware payload", "value": "a08817d5af51c0b39a8ae4ed2b7858c4", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577692, "uuid": "d48397ca-c911-443f-9d4e-24d823aab518", "comment": "Malware payload", "value": "e82e7e258675ae77b5f44de8b67adec0b50572cbef76e96a665961be72c6b02e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577692, "uuid": "4bbb3cfa-5f6b-431d-9810-36ed47a5669a", "comment": "Malware payload", "value": "2e571733dc0c81a38e1822455c182fbc473823da", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577692, "uuid": "a29e42ff-d933-43d8-98a5-cb0309a1accf", "comment": "Malware payload", "value": "6dc0970d5e247e0dc88eea01f87a4dadbfa88e3971676402e5c7cb60d6624c671dd2b8c49f712b5ad82ddfb6358cecf3", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577692, "uuid": "7c1f9a35-9180-410b-82ae-92c2da994aaf", "value": "T16235F1428BBB2BDE1D555ECD486F6E0A49CC5D323C12CCF6C9DF244742293D25AA292F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577692, "uuid": "f5573cfb-2910-49df-83d5-dbf7b8d3a04d", "value": "24576:8aMDyrZqd1iDLiDwOiDw6iDwphHiDwOiDwjMDyrZqd1iDwx:LrZpykNkBkp8kNkxrZpkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778577692, "uuid": "fa53893a-1dc9-4a4b-89c1-d81195d7692b", "value": 1158344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778577692, "uuid": "6dc7d55c-3b2d-4fa8-8b7f-1447bfda3cec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577692, "uuid": "ed6aab64-2792-4f75-8bb6-2d4b0438f42b", "value": "u-p.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2459bcaa-4e33-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778611698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611698, "uuid": "6730d6c4-00c8-455a-a6fc-ddf989d05dea", "comment": "Malware payload", "value": "facff72b6a876d605b1854be16f21d44", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "KeshXrdStealer", "colour": "#5AF399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611698, "uuid": "031c8308-cffd-4e07-8be8-a7fa3f086e37", "comment": "Malware payload", "value": "e87df996786ff1613b8550abf66de6456faaf7e1a26e9217cd17a2f5a6caad50", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "KeshXrdStealer", "colour": "#5AF399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611698, "uuid": "ab1e40d5-d931-4000-b6c1-5baa255ef233", "comment": "Malware payload", "value": "2df125d457121e46323ab36f5a60d3aa6ad48972", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "KeshXrdStealer", "colour": "#5AF399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778611698, "uuid": "b4c8fc19-e12f-4834-827c-a49104deb1db", "comment": "Malware payload", "value": "ec3157bdc6a18781e7bbf70c8fcacf8773352afaf1895e6e2fe4454ac176e8fcfb0f6feddba83a81f72f62d55c1ca7fe", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "KeshXrdStealer", "colour": "#5AF399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611698, "uuid": "3273ddad-fba6-41cc-86a7-ed6d6fcd8d5e", "value": "T14375F119E7E805E9E1FBD678C8224506C772F80A0B31EB8F079959D91F337909D39B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611698, "uuid": "fb2e5d2a-70c5-4c14-8227-884a61f89eef", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611698, "uuid": "c6669ffd-3df6-4aec-845d-e07a8a2e925d", "value": "49152:b8t85ftfAu4+hgfAxPOxJvROaYR86unXjkv:au4+AAGbvROaYyFnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778611698, "uuid": "9b793d71-7509-49cb-98a3-269f1623f74f", "value": 1632768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778611698, "uuid": "964604c4-90f0-41d8-b1f7-c65ea8d9e82d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778611698, "uuid": "ca4509e4-04b6-46bc-84c8-ebb29622adce", "value": "e87df996786ff1613b8550abf66de6456faaf7e1a26e9217cd17a2f5a6caad50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1a9a96-4df1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778583366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583366, "uuid": "18cf3085-6b76-4840-9993-000cef8adeb3", "comment": "Malware payload", "value": "5d255681c4356a11abbd4a519e014afe", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583366, "uuid": "69e61f82-f6b2-411e-ab8d-0bfec4dbec03", "comment": "Malware payload", "value": "e8c5afa1c70e36dc935cdd87bfdc2211258d7135384bbc665c4777315349e0a4", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583366, "uuid": "376fe19a-4e10-4435-b412-c1f6fce8c058", "comment": "Malware payload", "value": "4f8a4681151afffaac6526bfe890f8704998c6f6", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583366, "uuid": "d64e4e89-23ad-4d33-a422-11203a99b894", "comment": "Malware payload", "value": "0aa17571852dc2fa57bc81ec7dfd8b1b2fc4096251afdd5eee26c01581b462c79a890aa6a0d2725458f40f19dd14200c", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778583366, "uuid": "bac7f360-a7a3-4d25-b3fc-cf4e0849c2e3", "value": "T1754533E7669BD3BEE9E076F22C38789611C018171815BBF61E40CE286E55E32F316B08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778583366, "uuid": "0c6e6676-03d4-49ed-8110-361572535308", "value": "24576:SV+907JI8vs7+gpfMz7ZvJIWatut9tsHy7O5cSTKVUOI/HWWN+X2g/:J907JIqs7lpWnmE/snT2UhHWHb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778583366, "uuid": "403d85b4-b9ce-4845-9a3e-8a49ffca542c", "value": 1277028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778583366, "uuid": "d9d94e5a-8a18-4813-941c-c77a4bea0d6d", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778583366, "uuid": "f52dce4b-3694-47ce-ac17-02ed8350ccc5", "value": "react-router-1.169.8.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff347398-4de7-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackShades)", "timestamp": 1778579423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778579423, "uuid": "0da56e1a-7324-4c54-a016-7195439e047f", "comment": "Malware payload (BlackShades)", "value": "39aca27a8cb300e93ec342d38ca8d3ee", "object_relation": "md5", "Tag": [ { "name": "BabylonRAT", "colour": "#7890FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778579423, "uuid": "00456271-3ca5-4450-997d-7a604ed5edd6", "comment": "Malware payload (BlackShades)", "value": "e9a8601a49cc030d4fedc70be3e7f3aeb47af4660ccba49eb3f8510e5eac4507", "object_relation": "sha256", "Tag": [ { "name": "BabylonRAT", "colour": "#7890FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778579423, "uuid": "0b0058d3-13e6-405e-b639-390675ca4422", "comment": "Malware payload (BlackShades)", "value": "04ed3fb224d31898561d9fb39845446cb6e978f1", "object_relation": "sha1", "Tag": [ { "name": "BabylonRAT", "colour": "#7890FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778579423, "uuid": "b3a095a3-914d-47c9-a903-0f9933a689a5", "comment": "Malware payload (BlackShades)", "value": "697e07bf03b60c33f4361dd04e8e662f7cf90518967c6763617500b461366c064eaeca03f36c740a3d77e2538ebe6b13", "object_relation": "sha3-384", "Tag": [ { "name": "BabylonRAT", "colour": "#7890FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778579423, "uuid": "5cede731-35a2-405e-aa05-46752506efbb", "value": "T126F4012035C4F41BD95EAAB18F09F4B854653C595E8A4BA3B6CC77EF30BEDA04878394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778579423, "uuid": "67dbead9-5bd6-4107-a1cb-f94f74c5b94f", "value": "18aee7cc80e48017bb06b13550617d1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778579423, "uuid": "6cc9fc01-d963-47ce-941a-34c698f2c6b3", "value": "12288:GLdcfxaeM6fy/KaVUtgKkTZ73coU5C/y8:ukIZGSAtgN+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778579423, "uuid": "498ae80b-d53c-48b8-a8ed-29a61b62f30b", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778579423, "uuid": "ed4ab68d-eef8-41ad-b9e9-8e55b0a62b0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778579423, "uuid": "4a8cc8a7-687f-41a6-982c-5514c98f2685", "value": "duxfun.in.net.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc9a1f7-4e0b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778594747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778594747, "uuid": "33d12322-03c1-4fc0-a619-5e1d2e8a8576", "comment": "Malware payload (Mirai)", "value": "f902f5c308016d1e5b39ee9f20691f64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778594747, "uuid": "112316d9-b66c-48fe-a9cd-930bb411dcc8", "comment": "Malware payload (Mirai)", "value": "ea0f1019ac6eceb2e0522aff7eb1523614ad75b5b096397beb8b7b4b3de46622", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778594747, "uuid": "cea37d26-edd9-4c96-9c44-57ed0cec3ff7", "comment": "Malware payload (Mirai)", "value": "495c54d749312e228cf3cd5324bc75da8480c97f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778594747, "uuid": "657bb3db-03e2-423f-bf61-dd2e389eeff0", "comment": "Malware payload (Mirai)", "value": "bd072abdc4d58e66eabff89d1feb4af1485ec7c4c97281aa672fc480d801e12287c0541bf60c91792a85deb21b71b5f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778594747, "uuid": "6995129c-a59a-4655-965c-8c19ffeeea4a", "value": "T18144E91A3E228F7FF26D877007F38A319769769617E2D644E26CD6101F2438D641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778594747, "uuid": "0c584b73-2a05-4250-835a-55da971a1f73", "value": "6144:eqhNLGdE4mRHaxx7eFkhG8y8U1hWF5NqohWUkzn7MwA0:ewNLORmoxfy8U1hWF5NqohWUkzn7MwA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778594747, "uuid": "e2b52fb9-4060-4202-af5a-7f6ef0066566", "value": 257319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778594747, "uuid": "036cce50-ee17-40ac-bd2e-6c49de50884b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778594747, "uuid": "29205e09-380b-4d92-8c09-cb22fc2c7821", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74046ee8-4def-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778582626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582626, "uuid": "b2fe7ac9-ff46-4c65-af70-34849befd7c2", "comment": "Malware payload", "value": "ed9e80087326c349fbb90f2e90c5a691", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582626, "uuid": "681cc636-84c6-44e5-a837-23bc103d6e60", "comment": "Malware payload", "value": "eab7964658dd6ad28cb581d979837cfbf4690c582e0c507e965060defbb89d1b", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582626, "uuid": "3e63426d-6af6-4aeb-b56a-4495080ea014", "comment": "Malware payload", "value": "22e2b89a24e560885a7260f726acada9c170a680", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582626, "uuid": "9b127e4d-6c30-40a4-8cae-a3f2cfe4204a", "comment": "Malware payload", "value": "baa9163692824fe0c54bcce6b431780c5639b0fbff1c81015934763258328cd7c5af9e2593660a58720e43b97b4e15e6", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582626, "uuid": "d5615971-8017-41e2-b0ee-20fc8a5bd4d1", "value": "T1B0B2D009C25AB96BCFD078795FB2DCC3416D0EEA2212BBB5171831DEEC50384E632B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582626, "uuid": "8d8068a0-b914-48d7-93ea-fc4faee1c917", "value": "768:LhMJ/5qnPtk18rpPoAFMlmgmpB4MGKaApwFjvrr:LWJBqnG1QoAJBPzwFTrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778582626, "uuid": "d0224d55-f1cd-4bc2-8715-bc853597a645", "value": 25164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778582626, "uuid": "a68431f0-72e5-45bb-8424-9b878664743a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582626, "uuid": "2a28c156-2360-438b-86e8-d1dd21b0da65", "value": "transformers.pyz.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd27146-4dec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778581513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581513, "uuid": "3a61fb09-43cb-4a20-bd18-2cc9e62243b4", "comment": "Malware payload", "value": "be45df412ca9fa755320edd70ac5ac32", "object_relation": "md5", "Tag": [ { "name": "jicinvestments-monster", "colour": "#D62FD4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581513, "uuid": "6cc658d3-1b2e-482d-9643-275a7ad996bd", "comment": "Malware payload", "value": "ecdf8e500103f1ac5daa01f3bed32e52a4eba77aad941f19273525e103aca549", "object_relation": "sha256", "Tag": [ { "name": "jicinvestments-monster", "colour": "#D62FD4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581513, "uuid": "3c4c86b7-7c0e-4b2c-acdf-7b23f87d246c", "comment": "Malware payload", "value": "5fa43f52f10b9151a08c5819b160e5b1a9c86f9e", "object_relation": "sha1", "Tag": [ { "name": "jicinvestments-monster", "colour": "#D62FD4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581513, "uuid": "5bf89d87-610f-4299-a04e-625225e1eeaf", "comment": "Malware payload", "value": "f76785ec1b3606b3d739b5442c3f56751bcd618c584e1d75b220c8304ec84d6fa42aa088869d4c736a0ec14a01f98192", "object_relation": "sha3-384", "Tag": [ { "name": "jicinvestments-monster", "colour": "#D62FD4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581513, "uuid": "67691e37-f865-4ea2-957a-10e10c9e3bcf", "value": "T14F41C6FF759478C7002C8127E2D1CE39267B62F95C9B9CDC0C64B64A1A16B04FA66C49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581513, "uuid": "68d81aac-a41d-485b-9e25-eb96f6dae3e0", "value": "48:zSvekXDhJkuPMf8VLSInAtoHiddWLQOIGnSO8iMzDXQVQxJ:zBkX9vVLJAqC72QUnvbM3QVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778581513, "uuid": "a7094374-2bb1-49f1-9b1f-05c9295537f6", "value": 2164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778581513, "uuid": "41ba7020-5bde-4caa-8c33-2b14f9ab073d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581513, "uuid": "cce8d0b1-8534-45a5-a2fe-08b599a8e070", "value": "ecdf8e500103f1ac5daa01f3bed32e52a4eba77aad941f19273525e103aca549.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d79fa8-4e2f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778609932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778609932, "uuid": "faf7e27f-a749-4bbf-871c-0b786a6b6b17", "comment": "Malware payload", "value": "2e7017cb5cbf40c2f5c794922c8b9c88", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778609932, "uuid": "221585c7-0413-484f-8930-2e6b9511139e", "comment": "Malware payload", "value": "ee3d27c0299ae0923ba77648cb50fd134edd9ba787a18988a4d1ce709aa23aa3", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778609932, "uuid": "c90e9fb4-7fd1-4ed6-be05-9a3308e9d775", "comment": "Malware payload", "value": "cc109253431a6d24c1381e37efb8191c99ed4096", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778609932, "uuid": "ccd7930a-5c68-4edc-a7e1-a64af3f7d507", "comment": "Malware payload", "value": "32a33fdb2942670919e1eba80d0c4b30c720661ecc2dc654cc40e9acec90386ef1cd62faa458ff67895c03da7ebf2f36", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778609932, "uuid": "50d54583-75f7-41cb-8a4c-52c883181523", "value": "T116564947FC9545A8C0EED2308A669253BA717C484F3567D33B90F7282F76BD0AAB9704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778609932, "uuid": "a53c9de3-900d-4b90-bcfd-bfbf6025af9d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778609932, "uuid": "999fc168-486d-4f49-aefa-37e6df31baef", "value": "49152:JdnOS+rZyxzcsyP5/1kc1wNOGksDk2QKBJNYxAw5c5E8YtZiYJeQCpbXW1K42Qw:9cp5p1RV2QGJRSOEe95X742t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778609932, "uuid": "885fd113-d7b9-4907-a5bd-175d95452e34", "value": 6020096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778609932, "uuid": "fe64e667-dc01-4f32-b89c-64d539e3a5bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778609932, "uuid": "93b10277-000e-4521-a488-701497e1e6ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf9ca6c-4dd5-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778571580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778571580, "uuid": "8e00a21c-217e-4dad-95f5-09e757c82036", "comment": "Malware payload (AsyncRAT)", "value": "2345b03a066a71cf32238df6f2ef8ba9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778571580, "uuid": "9ae44c84-7d70-4d4d-9a40-8d0b5e0f4e77", "comment": "Malware payload (AsyncRAT)", "value": "eee6d177a92e0e870f5aa99b4366cb4559b3f0c2c6c78ffd4fc4721dfc3d4c91", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778571580, "uuid": "a5665ee9-89be-49fe-bb87-5d41fe23a99b", "comment": "Malware payload (AsyncRAT)", "value": "604d25b556e274a2218002d8f724a155078756f0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778571580, "uuid": "42182151-408f-406a-9703-e76ab2c369fc", "comment": "Malware payload (AsyncRAT)", "value": "46e09bb23ea3d5195680c821b531a215d70b522608b320cc11f5bc8385745e6aba8dbac90b583549c882330fb10f314e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778571580, "uuid": "9e34fd67-22e7-4708-9dd0-4600a215fef9", "value": "T1ABE533EBA8D8D59FEF24393F09A76CDAB9F8BE9F0424F03045D5D0D4992C949622D0D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778571580, "uuid": "81c6dfd8-825c-4e76-97f1-e0dab42d5abd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778571580, "uuid": "31f0887a-6442-4ba6-9d8b-26b00e3bb787", "value": "49152:A3w3kZeOmlUt+y3JzcPZQmpiFViJ3qhPv3M7RBqkj9wobjL2UpN+YWnAR3PT:XkZ4Mj3FV4K87RBqkZ7qnAR3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778571580, "uuid": "704f56a1-0b2b-4c42-8aae-9dbf589be528", "value": 3318784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778571580, "uuid": "e4c078d7-bff0-4c92-aed8-1895a69ae10e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778571580, "uuid": "c79960fd-5ae4-469e-82f1-48aaa4b44eb6", "value": "UIOP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afcf2768-4def-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778582726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582726, "uuid": "696e4c34-5421-4bef-ae81-34f3f425350f", "comment": "Malware payload", "value": "aedb20d12c9c2119e492b799876c5381", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582726, "uuid": "84ed26fc-6292-43bf-9f08-dc077270f00d", "comment": "Malware payload", "value": "eeee34f2db5cb3eb5e5877c93e2250d44128c470d24fad38885bbfdab452de09", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582726, "uuid": "fa4fd7c2-fb17-4c77-aad0-81f744561d65", "comment": "Malware payload", "value": "f302219d7b41c9cb03350b2ecc9ac962cc54eeb3", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778582726, "uuid": "885085e2-f0ae-4fbd-9d4b-d90408dbc6d5", "comment": "Malware payload", "value": "7b95adb5b5a68b3ee4fdc6b7bc666237b629149ff1ef042eb6f291ae03f8049ea606e46eb4275530614f6a29108e490a", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582726, "uuid": "92a5bf6c-661f-4556-9fe5-eff05d93f885", "value": "T134114C868CA0726393CFB1A8B45191F2E6763B83260C7831F5DC42701F01530E2E96BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582726, "uuid": "15bfa4d9-a00c-47ab-89b2-468aa22c0e9a", "value": "24:kgfifo8ta3BgmPkAhVTO4tKhTjYbXgt5UNOAS3pNY:k8ifZygmhFCnYbXU2C4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778582726, "uuid": "bbb98b96-2f61-496f-bb49-3c7b263a4ef6", "value": 896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778582726, "uuid": "50f48a4f-3726-4a1b-ba71-628737e29dc0", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778582726, "uuid": "93a28928-ce20-4bb0-aa0d-66cdfec2dd80", "value": "aggregate.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e40736-4dfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778587697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778587697, "uuid": "e45ce6ec-ede7-45ec-b99f-a9bf7caecd78", "comment": "Malware payload (Mirai)", "value": "d1b42df39b7a88ad432bbaf8ad55c71a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778587697, "uuid": "b3f29fed-c258-421f-bb8d-e4af09ae100e", "comment": "Malware payload (Mirai)", "value": "eeee899b8e5daac20097171d157f68534d26dd5ff9141002c2618f2a36d84f92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778587697, "uuid": "249be111-54e4-41ea-898e-09a6b01a229d", "comment": "Malware payload (Mirai)", "value": "1583f057eaeefeb5189e12ed10979d3349a7e334", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778587697, "uuid": "5b4270c9-8f4f-47a2-9b49-c701b0cde4db", "comment": "Malware payload (Mirai)", "value": "a86253b8b367714650f71ffd2ba9aebbc270f23217116d59fb7e52435eed0d506f56f6c2679c847c14b4c41d7749332e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778587697, "uuid": "a2300316-2be5-4e3a-9092-dee18de82f71", "value": "T1C2530202DD5F8EECE1C6C3B0B85F5D4CC0809A17E778650F67B9768EE4A079A0319A99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778587697, "uuid": "27fdeadf-e238-4d3b-803d-211830332433", "value": "1536:abS6ORLNvicN2gkes8RoOJdIvRnouy8ryD:myLNqcRkes8CUIpoutc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778587697, "uuid": "f3f73402-00f8-4ec0-94ab-493782145e18", "value": 63128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778587697, "uuid": "f2b6af7a-48bb-43de-bf42-5d7465472264", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778587697, "uuid": "ad9be9cf-54a5-4848-b270-c02e9bb9bcfd", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ba4193-4e2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778610216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778610216, "uuid": "0c31b29b-b432-4f6c-a716-ca09d8487d89", "comment": "Malware payload (Mirai)", "value": "c65b4b9ee13f29eb2b10b0b218b4d0f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778610216, "uuid": "67a4e3c2-1c94-41f4-8102-bbd51e082bad", "comment": "Malware payload (Mirai)", "value": "ef5d274ea8c4c2f1c105cf400c935359187fc435ff6874daa6792e18b080a1be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778610216, "uuid": "54a14aa7-c9d2-4dd7-b3aa-92fb24104fd8", "comment": "Malware payload (Mirai)", "value": "f85b52e8f64b2d073a038c3eb2f8dbfb60150668", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778610216, "uuid": "2c0ddb37-4678-48cc-91a2-2600404dda7e", "comment": "Malware payload (Mirai)", "value": "fa6d16561844c2c27d7b2d498a51ebf9b1c55454b2c5f41b085615e0b9056a1801e6e3107d8500b3186af1b6f8515c63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778610216, "uuid": "eaf09261-3e1d-4d6f-bba7-1dc5e577579f", "value": "T198730992FE81C941C5D529BBFA6F41CC338307ACC3DE72029E11AB3566DF55A4A7AE01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778610216, "uuid": "967f80a0-26ec-4ba4-8ddf-7b2897335e79", "value": "1536:yjoSrNjlUZa9ayN87002+iSFVj1LwiNLtCOr+0DoISa7:w0yaVgFvc1ki5tSxISa7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778610216, "uuid": "515affb2-60ac-4e36-98d8-b785c95c251b", "value": 77412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778610216, "uuid": "f2f386de-24dd-4b5d-8ff3-d8635801da08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778610216, "uuid": "cfa1954c-dd64-443a-b7e7-78499c90264b", "value": "bot.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f79362-4dec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778581532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581532, "uuid": "d423f5c1-7db4-4018-8d83-8c5a212aef51", "comment": "Malware payload", "value": "bae4e44909f70d6983552862adbd1975", "object_relation": "md5", "Tag": [ { "name": "jicinvestments-monster", "colour": "#D62FD4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581532, "uuid": "a93286f9-e6ac-47d0-b297-eaf877f9a1e2", "comment": "Malware payload", "value": "efddccba358bcdd71f136e1cd32f39bbac757a044b308a4c9d70d9a9bc3cf024", "object_relation": "sha256", "Tag": [ { "name": "jicinvestments-monster", "colour": "#D62FD4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581532, "uuid": "dd2da54e-11a2-4206-b0a3-207d355ea464", "comment": "Malware payload", "value": "94d583519b24df9908845ea72aca0e631f49d3c7", "object_relation": "sha1", "Tag": [ { "name": "jicinvestments-monster", "colour": "#D62FD4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581532, "uuid": "27a04f33-13d2-4293-bf9c-dffede807570", "comment": "Malware payload", "value": "e23db5343607d5cc752f886edc3b1b018ec57b05eec431db81d76641f5b15a3a5956c8776a48d1e097b8b4058a07f527", "object_relation": "sha3-384", "Tag": [ { "name": "jicinvestments-monster", "colour": "#D62FD4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581532, "uuid": "2f9bac6b-8823-44f9-8425-6f312ecdeeb3", "value": "T1664145A0BC4D50B1854ECAF2E9B8695AF731128DDC8F274C036CB2D235E7769A741C49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581532, "uuid": "de5f41d2-1186-402c-af61-4b1ded03097d", "value": "48:9e/FWJpDhODwx1XcChnSeHscDxurGbvotdtxVQn:A/yLXJ9SPhGDsVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778581532, "uuid": "fa0b5e4f-8fb5-4ed5-9af2-db74ec7c7f40", "value": 2141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778581532, "uuid": "18eaf0d9-d4ab-4fe5-8810-5276c7224790", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581532, "uuid": "00da5fbb-a62f-40d6-859f-422ae2c64d61", "value": "efddccba358bcdd71f136e1cd32f39bbac757a044b308a4c9d70d9a9bc3cf024.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "968e2b7e-4e1e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778602870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778602870, "uuid": "99791473-701b-493f-bfb3-4d2578f65a93", "comment": "Malware payload", "value": "07ea890ebab058afc5edd25282773460", "object_relation": "md5", "Tag": [ { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778602870, "uuid": "ca009262-e4e8-4760-8965-0632fcde1e06", "comment": "Malware payload", "value": "f0009af3a8e5d99582cbb623d1895c205a70836ddea1c27feffcc07ebeee872a", "object_relation": "sha256", "Tag": [ { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778602870, "uuid": "ede70fa6-9868-424a-b7c8-d80c188b9780", "comment": "Malware payload", "value": "95ceb9358c6097b9d1fa5c4b15e4f50eee913304", "object_relation": "sha1", "Tag": [ { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778602870, "uuid": "45d6be64-f1c4-4275-9eef-cb855420c91a", "comment": "Malware payload", "value": "f7f7234026ff959a00354e006e41da7ad343f013776e3bbd9729a7e7b536c6be0f72dd127a30f8635772455d0d1227ba", "object_relation": "sha3-384", "Tag": [ { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778602870, "uuid": "c18aa06b-8be1-4937-aae5-c2ebd798bac5", "value": "T16882E805B2B944AB82C3A665D4CDD2089678843FA14A5E9178DCC3C5FFA6239D3F87F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778602870, "uuid": "f931ebca-0ae8-48de-83b3-3e6e5aec0014", "value": "384:1I8NETLrDyXWC75JCun+l162SoLgSKPYoTpwDjstY:1TGrAWC75Jf+l1LSoLgDPYGpwDIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778602870, "uuid": "cf1f0fc8-9268-4645-8b48-6b4f7aca2436", "value": 18933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778602870, "uuid": "375eeba7-0157-4eb0-8057-f32c4a439c81", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778602870, "uuid": "ef3309f0-208b-46c4-a5ba-f0d58d09035a", "value": "f0009af3a8e5d99582cbb623d1895c205a70836ddea1c27feffcc07ebeee872a.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93401343-4deb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778580960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778580960, "uuid": "ded8ed5f-dbe6-4b88-94fa-662219c04557", "comment": "Malware payload", "value": "28a0bdf5bfd14ebec944e30633f388c7", "object_relation": "md5", "Tag": [ { "name": "43-160-218-11", "colour": "#697238", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778580960, "uuid": "66805921-c2eb-434e-bd82-1a252d585c55", "comment": "Malware payload", "value": "f07deea7b1b1053728c0079d30240d92c07853e3e37c86fa32540ee5e638d941", "object_relation": "sha256", "Tag": [ { "name": "43-160-218-11", "colour": "#697238", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778580960, "uuid": "cbd47e33-55e3-493b-93a5-a2bb1f5bc9e4", "comment": "Malware payload", "value": "b6a9529d6b39d1f894d5c50669ddb4694b33aee8", "object_relation": "sha1", "Tag": [ { "name": "43-160-218-11", "colour": "#697238", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778580960, "uuid": "62daf423-013f-4175-82c6-778d6725d4c4", "comment": "Malware payload", "value": "61224cb3f146a5d59d525442229fde2ba598810cf1c591575804c0d66aac21d203a44d1ec0bd4217384087724e613318", "object_relation": "sha3-384", "Tag": [ { "name": "43-160-218-11", "colour": "#697238", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778580960, "uuid": "444da7cb-b221-410b-ba10-4e486aba2856", "value": "T1FCF2E13612241D25CEAFEF788640C132152ECF7D95BF206F0A551599EFD9AEECEC1128", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778580960, "uuid": "9020c87b-ef74-40d6-bfeb-5ed62e42a475", "value": "768:mwOvR8QiRxmtoDG5RRDcj2fVNPjU7oRX7qBCQfyrZE45krrJMkVvgh:7mtoykj2fPjq+X7GDYZlArJZFgh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778580960, "uuid": "a917304c-4d23-4d12-9bfa-c323e7a37f45", "value": 37339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778580960, "uuid": "68c0812e-94c2-4597-8e50-281293546127", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778580960, "uuid": "0cb57174-4ff0-49ae-96e8-90e3df521d8b", "value": "f07deea7b1b1053728c0079d30240d92c07853e3e37c86fa32540ee5e638d941.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653cacd0-4ddc-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1778574441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778574441, "uuid": "2c8150bf-d678-46b0-b3b8-9aea5b3e680d", "comment": "Malware payload (QuasarRAT)", "value": "0634d014d43032342cce838b8516f581", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778574441, "uuid": "e418d8c1-e36d-41ce-9841-cb947b5c9043", "comment": "Malware payload (QuasarRAT)", "value": "f137ebfc699dbff610cd6526a026a290d6cdd54b7aaa0c468a31a5e6cdcdce1b", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778574441, "uuid": "4d24b5ca-18cb-4ec6-a71b-ec9bf8797197", "comment": "Malware payload (QuasarRAT)", "value": "f7fd28218daa88429ac0f0215b56a7f840b4d83b", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778574441, "uuid": "6bf648b2-cb4b-492b-9152-19ebc247c979", "comment": "Malware payload (QuasarRAT)", "value": "9cce6a090de5884d54138dd38f4bfcffc98373b2c1c97d2f1806979d76a8e4318805b8344ad205261531e1240031d098", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778574441, "uuid": "468061d0-f700-45f2-aa4f-c00e28de5c0c", "value": "T118E56B143BF85E27E1BBE677A5B0041267F0FC1AF363EB0B2581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778574441, "uuid": "05fbdf20-e563-4f05-853d-20c1b342ac1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778574441, "uuid": "6c31c41c-b295-4838-98df-d00cf858bf67", "value": "49152:nvwz92YpaQI6oPZlhP3Reybewo56RJ6WbR3LoGdikTHHB72eh2NT:nvq92YpaQI6oPZlhP3Yybewo56RJ6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778574441, "uuid": "4cbafed2-e3f9-4182-82de-55136d6f03d3", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778574441, "uuid": "74ce3fdc-6762-4398-b086-01e5556602d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778574441, "uuid": "19f082e3-a1dd-4d26-a921-de836eb9dda8", "value": "ru.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a656db-4ded-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778581607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581607, "uuid": "84242ac2-aafc-4a8c-b81f-e598d2d299b8", "comment": "Malware payload", "value": "e0a5b1ce4b495b19ed184b7fff6e7bbe", "object_relation": "md5", "Tag": [ { "name": "jicinvestments-monster", "colour": "#D62FD4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581607, "uuid": "f048d62b-bc4f-4813-b5a1-4415097d1687", "comment": "Malware payload", "value": "f1919be6422240e85aac06ae9a0271180124236f6939fe91a48ff3986dc0ee2a", "object_relation": "sha256", "Tag": [ { "name": "jicinvestments-monster", "colour": "#D62FD4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581607, "uuid": "e8980219-8d2b-44b5-871d-cf7f941e1605", "comment": "Malware payload", "value": "a1b7ac144f1c380e4b947bcb1f127673a0b3bb9a", "object_relation": "sha1", "Tag": [ { "name": "jicinvestments-monster", "colour": "#D62FD4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778581607, "uuid": "a7f4756c-372c-4b5a-91db-cf9860cd31ad", "comment": "Malware payload", "value": "c2afe6d198512e8e7ec41d497ad85f61535b3edf040893c98dab274627061602a40eb120a5936593d3043b8c4e949d30", "object_relation": "sha3-384", "Tag": [ { "name": "jicinvestments-monster", "colour": "#D62FD4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581607, "uuid": "c2af2230-4996-4b56-aeae-727b36bc86cf", "value": "T16E41B634669570D17F18D9AEF2E3802D222FA7F49886B5D4124137C60221DC8FE21C6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581607, "uuid": "acfaf215-6d20-4eb3-96e6-bdc664421860", "value": "48:lz7hL7pv0WMyGmGUizSfGWgQZ5EM0zdB0aVQxA:hFWWMyGtUpeWrE0aV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778581607, "uuid": "44c82b8e-a03d-4d48-9db7-2da080e9d0c0", "value": 2172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778581607, "uuid": "63d3a067-9891-41c2-bc00-c68c7d1904fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778581607, "uuid": "9d6141d4-44f2-4484-9b7f-6d6c4b067dc6", "value": "f1919be6422240e85aac06ae9a0271180124236f6939fe91a48ff3986dc0ee2a.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da83e9b6-4df0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778583227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583227, "uuid": "772f3eda-cade-473e-9dd6-44891386ca39", "comment": "Malware payload", "value": "f5c9de6c7141536453944f1ff70d6737", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583227, "uuid": "f5bcda83-29ef-4bba-b309-33123037bf7e", "comment": "Malware payload", "value": "f554637fbc612e5703437c4f8458f8269d505e6e3a08af0bdebc096020d69150", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583227, "uuid": "738f7bb8-a9b0-4d2d-856b-b186cd39514a", "comment": "Malware payload", "value": "d548e0af61669d2680a4d1cb71ce17143fed1495", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778583227, "uuid": "669e0909-a3fb-4f58-be64-dabfa0684618", "comment": "Malware payload", "value": "ccb312e3a95526345a8f6738c7c7d4eef9ad2a2a9dc79a0484305311fc34bdc5856d3cebab734f423938e879dd13494f", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778583227, "uuid": "c51bad1d-42a2-426c-ba81-12bb8937ead8", "value": "T196A401437AA4454EE11746F90F8B744E3308FD25FECA1612399DF78F1738A9AC95322A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778583227, "uuid": "e6f46c2d-40a1-435d-9440-1b4a548300b1", "value": "12288:BLy6fbmcINVzUayJctWsehNL2aU1hgX4vZHI9BQcJH:Hbm7UxGzeLL5U1OIlyucJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778583227, "uuid": "d0520ef4-e4c5-421b-a722-1de8d08cf644", "value": 456704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778583227, "uuid": "fc07fece-0cf4-4e59-b8f8-34cf8f33bd83", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778583227, "uuid": "947605b9-fe82-424e-8ab8-8490e59a324a", "value": "Zam\u00f3wienie - ZDIP202605000078.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f29c9a7-4e48-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778620897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778620897, "uuid": "19ed6831-2c01-43a6-94f5-c5bac415fde9", "comment": "Malware payload (Mirai)", "value": "67a94330ac8ce5e58d5bc71372602804", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778620897, "uuid": "2fee1c8e-9b47-449c-bfb5-f7e186e90dfb", "comment": "Malware payload (Mirai)", "value": "f6044a669dfd2e3b86d0b8b1d0cf5a3badd8b5bc35bf7c8f11fb7cf7c4826639", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778620897, "uuid": "6031d134-2b31-42a3-8abb-514b013a5762", "comment": "Malware payload (Mirai)", "value": "5c31a160988d4b4274e9143671158e4ee143e42b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778620897, "uuid": "316f398a-8e1b-406b-9253-76d7a4f4fc45", "comment": "Malware payload (Mirai)", "value": "b0003c0d3929cf4f804275d8a059f2f037c6f53eab2b843187a2586907924632f971376187a4962acce34d6400dd165c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778620897, "uuid": "20c16d52-ee28-4842-aa91-c25433abebc8", "value": "T1E1730892FE81C941C5D529BBFA6F41CC338307ACD3EE72029E019A3576DF55A4A7AE01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778620897, "uuid": "e3c4c5b0-04f0-4b67-8483-f0ef5c3e7699", "value": "1536:yBLSrNjxYNyeyDVvDEOeulCjVmNiUoB6Orh0jEa07:tIyeab1j0V0i1B1ta07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778620897, "uuid": "301913bd-617e-4835-ab18-8b0ead7eeccb", "value": 77460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778620897, "uuid": "1890b8b7-e747-42f4-9edd-3feacc61544a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778620897, "uuid": "f376477c-123a-4a42-9f98-6d162d024221", "value": "bot.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581ff4e7-4e39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778614362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614362, "uuid": "50d135b7-1ed1-41c3-8be1-11ebbf9845f9", "comment": "Malware payload", "value": "909c44d693cff8ea22b5165958f6abd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614362, "uuid": "3d24dff0-ebef-4e2d-8b8b-e70d6d15825a", "comment": "Malware payload", "value": "f62db70d12cff35c518720d70afe3057e124137914340c28eddb79b511cdd5e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614362, "uuid": "37265302-5e52-4029-98d7-1ff51a17296c", "comment": "Malware payload", "value": "b8cd5d8937a91561735559cd74f4ed922a163b1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614362, "uuid": "dc127f07-d9a0-4ebc-8acf-88256a39bab9", "comment": "Malware payload", "value": "6b49166677160e79fe9dda5a6bd8373c6ee9f6ea158c59b0fef1ee3b562db12c129477c35aefe5d113757b7be44f93a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614362, "uuid": "362ac4be-6721-429c-8a9f-c2f6c5db9fd1", "value": "T197F31A45FD419F26C6D622BBFB4E42CD37261768D3EE320399256F20379A85B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614362, "uuid": "fd259c7f-64dc-4537-b2e6-e955554d5cda", "value": "3072:rp0rYJVCbaMTYdESVlA3UQ5R9JTQw6SAUGP:r2ryCbaAfolA3p5RfTx69TP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778614362, "uuid": "b7eedefe-d326-484f-ae06-76c4726fec74", "value": 162512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778614362, "uuid": "58b144fb-30e5-4f97-b870-672050649634", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614362, "uuid": "e1d60ee2-7fe3-4125-ad68-196bb6c918d4", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e57bb5-4e15-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778599140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599140, "uuid": "bda604ee-a3d1-4235-9c4c-515fcbfc85af", "comment": "Malware payload", "value": "c3fb0312ea2bba5d8dae1d1eae18d495", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599140, "uuid": "d81bf303-6cce-47d3-9ddf-b683eeb13572", "comment": "Malware payload", "value": "f768aec48b9c966c34159db4ab0b3eed0b860c372a626afd63763baa7125a149", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599140, "uuid": "5e2769e9-e22c-4a6d-8af2-931aa5e74e34", "comment": "Malware payload", "value": "9592a161dcc622e5051bd99c29797b03c1ad8f58", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778599140, "uuid": "f3fe3f72-a670-4730-87ac-03397e91f72a", "comment": "Malware payload", "value": "b590a34d9d954f24c7da045156aec0653bb24c82e79599dae35a186eed1feed3faf9751dc9f57e60becf1f87f0bdd160", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599140, "uuid": "f4fe6b3c-3a00-49f3-af9f-31bbecedc238", "value": "T179926D0FB9514315D5C00474A5B2873FD6BA5476338454EFFBD88ACA1B682E9F83216F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599140, "uuid": "452b9b31-2502-41a1-aca6-a7e330a6d12b", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599140, "uuid": "3800e791-a7f8-4328-bab0-d611b813e7f7", "value": "384:jIkjLVlvadxqSDO5wtT0vu98t2rFJ/Bgav8U9c+G:Tqx3600G9oJa0UnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778599140, "uuid": "cbbab1fb-d887-4fa5-b4d1-6fb7f27f3f93", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778599140, "uuid": "1774f304-370d-4eb7-aa4b-a9828c8e78be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778599140, "uuid": "f94c6bab-83ba-4409-b079-9adc85733c0f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f0e56b-4dea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778580435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778580435, "uuid": "dbfc539c-80f6-4424-81cb-0995539634ca", "comment": "Malware payload", "value": "85c22aa88591c1983c7e9cef6fc3c397", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778580435, "uuid": "655b685f-0cc1-4291-a69c-d9ec93070af8", "comment": "Malware payload", "value": "f8c67c18089530fb53f384133d57345a11f151cd3dd069b1f02a081b5f968a66", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778580435, "uuid": "bb32210b-b1a1-4b1a-b8a1-43adc4b89521", "comment": "Malware payload", "value": "945339f77960a2ec7205a0c8a6ac959f079fbe03", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778580435, "uuid": "e1bc2110-99e6-43b2-ab1c-9a978020b210", "comment": "Malware payload", "value": "25513196af3543b787e4a772c01ef9472ad9e0c5325881e1e54bdf0812161bb0e60e68ab313ea4c207ccc825bcc44b6f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "eth-fastscan-org", "colour": "#A7F77E", "exportable": true, "hide_tag": false }, { "name": "welovechinatown-info", "colour": "#48D2BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778580435, "uuid": "d8a8bfb5-2173-4cb3-b32d-bade0f5b3eb7", "value": "T1D0413017600429F6C92D5B31DACB06433BAF92AF415A5888706DD0601F057AE8FEBB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778580435, "uuid": "94467443-3978-4537-910a-19b3e30422e9", "value": "48:RpbIQW3G6iT5lE3NvX5limkXeGNsp6/sK:RlIA7V233Uap6/sK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778580435, "uuid": "438218d7-348c-4323-8192-f3065fbb9a94", "value": 1960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778580435, "uuid": "eb8824ef-6aee-4d65-ab2e-1ecace9c4c82", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778580435, "uuid": "40bc19b0-9847-42da-bd4f-a433a4be1119", "value": "1391511170.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e997445e-4de0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778576381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778576381, "uuid": "5af99325-3f3b-4167-8835-82c40ecf6e25", "comment": "Malware payload", "value": "1fc328b17aa586645a515791e468547f", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778576381, "uuid": "0119706e-aa42-44bd-9121-ad06f1b077bb", "comment": "Malware payload", "value": "fae5b32eaadaa010d3582924f19008e63e1fc54b05bffc9fac389d48631ec0c5", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778576381, "uuid": "aa8d90d5-e7a7-4bf2-b976-a6aa1a465e80", "comment": "Malware payload", "value": "c01d04df2b39f4ff93314c59a7e9154a19e95a9f", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778576381, "uuid": "163a9ff3-d977-49d9-bb46-0ea3133f68ea", "comment": "Malware payload", "value": "93f6a9964eb4786d6884ea36c10e144f34546090d488d2684c1d9e90fd4badd5c406c8dc75a350456f4e24d3af6372ba", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778576381, "uuid": "e637d738-3e81-4b37-b546-1a43ccd620db", "value": "T1F8A40143BAA8094ED12646F50BCB744E3318FD21FEC616563D8EF34E5734B6A8863627", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778576381, "uuid": "082c1cde-d017-469e-bf0d-939ed727b06e", "value": "6144:D03RJIq854qbmcX4NQ8zGiQb0QnayPD168qKs7mM8MUpsqil0NL2eQ0QAqSuJPoA:QLIqebmcINVzUayJctWsehNQrW0p0Rg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778576381, "uuid": "ecef3a26-11dc-43b2-a5bc-e30411d3581b", "value": 457216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778576381, "uuid": "2ddcf8e2-531a-4dec-846d-8e6bd2251298", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778576381, "uuid": "b110d159-c216-40a9-a346-8ce171243201", "value": "faktura.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "306c7dfe-4e3a-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1778614725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614725, "uuid": "44992ce5-5dff-4bdc-8caf-047e2fa97734", "comment": "Malware payload (NetSupport)", "value": "218ae99c40517f936ff3b4e49f829df4", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614725, "uuid": "b38b083e-23ba-4b59-bafc-e1f337476012", "comment": "Malware payload (NetSupport)", "value": "fc12bbabe8d523b51c1ad2892516e5ae85d0ae3d202bf0b25fe852ef5ea4ae9f", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614725, "uuid": "dd1e723c-db1f-447c-8b0c-4ae0f17f4559", "comment": "Malware payload (NetSupport)", "value": "7c89b96633e3c480ccdce2002cb28a7fa52214d0", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778614725, "uuid": "95cfa9b6-9ec8-4a5a-99c6-70ac29bfb7cd", "comment": "Malware payload (NetSupport)", "value": "015354a6f5144ffe33c286e5d3f1afe94a73d260d97133cc53aab0f214616cd85f025185f5084c11e1d2676dd5c2d70e", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614725, "uuid": "8c4ed032-5efe-4234-9c48-c9cbfdf8387b", "value": "T13813FD36EA92E88297D83E00C475FC59256426B18BFBCC5CF78CAAFDB481E101F5469C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614725, "uuid": "cafa054f-3dc9-4083-aebb-6de7588ed50a", "value": "768:SKK29IuWqVe77RU7SQLzRgI5o309uEfM+Ve/HkKk:M29IdqVe77u7JL9h+k9lGkKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778614725, "uuid": "4b2cc056-1326-4c27-8b34-f5cfda01d14e", "value": 42885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778614725, "uuid": "166b8547-2197-4cb0-a6c4-ec52b1ab6356", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778614725, "uuid": "3d027bc8-ea09-4039-a229-c3be42f17ff6", "value": "85-239-149-10.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98185f47-4e00-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778589988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778589988, "uuid": "82b8e5b2-697d-4729-8cf7-9fefb42e8c1f", "comment": "Malware payload", "value": "ea4185f296ba759235279043a2f24d5f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778589988, "uuid": "5627a2b9-a7c6-4125-bc42-095507205cb0", "comment": "Malware payload", "value": "fe2373b443923a8b9f3fba38ab269d2561a05882c45aa750e467f2043d02e901", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778589988, "uuid": "f6f4b2b1-9057-4b1f-9cc0-3a7ea7670062", "comment": "Malware payload", "value": "57341f0495a1a8c0c375eafcd3acd11ea766591a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778589988, "uuid": "3091ab07-ecff-4f6a-a5af-52a9af11d9f0", "comment": "Malware payload", "value": "ed452b64e2993f7088ffc885083aa381d1f4ec15866af71097f19eae53f46e1b2c4b11cb26dbedff8cf2e9181f937d38", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778589988, "uuid": "b8ac9a82-5c34-495e-b2e2-cc13bbf9731e", "value": "T1F8D0A7AB7123017814729C18F5DBBD00B1958B3FAD58DA5E781765721F0670EF8C17E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778589988, "uuid": "fb235d4d-e8f4-40f2-83c6-9d36fe81aefb", "value": "6:hTT0qW5MFyvrabwG9I4AulNXYq4HvXDG+NjVsNXYrkJ:VT0qW5e8Wdy4Piq4HvXDGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778589988, "uuid": "60c60dc1-e8ad-4b92-bba6-43b4b923da9f", "value": 263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778589988, "uuid": "75cda8e0-7495-4fe5-b086-16224500f55b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778589988, "uuid": "d1d7bbc4-5ed3-4a60-b7e3-a2e443b05df2", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000b6f87-4de4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778577707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577707, "uuid": "c051b364-db10-4517-9eec-9d56f7d2400a", "comment": "Malware payload", "value": "b621b164f1c9143bd6f3682ebce122a8", "object_relation": "md5", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577707, "uuid": "b2a407af-9222-4628-a288-49c4e5ee1678", "comment": "Malware payload", "value": "fea319d2d89ca686f07f9c8cb31425e6e77983ef8f043a03cca17d8b3c902b7d", "object_relation": "sha256", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577707, "uuid": "7583c430-b899-4e49-a35b-93eb3cdf67e5", "comment": "Malware payload", "value": "c061d415a1a767d79e15d57d69d9545e5e5d30f5", "object_relation": "sha1", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778577707, "uuid": "3e8a46ee-7be2-4ec7-9537-c9d70dd9497e", "comment": "Malware payload", "value": "2cdf7288e286791b16b7a7110a4e4140405f44c84d39bd899e9b5feeffb94c11a480bfa700f40928ea5311963e997762", "object_relation": "sha3-384", "Tag": [ { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577707, "uuid": "b4dc1334-5fb4-4309-a71c-696150d27112", "value": "T1CF273343C20E03A6ED4BBF3136DB113B6568D11CB16AD59B3E4653D02CE16E7AE23B16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577707, "uuid": "61586f59-e878-4fa6-a663-16351744238b", "value": "393216:wCo14YI575UKV5EgPZHJbQ/Gvi5maMgxO8pm6u+vV9r1BPWCpFD8uXd8G0wimr:814Yy75rV5XPZHJbQOAagk8pm6XV95B9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778577707, "uuid": "bba43b8b-5c3f-4473-b30f-39055e6475af", "value": 21951683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778577707, "uuid": "7792d7e5-9564-4515-bd79-9035d9903d10", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778577707, "uuid": "7491db30-aeb1-4f6b-98ae-6ebce51a2514", "value": "T1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }