{ "Event": { "published": true, "date": "2026-04-24", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-24", "timestamp": 1777075381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "0e006053-c4a6-4ec1-86d1-f50c94fa1173", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eabcf93b-4003-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777052099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052099, "uuid": "db3c4e95-1694-44cf-86c5-6b3ffe9b7e12", "comment": "Malware payload", "value": "3ca15dcb34e2d4dff64dfc5fc970dd35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052099, "uuid": "9cf06fb9-999c-45c9-819f-ae9cafa9dc90", "comment": "Malware payload", "value": "00276057038ca26dd9b0a9c4e64e9dcef8e5084dcbabf691026b288ecc3bfd8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052099, "uuid": "bc30b359-9e65-4e60-8f94-fb0765b990de", "comment": "Malware payload", "value": "2e8dd52e52619e64c4fbfd3f21c86db39544d2dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052099, "uuid": "716a6008-73d8-4125-a661-66903f1309a6", "comment": "Malware payload", "value": "02d19dabaab44bdb4dbe6b97ccea139c29456f988eac0201b2170ff764b26314b6a259b68ea88fd5494ed536ece13a5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052099, "uuid": "7a50be73-cc60-4f88-8b11-c06a6d28a77a", "value": "T19495F156F2F334FDC067C030839BDB626936F46541226E7B21C4DA352E96E701B2AF66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052099, "uuid": "cf63c9dc-cbec-4bcd-b07e-67e3db4eeeb3", "value": "49152:A19DV6Ab6AGRE8PuszV6nIMv2xgB3rTZ4DwCq2+:K9DV+RVNzFM/Z4DwA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052099, "uuid": "1f21d3f2-6445-46e0-a4dc-2931e08bc770", "value": 2022521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052099, "uuid": "ed3256f7-d732-4f4d-8465-db96e93f12f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052099, "uuid": "7f4abfb4-4662-42cd-9555-b7d1917d5229", "value": "bot.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29aa3875-3f9c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777007537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777007537, "uuid": "a40e7b74-85b1-4e2f-9a8c-245640c4cf22", "comment": "Malware payload (Mirai)", "value": "3c99a6db1b6276c34c8e2edaa0a30a06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777007537, "uuid": "10230c1a-ac1c-4d55-87a9-a573de7b9cd4", "comment": "Malware payload (Mirai)", "value": "005067d66ac14c10f867ab81855016e1ec2bb6e705e04afd8197cc9a5c95d524", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777007537, "uuid": "0b471b6f-b276-4ba3-a473-0135d580df78", "comment": "Malware payload (Mirai)", "value": "e88250c4235daf44b85c5482e895c60218304e18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777007537, "uuid": "ad9af172-e5e3-40a4-bf23-955a8340c033", "comment": "Malware payload (Mirai)", "value": "0cc8aad7c1eb13be113182b77e6340200edbe0aca0c6143bd29d92f22e663eff6ab46820434559c5fcbb0deea48b427b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777007537, "uuid": "4586c831-c8c5-4041-a555-31241c5cee05", "value": "T104549D077B8A4DEAC62DC3B20EEBA3108B13F0350712E79F37646A647F4A79C6C58559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777007537, "uuid": "cc023e6d-2ac3-4f52-b645-1ea65e46164a", "value": "6144:HOd3iYi3XmEiIrlG+nQbMk59QlknPDM+k6ZxPOaP0rbyjbpblTE3TqjjicmmkZa7:aEK+n8Mk59QlknPDM+k6ZxPOaP0rbyjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777007537, "uuid": "ab358865-96c1-4dd9-8bcc-fced27bac218", "value": 300498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777007537, "uuid": "53f37dd9-db36-4fc8-ae19-c8ceb8ab7f09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777007537, "uuid": "908850a3-1ba2-47fd-8fd4-c14445e4ed4a", "value": "zyre.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a81e463-3fa0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777009337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009337, "uuid": "3ef0d364-40b2-408c-b4a0-f36a8e594045", "comment": "Malware payload (Mirai)", "value": "bba2925487c609018029ab23f32038f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009337, "uuid": "145a99f2-25ed-473d-a7da-066ba189b3ed", "comment": "Malware payload (Mirai)", "value": "01e6c07cd6d6f7c9b5d9af76eb1631ece66ac36c627668101cf2498b7e577273", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009337, "uuid": "e3381dc9-05d0-454f-9679-978023d97ce5", "comment": "Malware payload (Mirai)", "value": "85e12d63d016ae5f56edf5c566811b322d56621c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009337, "uuid": "456dd406-ded6-40f4-8792-0a1ac229538a", "comment": "Malware payload (Mirai)", "value": "c20b6f32a27897964b9710da454480fba61175f0934833c94ba02adcc9b11c9ba96b449bcffdad6fb8dff55e83bdf72c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009337, "uuid": "ee5baf35-e763-4515-bbec-824daacf0645", "value": "T1F263F19DA2EDF491C7BC6CBD752CB61922041DC364DA0B9D93304C99EB4272D3ACB8B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009337, "uuid": "ea9ab3e3-df85-4a38-a1d2-d35b3f4d598d", "value": "1536:adIiaKp5QviVOtdYlregVIcAvbf1vvFjgBuRSSdbzVaSsTcgJ/0:adIV4OtdYLigQR/1VMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777009337, "uuid": "89c785a6-fd3a-4681-9e01-1282957c9434", "value": 73188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777009337, "uuid": "aa5c3f1c-91e7-43cf-aba6-30fef8fd6436", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009337, "uuid": "1804e834-c872-4b5a-871a-b665f3f28099", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e3e1283-3fbd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777021798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777021798, "uuid": "e5d97b06-fb07-490b-bf2f-6ededa36cc9c", "comment": "Malware payload", "value": "4fb39c3a46dd67244ec2db64eb7523bd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777021798, "uuid": "07d9f88a-778b-4357-a45f-9200694a365a", "comment": "Malware payload", "value": "02411506c5ecbd16d2ba301c4d687da46b0ca2dbb526a167a864172edcb66467", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777021798, "uuid": "7a9b22f5-1a2e-4f3a-90b5-c9cd6b3a93f9", "comment": "Malware payload", "value": "23b88e200e80bc31abf42015db411b824d34a2cc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777021798, "uuid": "799e46dc-2c89-4979-b529-3195d611d17e", "comment": "Malware payload", "value": "37bd9038e56a196e3d44bf2b41e6e2aa9c7221759b08a239cd04a4ccf3961cbd5d6e747f5ca7094a741cc2a31de10603", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777021798, "uuid": "9d79f942-0e46-4af5-832a-cf8c864cbdac", "value": "T1DBD5333C91633336BCC5B30E8279A2F04F1685B4B455A9F79CF74E2644497CC127AAA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777021798, "uuid": "32c4451d-ed35-4ea1-81dc-0e56199b8269", "value": "49152:PQFuXly9T6Reqcw2TOboOa2F5fRcyDpubCqHeV3y9qOpOhGzOXF1:PzluTlqcw2TtOZTOQFN9y4Qg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777021798, "uuid": "d8c8db5f-1a38-46f7-b315-9486bc163565", "value": 2893361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777021798, "uuid": "2c1e7fad-c57c-4a26-99f9-11a2150bc34f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777021798, "uuid": "317f75e7-c201-426b-b7c9-f84ba8960f8d", "value": "24974195103.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dbc03ae-4032-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777071995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071995, "uuid": "eda564f9-ef5d-4814-a9c1-bf2e056994af", "comment": "Malware payload", "value": "56f22b20a366f154f130cb3e9212a08a", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071995, "uuid": "21589800-7e35-4152-a71b-9406211a0dcb", "comment": "Malware payload", "value": "02935d1ee143d4f585cf999a146e1a4c208dbbb685b3493f454e390800ab3248", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071995, "uuid": "46796b06-8fc9-4e58-bce0-a2972bd71d1d", "comment": "Malware payload", "value": "22ef1e91e8d84a0b7d1f3af65775b6bc29798424", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071995, "uuid": "dd6c17cd-3f89-4c14-a576-23bd5f9e904f", "comment": "Malware payload", "value": "53e26ec6cbc875ee2ff5b1cf5953e4c8e655fc4edbc1ed181648faae63175460c7368e54347cc3a835da630d56351fc7", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071995, "uuid": "5f476711-0917-41cd-b8ee-3f69ea1a6cf7", "value": "T18B2110857AE6A72285724B084E46D294C51F123720A3250077EC8341FF7869FC669BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071995, "uuid": "f51cde7d-b846-44db-9a44-d967a6a69feb", "value": "24:2XTody/GELm8hLNnLak88WFiOIRIbj23OA5WQxoUWTV/0DxC3:2jodKGYm8FNLVWSinNKWSWixC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777071995, "uuid": "9416d1f0-f3af-43c1-af86-22fb920b7377", "value": 1374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777071995, "uuid": "b5b78ea0-e1db-4f79-8283-71da43047737", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071995, "uuid": "13d9d193-649f-44d5-a545-103c241ef836", "value": "wb1hdmwzqtp.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e20af29-3f79-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776992458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776992458, "uuid": "c932b716-dafd-4309-97d8-ce096736552e", "comment": "Malware payload", "value": "5edb6711714083887a185e0912d9cf1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776992458, "uuid": "da27233f-0bc5-4472-8306-99c3aa8536a9", "comment": "Malware payload", "value": "039c363f2145bd2845b6631d512a74864ff0b6a7ed2d8b270372f8662e9b5593", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776992458, "uuid": "860d3359-8fdc-4fe1-acf5-a5470b950425", "comment": "Malware payload", "value": "c7618670f139fe308c15e3128312af881eec809e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776992458, "uuid": "0523417f-8fd1-4c07-83f8-ef5feaa74165", "comment": "Malware payload", "value": "71b6fec69448cbe882e32381eedad4f84cdee019caf51e56a6c382b5b78441d80064c228ec652dd60d951662630964ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776992458, "uuid": "1abcd6b4-0ee2-4718-ad41-3eb8e1acd5c4", "value": "T1FF463A73A49114E4D2EED974C6156212BEE4388B273463CB7BD076F11B7ABE49A78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776992458, "uuid": "20e713cb-d6f0-4bd8-b2d4-88b9de41ed42", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ+:cqYUQuVDt0TZER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776992458, "uuid": "4371b7f4-d78e-452b-bc42-c4ef536b2a54", "value": 5668864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776992458, "uuid": "70173b06-61bb-4660-917b-09d67c444e83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776992458, "uuid": "7e856eb5-d398-417d-ab3b-53742fd350ec", "value": "039c363f2145bd2845b6631d512a74864ff0b6a7ed2d8b270372f8662e9b5593", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ecc7a3-4010-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777057439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777057439, "uuid": "1117b096-14c3-43da-ad5d-4b9d600a373e", "comment": "Malware payload (RustyStealer)", "value": "e87509e91fab412290d9760c2d4bb78c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777057439, "uuid": "ee97d5a1-26e2-467e-9347-9c2f76be1abe", "comment": "Malware payload (RustyStealer)", "value": "03dd84f426cbd201f949da44f1d36d034b75033738bb52b7a6e9e65d7c5b7ffc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777057439, "uuid": "b9291a20-e8b2-4d1a-a095-b1fecd19e808", "comment": "Malware payload (RustyStealer)", "value": "c1901f276acf2cd50b7e8931f0664df9c382ff42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777057439, "uuid": "65dcfed3-cca8-4473-b819-193419a60ec2", "comment": "Malware payload (RustyStealer)", "value": "06dd165662a569f15bd0747f6b438c3ba54750a4e0e9af3f46b5af7fb2c986d1957b8ab3f181d07d23b61847743a7c63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777057439, "uuid": "3addb820-8320-4ecf-80cf-5a655528a58a", "value": "T11DB47D07BA9552BCD0A9C079930A9572AA32B8850730BAFF03D459323F55FE72B3E715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777057439, "uuid": "a4a91531-d20f-40ee-b934-0ff27eeeabbb", "value": "d3da498c9d134ebdf735f07802c6ace7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777057439, "uuid": "2417cc00-4123-4b74-8289-9635df7cb023", "value": "12288:C/wh1c81NbGDqGnrthnlzXx4F/WrFS8IX:ew7c8T6//5x4QrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777057439, "uuid": "223166fe-80f6-4f6c-8603-00a9aeae4fdd", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777057439, "uuid": "b66d3548-f9f9-4d40-a31e-8550ddd42d6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777057439, "uuid": "517bbce1-0969-42a3-8f6b-293f038dd68e", "value": "2026\u7b2c1\u5b63\u5ea6\u8fdd\u89c4\u8fdd\u7eaa\u901a\u62a5\u4eba\u5458\u540d\u5355\u4fe1\u606fpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6d5bdd-3fe2-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1777037933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777037933, "uuid": "55c718e8-80ac-40de-9cd0-fdfa5994b8c6", "comment": "Malware payload (DarkCloud)", "value": "fa96bcb49a84e456e1417a184b4d2c9c", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail-mokasco-com", "colour": "#ADDA3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777037933, "uuid": "5b21f779-1ef1-4b5c-8284-9e4caf58ed02", "comment": "Malware payload (DarkCloud)", "value": "0565bb8643c8c1067a517c00d32f3b3ab5140547b0a565ff4fc20e69d752baf9", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail-mokasco-com", "colour": "#ADDA3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777037933, "uuid": "7e44ee8e-ef9b-45e6-b0e1-647a5057a221", "comment": "Malware payload (DarkCloud)", "value": "0ac80a4ae50dbdec9971099831bf5f5f862b1cb7", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail-mokasco-com", "colour": "#ADDA3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777037933, "uuid": "28afed7c-a46c-4831-aa30-6019edc487e3", "comment": "Malware payload (DarkCloud)", "value": "b9b9185afacb8a7d1f0cfc54d9d65dac97311eedd7d0d5307d68c65ff482d13f8763d0abd56812ab8a53ea209446e114", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail-mokasco-com", "colour": "#ADDA3E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777037933, "uuid": "27217675-51f5-4af6-9364-2b1540164901", "value": "T1C0944A13EB60A11EF1A3C9B1A8B5925A68277D351B98EC4BF3409F1A35715D3ACB031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777037933, "uuid": "5250d693-0e70-4227-900d-b097fc72e6e4", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777037933, "uuid": "7bc914d3-14c6-4262-b863-0ce92af145fa", "value": "6144:e2j8d1/w5KA81IJ8GpF6nuTmOOUiBUrj2Td8zlOxJZG7F+tDYsTkeyKdw6U5i:WjYKkJj6GmZUiqr+d8hB719eyKSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777037933, "uuid": "fcfc865a-3279-40ad-97df-31fa180ee738", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777037933, "uuid": "17faa303-98ef-4156-82ef-c2c2226c8a6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777037933, "uuid": "bacb8d1b-85a2-491a-894f-62715cbabfa1", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1745fb5-400b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777055439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055439, "uuid": "d7556ef9-4886-4196-8ad2-5dce334f9559", "comment": "Malware payload (Mirai)", "value": "42727fc3d574976bfd6c4ac7f03a0417", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055439, "uuid": "8e227033-590a-4494-88a8-68ba865e9c6a", "comment": "Malware payload (Mirai)", "value": "060799bd237259d4a837286b0ee4a9b72c7c2f2ff7ff82ffb4f53ebd257fe07d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055439, "uuid": "97fa2a2b-2ba9-4bd8-9376-1a26d3da5aed", "comment": "Malware payload (Mirai)", "value": "06a7cf45f94350d8fd1e1f4fa4503ef1258d6899", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055439, "uuid": "9d91e078-66aa-4b4c-a0c4-8ba063ca742d", "comment": "Malware payload (Mirai)", "value": "164940df32ee49d153abbc524c546e7456fe3d2b89cd0fa29a7e0e8e76fe145f8a0476dec7a6ede45142763466826739", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055439, "uuid": "09434596-a96c-4083-b61c-8f7852d06c02", "value": "T1ACA2D029BF58828BC832797455D9E5D21297FCA1F29DCC4E2940C15FF0A33A96474E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055439, "uuid": "731cf468-cb53-42a8-8d4d-84e2ed0bb913", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTH:798o08kxofBE+ZkXaITbp2F2TWul0c5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777055439, "uuid": "fb4c2953-3a9f-42ba-8368-db4172de35b1", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777055439, "uuid": "5b1b0d43-3f5b-487a-a1f6-0792de459edb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055439, "uuid": "a524b4c5-6a09-4a33-bc44-c6eaaf752e44", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d31323b8-4003-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777052059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052059, "uuid": "8054b40e-c9ad-4ddb-87ec-76fae2cbad03", "comment": "Malware payload (Mirai)", "value": "ba7f9fa1b64b67d581d11f47e443a946", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052059, "uuid": "18295b39-5c8f-4aa3-855f-1cae17b804a3", "comment": "Malware payload (Mirai)", "value": "0630ab17e5835270c5df6efd53b30b975f493ddcae716ca63eba76e037baf547", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052059, "uuid": "45e827a0-b210-4646-8c4e-daa8d74ba357", "comment": "Malware payload (Mirai)", "value": "69bb1800fbfa26dc9678ba2ecba8c632d01d6b4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052059, "uuid": "fe2d4a1f-086e-46a4-bb95-16f0b6c3e528", "comment": "Malware payload (Mirai)", "value": "167758dec20848475ff40d1bc7124f88bd35490dbee0e02f469a7bac58c089d78c59a72a5fdc9b3e5fd9e178b8bbcea4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052059, "uuid": "bc88e456-8a63-4fa1-bcd1-603f73a8a024", "value": "T16EA2D11576632D66F3ED1C3DC86E8357B9A61BFCC0F532B679451620C90920A3E39A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052059, "uuid": "9c65121f-f0b5-465e-b3f1-95a790e1be1a", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjmwhymdGUop5h3:TvQn4j+ZO5fKAlxKws3UozR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052059, "uuid": "1e3e486b-6166-45ae-baea-d8ad7a0fee81", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052059, "uuid": "b940d7d1-d6b5-47aa-a602-d3449e293d35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052059, "uuid": "791138ae-5b1b-410e-b313-e3f9afede24b", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e860309-4012-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777058172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058172, "uuid": "275683d8-36b1-4375-9a1a-c8ec7a344fe0", "comment": "Malware payload", "value": "afc665dc85028fb1671c1748b68b42f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "PoisonedRefresh", "colour": "#24B87C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058172, "uuid": "265847f4-3bc0-411c-b06a-14fe10fcd1f4", "comment": "Malware payload", "value": "06565a0786425cbc6a28926f30fb69207473690aa538b8d85c71f5df28981781", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "PoisonedRefresh", "colour": "#24B87C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058172, "uuid": "d9f345f6-acb8-4a73-b5a3-1393e1038177", "comment": "Malware payload", "value": "e5066c2490197ffbe0e916bc232114a61cb09a16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "PoisonedRefresh", "colour": "#24B87C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058172, "uuid": "4c6a2e70-646d-4d62-9013-e0b511b44e24", "comment": "Malware payload", "value": "21dc61300e9f16eccce4b2d57c0973efd4ad4c705529ade217e4306001f63257ba79f183bb460b7ba3572fcc01574c02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "PoisonedRefresh", "colour": "#24B87C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777058172, "uuid": "081e3265-0f05-4833-b48d-230dabd88b32", "value": "T123738D4BB457857DD252D3708AA790349D30B894A21BB93B3A45BF3E1E03628271EF27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777058172, "uuid": "7245d988-9c09-415c-805f-5a845b87370d", "value": "1536:AkyzYiVUwzi/In6p/rN5F1palLp3nol9of:9oxOIn6pz9TalLlnol9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777058172, "uuid": "d3c0cac7-b704-4daa-8d9b-2842de9fa0db", "value": 78784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777058172, "uuid": "284afb13-7816-4db9-ade5-fbf630961ce7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777058172, "uuid": "ae2296fc-85aa-4206-836e-cf6d06a02d4f", "value": "umount_22032026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2385a561-3f82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776996359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996359, "uuid": "9dd1928c-28cb-44ed-a3ca-d5eb0b7521bf", "comment": "Malware payload", "value": "24b6ea7269e838d8482fbcb51e7590e6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996359, "uuid": "5e1c444e-be59-42c3-8e3a-607d3d99ada0", "comment": "Malware payload", "value": "0703f3d9ac2bd194b08a29f9df6a4e1689390a25f20cb2b139edb05c46d5a8f7", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996359, "uuid": "45c32776-196e-401e-b43f-b61e5c6e4060", "comment": "Malware payload", "value": "97dcc0f0bd4c984af02c5611fc2941de8ad11e33", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996359, "uuid": "40f81764-ff43-4cf9-b948-03843cd08330", "comment": "Malware payload", "value": "6fb5f1b0a104a18fe7ff040c6547bb00687c2b74bb326e586a283647ae1b44d5aceeec02e2bee48eccf58f3f4e6895ad", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996359, "uuid": "ec4955df-9427-4c92-b19f-fd0fcbb1ac06", "value": "T13DB09229218B898B3D0655A71B72851C89E099902644ABA5CF0196DD10B8508B9AA043", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996359, "uuid": "d2464b59-3618-4037-9abe-d30db8fe8b7a", "value": "3:FER/8ClVRK+pn2HoIkVViEaKC5iIW0y72cYKHHhn:FERblVR/p2IBnaZ5izXHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776996359, "uuid": "9f22c4c3-2e88-4002-a17a-b1bfe00b53eb", "value": 120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776996359, "uuid": "13f395d4-3eb3-4dc8-8024-64dc1a8a89f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996359, "uuid": "3c3218c2-edd4-4130-a83a-14cdb96a6e6c", "value": "$srt-startup_str_895.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382f5704-4011-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777057812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777057812, "uuid": "d031101f-e69b-478b-9ff9-9df4f73e929d", "comment": "Malware payload", "value": "b5d1e8c80449989cf50ec4f196ab8fa9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777057812, "uuid": "ea9e6846-8355-4965-ad70-f2aaef10e8fe", "comment": "Malware payload", "value": "07a756ab22d85cf1010a1b94c1838f21e023b66c8160adf4224911ce746df941", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777057812, "uuid": "3c62c41f-c8d1-4450-897a-076c4030c9a5", "comment": "Malware payload", "value": "e8bc3303148ae97851b8082ec81c46e38e78b5ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777057812, "uuid": "208d68af-62a9-4c15-a5d4-e44201cb82c3", "comment": "Malware payload", "value": "e0b418fe4caf6e34984912dad40f79edf76994d7ae6041b954b19036dff37175750fccfb322bcfe83c03d9c6a7ca2d2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777057812, "uuid": "e1ecfd0d-4f22-429a-af2b-1d60de3df6e5", "value": "T18E47DF77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777057812, "uuid": "bf785f3c-f27a-4da0-a7ab-ee8d6ad80b17", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQw:cqYUQuVDt0TZEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777057812, "uuid": "124bed33-f8ff-4bb7-8503-92e8859bed78", "value": 25985024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777057812, "uuid": "d7d01c0e-6e75-47a7-b7d6-bc80ca3c3313", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777057812, "uuid": "35bfeb6f-47ce-4d88-82e1-f2344fe9209a", "value": "07a756ab22d85cf1010a1b94c1838f21e023b66c8160adf4224911ce746df941", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a908bbd-4012-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777058192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058192, "uuid": "b6a6113c-9442-4581-8a20-3d41267bd989", "comment": "Malware payload (Mirai)", "value": "293a050298156856a370a6b1570a2ab5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "PoisonedRefresh", "colour": "#24B87C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058192, "uuid": "db61e829-6dc1-450e-9c98-ce0b3edf8b94", "comment": "Malware payload (Mirai)", "value": "07c2849a7bc3d19c4a32b2b06d7d3aca8e08cc46abb61d29cf3e0b8f0041b77b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "PoisonedRefresh", "colour": "#24B87C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058192, "uuid": "7f475439-c820-4212-8d2f-dce534f59144", "comment": "Malware payload (Mirai)", "value": "7a2fc3510b502d8fdc2548f907af08308840851c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "PoisonedRefresh", "colour": "#24B87C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058192, "uuid": "fabc854f-fc28-4e48-bc73-c27b6644ef30", "comment": "Malware payload (Mirai)", "value": "959dbdf91cbe563e5a26d656141d17c95bcc345d61346a5762ecfefca106c9e0f52caa1055b2db5a35677b5bb0bf5647", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "PoisonedRefresh", "colour": "#24B87C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777058192, "uuid": "500a7d16-8daf-47fc-a169-0d1fa3d5da63", "value": "T135D4E876F943D1F5C8633232431FF2BAB6245B6586560C0E6D1D0E28F737A50AB1A2DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777058192, "uuid": "71c4b763-fa96-4a28-826e-a7e0ebca8c32", "value": "12288:kTAxjqTfq9+Ij3HQQBOPhS3PKhBOq6LZPW3SjlLh6Bejy0OCYIRwAYgl:kUxjqHSAfPhS3PKhBOq6LZPOSBLh6Ay4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777058192, "uuid": "53061142-d47b-468d-a9e8-8f41561ca22f", "value": 614188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777058192, "uuid": "c1b493b3-e2fd-4a2f-83c5-187d3ba6191a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777058192, "uuid": "019dc9d0-51ec-4ce7-9678-caf6ca58066f", "value": "httpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6cbc2d9-402d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777070158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777070158, "uuid": "e1cdb258-58af-48b6-8c1d-14a12ef52d5b", "comment": "Malware payload", "value": "00b9d896e190cea3e667294a4e605769", "object_relation": "md5", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zebregts-com", "colour": "#5C0156", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777070158, "uuid": "8ed65c5e-ecb7-4d04-88ea-6a912daef22a", "comment": "Malware payload", "value": "07da682fc914a72bd6b0824b1f7176c2c4c195db9c4f69fe7b4fd917e9d8ba3f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zebregts-com", "colour": "#5C0156", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777070158, "uuid": "91d31513-2814-4aa7-8ec8-5e4549f8eb3a", "comment": "Malware payload", "value": "151cca7796233fb58c26229ad2c1bc6be368e43a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zebregts-com", "colour": "#5C0156", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777070158, "uuid": "507bdac2-4f0a-4f56-bf9f-6961d4b79533", "comment": "Malware payload", "value": "d0c61831ff0fb9f964ff5d8da85146356fce02adf5ff21b3da4481f734e7ac59cffe16c59dec7ee9b76b4bb2526c2dd4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "zebregts-com", "colour": "#5C0156", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777070158, "uuid": "4133f6a5-8989-43d4-afd7-b407a8be1c14", "value": "T1CE04C4E717980AEDAB944CDA810D361764F7C17B2C5E128DF9E24657B03FE20BA25B70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777070158, "uuid": "d72b01f5-c2ac-46e9-abe8-283d616ca650", "value": "1536:xs3cDy7lBJod6iNwt5gJRWCHWJb70dO2Szt2XsT7jcRy3eqXjhRkvc/UQfLwoSFg:xGkkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777070158, "uuid": "2f8517df-bb3d-4d1c-9a7a-888c53aecc1d", "value": 182686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777070158, "uuid": "c5ac8813-0d8f-4cec-9c76-05d6bc09d79d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777070158, "uuid": "ad3ced16-907a-4dcd-b234-9603b30e252a", "value": "extension.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93543399-3fc3-11f1-a769-42010a9c0008", "comment": "Malware payload (SnappyClient)", "timestamp": 1777024464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024464, "uuid": "7358303e-de52-41c3-a986-6f7598670d89", "comment": "Malware payload (SnappyClient)", "value": "5be136aab88d8104b83d1e4a603ebe8d", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024464, "uuid": "41d8d9f9-59cd-47d4-b5a5-ea730f142d73", "comment": "Malware payload (SnappyClient)", "value": "082c873061fdb6a9a7e94f24631b2b9aa8fcc5efa6005ccab81497c84d9002ed", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024464, "uuid": "af2d8b30-2bff-458d-b0b2-c05ec774e3f5", "comment": "Malware payload (SnappyClient)", "value": "ce474e06a90a28154e2a10ca5fb25f3e2baadca0", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024464, "uuid": "29c5acff-fdce-42af-9179-69d8c1f709df", "comment": "Malware payload (SnappyClient)", "value": "b610293f773877a56f0c66e86dcdc768e7f16a0cfa985bb512f51da51aa59b885978265cecef0e8fe7334177c5d77617", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024464, "uuid": "2097aa02-6761-4d80-b7ac-8dfb1b6a805a", "value": "T11DF2323966D7E84293A43E04C4A6F85965A423B157FBCC5CF3CC9BBDB081E611B542EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024464, "uuid": "d142e184-bbe1-4f82-8238-4bb5a9142593", "value": "384:sVe7EEZbOFAmHeeR/CWimKFVrX1BUg+KOcdezeIQ4r2VPbpDS+KNcgUMPUW06jwf:L72AGhdinLXIgLOctS+jpDSTcG8W18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024464, "uuid": "eedb3284-247e-4aab-b9fc-16f618c85a17", "value": 37186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024464, "uuid": "6f87788a-4b9c-45b5-94a8-904bc4bd0358", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024464, "uuid": "4c42f06d-2b66-484a-8146-63701ce0a4b3", "value": "letoltes.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9f9dde-3fdd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777035778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035778, "uuid": "7c6b2c0a-e93e-46e7-8adf-523c651cda7e", "comment": "Malware payload", "value": "663dbe4c5a60239a627aea6b1e09dd36", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035778, "uuid": "f2971fb6-dab0-4689-b6b1-bd15c353f690", "comment": "Malware payload", "value": "0838fa819961d0a56be064ebb4bc6542be2338e17937ec8ca1cc646acb75833a", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035778, "uuid": "83e1811c-5846-49c1-b05c-3d2ea5f5d8ec", "comment": "Malware payload", "value": "fc2e67fbceffdcc7938c7fe569992dff048f6f84", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035778, "uuid": "a9526787-9fbb-4fc6-bfbf-255d01de2caf", "comment": "Malware payload", "value": "3a7f32aa8cf007881fe2b86f7d9f94a1b90e843cf3db02fbb412bf7c7e7dd21e5377d456ecefd71c412b40a4f356c8bc", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777035778, "uuid": "546685b9-d97b-4b1a-a3a7-15a19e5ccea6", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777035778, "uuid": "3770cfc5-3dfe-4794-ab36-431eac053888", "value": "3:VSJJFIqF1F65IFR8ZKMn:s8qF1F8oMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777035778, "uuid": "5d44836c-796c-408e-aebf-6d687d52dbd9", "value": 49, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777035778, "uuid": "427b65f3-df35-44fe-9771-320486d6c117", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777035778, "uuid": "f4dff8cc-03ea-4d3c-8b65-96b7367449f9", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21517919-3fc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777022985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777022985, "uuid": "0970bfab-af5d-43e8-9e67-1217553ed9eb", "comment": "Malware payload (Mirai)", "value": "53ef79f8d39e860d9102a69541bc5fa9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777022985, "uuid": "cbe16fe8-e51d-49c7-93db-7bd8f05048c2", "comment": "Malware payload (Mirai)", "value": "092fa4059dd7a8ffa28111f98f98f067d95f038ee5e461e1a8ecf3bc9345a4ea", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777022985, "uuid": "4a1700a2-ef9c-47d6-b8ab-3b56c244b939", "comment": "Malware payload (Mirai)", "value": "152b09e5161b194ceecfd6c6e5099d1a70e6ce01", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777022985, "uuid": "afff096a-7a75-4864-b891-89718f7acd22", "comment": "Malware payload (Mirai)", "value": "16470af577742e56717cfbd3b5c274a57d4f9c33d2fc6ad15b8bbfa216807522a2d72aa150a58138f648161eb74a11a4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777022985, "uuid": "3781015f-720a-4a80-ba78-a3565e91da6c", "value": "T1A15171C7216801383CB5D61AB1B6E0CDB4A0405A7DFE1F8A7CEE6CA951EFE056C40F5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777022985, "uuid": "4fe58e25-04b5-457c-aa27-596ade6bf332", "value": "48:vFTo0MsF+v9lMsFsQsFabMsFNQNFLbMsFI9ZMsF0JBMsFGawIMsF7wsMsFsh5Msb:vFToDsF+v9msFpaZsFSDMsFI9qsF0JC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777022985, "uuid": "595fc0f6-c1c6-4758-ba20-0685724ac6d2", "value": 2895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777022985, "uuid": "5b043390-5e55-425c-89ce-907152e2a69e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777022985, "uuid": "0e211a8a-a49c-4066-b884-d4df872d6b1d", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b29106d-3f7d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776994359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994359, "uuid": "187bf3e2-a7cf-48f5-82ba-2750eb581a74", "comment": "Malware payload", "value": "133d147c46a09bd7b888983f77482402", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994359, "uuid": "5c2e0e7a-7bf1-49c4-8e3b-6a72c7c235b5", "comment": "Malware payload", "value": "09402c27364c09e22ac0ffe680b889fdb23b577b1ab2f2666486508f7be3258b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994359, "uuid": "a8bacdba-eb45-4d68-b308-84b0d5dd010a", "comment": "Malware payload", "value": "49f05322960f7d96ecf097062054ea4a811113a8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994359, "uuid": "c201936b-a80a-4843-893a-463f9613390d", "comment": "Malware payload", "value": "a8a99d90806c75fb3f0d8c4152ffcae87aac1ce4fe3e26efaa82df486df9a08e2bc0b2e7271bfb9d618e899e5492ebb2", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776994359, "uuid": "425c07d9-59de-4f4e-a62c-af13bbba4f54", "value": "T1D0B0922A228A898B290659A30BB2860C89E095802644ABA5CE0086DD20B9508B9EA043", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776994359, "uuid": "bba9d5f0-a620-45b3-9e6f-8e16bcb7cac2", "value": "3:FER/8ClVRK+pn2HoIkVViEaKC5iIW0y76QYERHhn:FERblVR/p2IBnaZ5iz3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776994359, "uuid": "0b9fe0ae-aea8-49c3-8510-eb70f4c67bb5", "value": 120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776994359, "uuid": "a714a762-4cf8-427e-866c-41615005205b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776994359, "uuid": "b43b62ee-b94b-4866-8de3-d5b3d9163df8", "value": "$srt-startup_str_455.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e797642d-3f85-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1776997977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997977, "uuid": "cd56170a-aae1-4fa4-bf79-ae9ae37fb5d0", "comment": "Malware payload (VIPKeylogger)", "value": "6ea485426b5412c8ad2b4827d8389000", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997977, "uuid": "637270fc-a5ab-481a-83d8-5facd2d267be", "comment": "Malware payload (VIPKeylogger)", "value": "0950c50ec518ed1e395f33f3b9a5d6c171c937c84ceb41f774139f93e374288f", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997977, "uuid": "4c48d669-b075-4cc5-9fb9-a095b00f98eb", "comment": "Malware payload (VIPKeylogger)", "value": "0f6bdbde1b75c03866846d405129d54f0178a9e1", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997977, "uuid": "9f317d7f-c27f-43a5-884a-ab27c4e62fa2", "comment": "Malware payload (VIPKeylogger)", "value": "9cf0a5980c3aea4ea6bcc81e74f363c91760297aa91744389c63ef7708230b3811db169a3927cf36cbc4ea7710c4d246", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997977, "uuid": "396c0f64-fbb6-41c1-aa9f-f77231766709", "value": "T1850413523F376996DD3EEBE4109BFC8CF602C912993E68F699934245614FD0B902E07B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997977, "uuid": "fff7eccf-4309-47b9-b8a7-735d6afd3205", "value": "3072:V6m+3aX8BzytOgqLrGKhhHII7yn+EmTPBNy7zQUCkEeAZu8bGoE8quJdz:VbX8BtgqLrGKXIIwsN6GLRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776997977, "uuid": "4ae6dc0d-c681-4e27-b2b1-fdd9d1150955", "value": 180338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776997977, "uuid": "12f9df6f-760b-4e66-bbe1-f6f1d5c334fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997977, "uuid": "2bf739cd-a4fc-4b0c-8a12-da3efd0d5a50", "value": "stream.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c40f1d-401a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777061695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061695, "uuid": "c716061a-4e5e-426a-b9af-677168758d20", "comment": "Malware payload", "value": "f28b4a78b1b4ac109296d2dab5c7efbe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061695, "uuid": "c82dcfa5-ef3b-4b04-bb38-25d5b0d5009d", "comment": "Malware payload", "value": "097ad25cfa09f5206a946cf2edf8c5589bbd7aa130c184001fcd98b403639408", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061695, "uuid": "db0a5c9b-f25e-4123-b525-7a0a0f335eae", "comment": "Malware payload", "value": "05e1e01b9427105ef3cde3b4add4e6f92c043ccc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061695, "uuid": "6063bdae-ee14-4266-92bc-0d1fd152a462", "comment": "Malware payload", "value": "f5da58ccb1c8106aee561797f17c86e559a4cfc65529875b7faca301c1b97de8803eaa20d08ce03954b9aac8e91e40fb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061695, "uuid": "677c4c43-478e-4517-82ca-80ed020f49ad", "value": "T17C559E6D87A312C1EA7AA70432AE2A1D433E489F14F236497F0D1FDD1F54A7A17B819C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061695, "uuid": "6e9e3329-363b-4af9-ad7b-25e7f4ab13e9", "value": "24576:Frl7yxKk0/u/MjMRR+Athg+TOe3bWumE7yxKk0/u/MjMRR+Athg+TOe3bWum1:FrXC0oJC0og", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777061695, "uuid": "f23483b5-d6ab-4660-b287-aafc68d2ae82", "value": 1386467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777061695, "uuid": "6b46ac61-deb3-4e0d-b118-fa898b549b00", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061695, "uuid": "4b5eb207-87aa-4116-a877-945aace0d023", "value": "40_6yg_darwin.dec.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7dfdc47-3fe2-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1777037947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777037947, "uuid": "cd5dc889-efd3-4d38-aca7-d0680ed07892", "comment": "Malware payload (DarkCloud)", "value": "61bde6c1e5fbc07e1b0548debd3c9a3b", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "mail-mokasco-com", "colour": "#ADDA3E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777037947, "uuid": "eb150b3d-14b4-4fbe-8967-7c38a8c2c1a4", "comment": "Malware payload (DarkCloud)", "value": "0b76b79d72d27af5309d75a68d92e952e2647fc8c1f99b8dcfc138fa5f144bd0", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "mail-mokasco-com", "colour": "#ADDA3E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777037947, "uuid": "0f6a0d6a-ec52-4c6c-9d72-074f1c847ad0", "comment": "Malware payload (DarkCloud)", "value": "03c9e4562148eeb3668f76d96455a4c94019ee51", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "mail-mokasco-com", "colour": "#ADDA3E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777037947, "uuid": "f92bc795-952b-44be-b973-b878fdabacc5", "comment": "Malware payload (DarkCloud)", "value": "b47b16adc51a4aceadcb3b3650bd2dad6ce5ac2ec5764ce08c9f3ffd8cf36bbf708c7a7b2a99d57d60af22c4807d6bd6", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "mail-mokasco-com", "colour": "#ADDA3E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777037947, "uuid": "17a16461-64e1-400d-b646-b86b94f132ec", "value": "T1D83423E6CC2A84CC680ABC4F3F342EBC392661FA657459B53F51C059352D0D8678B5B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777037947, "uuid": "8e2d9d82-5b49-440f-bc9a-95f052584c24", "value": "6144:QuRaFrC0Qhvys8nnkUsXH6btVlYzfAUwBT:QHFrta3GvlYDQBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777037947, "uuid": "46ec9ea4-a11e-4104-a566-a0cccfe072ec", "value": 245305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777037947, "uuid": "b5d68634-4037-44db-b112-4614d289f9ea", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777037947, "uuid": "a5bbdcb3-8e45-4f71-a215-af32c4c57f7e", "value": "Proforma Invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ef9a71-3fc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777024818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024818, "uuid": "19018618-eee2-4887-ad86-00b21cdd59cf", "comment": "Malware payload (Mirai)", "value": "30e8adfcc0ca44c5369ff49bb52fe348", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024818, "uuid": "004be44d-8a87-433e-aa2a-6047ad03b1cd", "comment": "Malware payload (Mirai)", "value": "0b8c2e794d1dce61898960a8e877d94738474e56e0a6cd2efb33e8492c0c2125", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024818, "uuid": "55a11a0c-d414-4ac2-9fec-30322d6c36f0", "comment": "Malware payload (Mirai)", "value": "57530179f978e91777a5f288061ed183c91b6756", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024818, "uuid": "9531f5da-686d-4fa3-83e1-bb5339d6b5af", "comment": "Malware payload (Mirai)", "value": "f3992a7bcd0c0c8d71842db009903b9083e6b9b028be6d8a68d2efd1ad518d93db80547412226e871c08b5269288d5e6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024818, "uuid": "e2c4a267-a214-4165-8237-1ea5442c2097", "value": "T1B0E30B46F8814B12D5D111BAFE1E128E37131BB8E2DF73029D246F647B8A97B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024818, "uuid": "c8b99531-5473-4a41-a6c9-9880c9101526", "value": "3072:jHea4CjNYUDAgp4X8rL0z4aTlwSdzVMAa3LP:TePCjNYQL4XOL0MamIMAa3LP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024818, "uuid": "cd37204f-b878-45d4-9973-c0d631c3b10e", "value": 144156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024818, "uuid": "0fda8a2e-472e-4e76-981f-a306387b9fb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024818, "uuid": "cc710fc0-a371-43e7-b4cd-d57e7d74a5b3", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67fb7eac-3fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777029975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029975, "uuid": "3c205476-2c06-4a1b-aa53-1b8e0ba1385a", "comment": "Malware payload (Mirai)", "value": "6613ccbd2130d1bbed8182b7f3bb3883", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029975, "uuid": "891d0802-935c-4c06-b79c-19a1131519a1", "comment": "Malware payload (Mirai)", "value": "0cb548ea4159131faeba7597eda608d4b9b2a0f67f7702aec5a6ded75771609e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029975, "uuid": "d084c164-9dae-40a0-b893-d520c06919c5", "comment": "Malware payload (Mirai)", "value": "0d0918d0da37c6791aa9ee63af1219920bdae60e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029975, "uuid": "a17c34cf-d210-4066-b732-acbc3010adb4", "comment": "Malware payload (Mirai)", "value": "b93745017d459196af037054e932151c4aff955c104c15a0ec0caf8e98e3f411715007c821714273aca73b9368dbb1b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029975, "uuid": "09f97cf7-e3bd-4ad1-b01f-f5b0766d38c4", "value": "T1F0630891B881A626C2D1137BFA5F008E372457D8E2DB33139D255FA0778A81F0D57F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029975, "uuid": "d0508a59-fb00-48b1-96f2-bb6d203ee749", "value": "1536:yOTgWIYeMlktkUwnEU0+m7FcWS2RM8fhWtu5zPeH:yOTgWLeMDcJS2Rrpeu5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777029975, "uuid": "42e11927-444b-4548-a323-72f8cb4fa8a8", "value": 70956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777029975, "uuid": "8916e8d5-5553-45c4-8447-cc3a739f95c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029975, "uuid": "5e119f6b-3433-4deb-a74b-fb1f89d1d4b2", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22aca30-4000-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1777050823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777050823, "uuid": "8e3851b5-5a22-4a60-a85b-2525baea5c76", "comment": "Malware payload (WeedHack)", "value": "4462d2085dca4cd60496d056513124aa", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777050823, "uuid": "b55312a2-95f6-4d45-935b-598e97c5f9eb", "comment": "Malware payload (WeedHack)", "value": "0cd89507543e2755290c3d6415ccffb8c8c814400685c2b4a576032f200b2c51", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777050823, "uuid": "362715f5-e424-4582-8163-1d061a030629", "comment": "Malware payload (WeedHack)", "value": "df70cc1b947baf1f87de2ec600ad44717f0d6b0b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777050823, "uuid": "274dfc94-3ce3-4b55-a7a3-2ffdb35afa2e", "comment": "Malware payload (WeedHack)", "value": "f0257e0dc69efb06f5cbac8383208ee4b74733431d6cc88aafac33be5c5b47b3bfe3aa4757dd9c8da8a360246be9c487", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777050823, "uuid": "ce2eccea-ab80-409d-9e54-500614963ff2", "value": "T12205F81EFDA8CDF8D85F703004849923B51D5288D8EFE7976CE0584A0C36F666666ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777050823, "uuid": "bce6558d-92e9-4ef5-85e8-2b221a37f6fb", "value": "12288:U8n5uI7rTYWcKNHJ0kunVWyIFhqi9q58DnLPK:Bg8kGb0PW0i9qt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777050823, "uuid": "1cad04f0-1aae-40c7-828e-43248bacb622", "value": 821950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777050823, "uuid": "37d1d5ab-bb61-46aa-8fc3-6b19231b9d27", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777050823, "uuid": "16d2a5c1-3bb3-4280-9b57-cb912415506a", "value": "Donut_SMP_Dupe-1.0.3.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0a0532-4037-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777074408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074408, "uuid": "24a4d063-5fa4-43bc-b317-0ec60dc389ba", "comment": "Malware payload", "value": "19f60232820b34e2c9328d14ebfa7eb7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "jimdifree-com", "colour": "#F430EC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074408, "uuid": "5bf5721b-3a2a-411b-a1a3-8423809ecff1", "comment": "Malware payload", "value": "0dccf5e59a322ca6f4396d38e065d2541969dd2be05b8d75a075e7921b34dc85", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "jimdifree-com", "colour": "#F430EC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074408, "uuid": "b3396b80-e9d3-478c-bcb2-ef508e56ee3f", "comment": "Malware payload", "value": "ed8cc3e3fa347c78423ea1aef8f37e4b2676a05f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "jimdifree-com", "colour": "#F430EC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074408, "uuid": "3ab252a5-1d60-4037-ab23-667490e84258", "comment": "Malware payload", "value": "8ebd4bb2085b9eb243d19f36325e357116ca5abdee2b0dd62f2481b8d81d23c9a96f82d3260e652543261fb114f29fd9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "jimdifree-com", "colour": "#F430EC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074408, "uuid": "460a0f40-8802-44f3-b5c5-bc6f2b9804da", "value": "T1FB1302E313AC0AEDAB8059D6820D760754FBC27B2C5D528DF9E25647F03EA21B616F70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074408, "uuid": "b01cc683-c08c-426c-8dfd-5009541f850f", "value": "768:UgWNtDDo6qdOFoiYQB6k2cDTiezHyspkkOyFFzE0c2:QNVDo6qdOFoiYU6k2cDTiezBkkBvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777074408, "uuid": "85d5cd71-8ba6-4e12-990d-5abf6b15f177", "value": 42498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777074408, "uuid": "16a6c422-217a-4583-adf4-9d67848e3f27", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074408, "uuid": "9f0dd567-ec0d-40cb-bba6-cf043d23a0ce", "value": "cl-ncl-start.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc68e712-3fa6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777012185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012185, "uuid": "18fed6aa-196c-41ef-96b2-67a9ec1ae0ee", "comment": "Malware payload", "value": "068f0c342defe33e4522b91612185a45", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012185, "uuid": "0da387e3-bc98-4cb4-bc33-62a10ea7c6fe", "comment": "Malware payload", "value": "0e2433cdb9d3669b9fa1cd7e342fe865d9f2b5793b01ab62a41c223b07f8eaf9", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012185, "uuid": "081b6830-7a71-4e9b-bad1-e8c7a4817905", "comment": "Malware payload", "value": "22682ee670c0373c49c99c7f33823b23a2c59470", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012185, "uuid": "86ca8cca-d00e-4196-8bae-f4d111939cff", "comment": "Malware payload", "value": "758202b6cb720b84d0b5899da737044375f866d8ebc358ebd01a1508a6462d27c8576b21a0ca60faa9526c2a8fc77abc", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012185, "uuid": "ec2ee84c-ec60-450e-af11-a46d12c6949a", "value": "T1B8646C11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012185, "uuid": "25e0307c-3f78-4ab7-8719-6d5865353d54", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012185, "uuid": "5b5ea8c1-5d98-49f5-b50c-d933a285c07a", "value": "6144:4mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9Q1:z1iw7gryNkSV1hy1Z1u2JLI9Q1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777012185, "uuid": "7b68e26b-8c1e-4f84-9f8f-a3b6348f1cd4", "value": 313992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777012185, "uuid": "f701e80c-3368-49d9-82e1-0551e92bb698", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012185, "uuid": "dac89cab-a272-4e37-98a6-d4e426bbc367", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff277b11-4003-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777052133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052133, "uuid": "120d3877-1caa-4ba7-bd43-70c98b2ab842", "comment": "Malware payload", "value": "b2eeb6d3752793cc57e079b66b2032b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052133, "uuid": "72146623-c307-4248-a97b-c7cef9981179", "comment": "Malware payload", "value": "0eebb779134cbf7fd8a98104fcf05798ec0ef073dfaf0602ac17dbe42bb899e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052133, "uuid": "0d0e5bc0-c5e9-4075-86ed-b6a79cc4ed5f", "comment": "Malware payload", "value": "78ddddcbcc0d7e56058d1cb920b2cb7ea8e69dc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052133, "uuid": "f0de753c-686c-4d31-bc4c-2196a057a34d", "comment": "Malware payload", "value": "bae945ff0b8e1ca3e4bb5e0d7515d0b924a96d69c5afc3633dff61153341b477b44a5f70fceff75c75065fff2939dac7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052133, "uuid": "049052e5-9247-4022-a8dd-03703ee04721", "value": "T13575D153EB0A0F97D0EE8F34C41A829B03686D939951876EB69C3F9D6F3E3954F81448", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052133, "uuid": "51f87209-da20-4d9f-839c-3d338d007aca", "value": "49152:SPS3333333333333ZI3a33333zyNWeg6LfnoSNgigV:S63333333333333ZI3a33333X96zoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052133, "uuid": "72dd251a-8139-48bb-acfc-aa7c6d8e3f78", "value": 1640815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052133, "uuid": "ddcf61ff-d1c8-4468-8aa1-7cf7a0f5def7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052133, "uuid": "69608e0f-a8c5-4dc2-94d4-77a4d9b12b1c", "value": "bot.mips64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ac443c-3fc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777024928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024928, "uuid": "27db261b-c004-4d2d-a2b8-79cf9e5bf437", "comment": "Malware payload (Mirai)", "value": "aeda8a10a23b428daa0c7d9aada0555f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024928, "uuid": "a43d10aa-cf0d-4554-a0f3-744e53e92bdf", "comment": "Malware payload (Mirai)", "value": "0f818c18e2da8575cd50046b12f51252a885979726703d73faa950ef510ab3f7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024928, "uuid": "f7632e24-2912-4acb-b88b-f8696a6ccaad", "comment": "Malware payload (Mirai)", "value": "5be5911edca96ade543bfb4faca798448be2a9ee", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024928, "uuid": "ab363fb1-d0d2-4ad9-bd36-3056a54b06c9", "comment": "Malware payload (Mirai)", "value": "084254c4935f89adf3a197c08bcd6e729adc02b30722b1d24e939f0d1d822535ddebdccc62c55d0e0d5681143b72a167", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024928, "uuid": "6042e4e0-fc2e-4bec-85ba-9e41c41309f5", "value": "T141D35C17B5C180FDC4DAC1744F9BF53AED32B1A91238B26B27D4AF222E49E205F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024928, "uuid": "54f3a5b6-f9a5-4871-846d-04434d6fa3e2", "value": "3072:79eSuygEPjt6qkWq2dhmDnYMb0oBd/gQyVGsdqml69aj:79eSuygEPjt6qkWqs2H2la9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024928, "uuid": "5effab35-7007-49b7-84b7-411d40703568", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024928, "uuid": "968800bd-b292-4faa-8653-57c03779e323", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024928, "uuid": "d8164216-9c19-412f-bfed-47be415b2b63", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b15fa74-3f9c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777007620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777007620, "uuid": "e95f7216-5a5e-4098-a6a4-828f34ca92c3", "comment": "Malware payload (Mirai)", "value": "5feed26318bda4fffee974c87b65c8e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777007620, "uuid": "08e5f235-d4a8-4566-9051-a49b5320c2d9", "comment": "Malware payload (Mirai)", "value": "0fc6dbd9a55073e519ea92881fc84951d6493ab4005390fa6215320b15943552", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777007620, "uuid": "a0808015-8c59-4211-8462-bc1149dc1f25", "comment": "Malware payload (Mirai)", "value": "ca75b4cd23050563ff95cce3a94550b208dc429c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777007620, "uuid": "f17f2787-1692-4cd6-9d8a-c77b98d5ed2d", "comment": "Malware payload (Mirai)", "value": "bcad23b81d9f67ab9885dfa709819e1b9a2a0cb6d339c762f8a60f4e1fa890c4299249b23971fcab6447b46c7d590b88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777007620, "uuid": "47777888-79c7-4f85-8c89-857bd2dddf11", "value": "T123247C99BA4F7E82D2C6D3F89F8BCB91312731958A4682F53D01132DC5C6DD98CE2B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777007620, "uuid": "5378d2c8-7bd3-4edb-b234-dee3650b64c2", "value": "3072:aAfDqt09HLyWC3ERktewb6wqAPpTyNA1gveq1vJj4tejq8:aTtWyb3Uee+tqAPpTeGseq/ccjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777007620, "uuid": "9d1a874a-c5ed-4fae-ae48-58127f6b9c92", "value": 211008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777007620, "uuid": "be2b605c-58ed-4d44-98db-03114f581c2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777007620, "uuid": "99c020ab-c10b-4cee-8d1f-cf9f9f5bf8a0", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157e5465-3f79-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776992470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776992470, "uuid": "0b5886be-acb3-441a-ac14-7de1ebd934eb", "comment": "Malware payload", "value": "89425fbccc7bc36062a82033043eef12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776992470, "uuid": "1f2b5759-617b-412e-9b3e-be13a5f1bfd1", "comment": "Malware payload", "value": "10a1aac9eb7707893306482216b9174dde795c20dd3ea69d8c5730f5f503f33d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776992470, "uuid": "ce77c211-e4d4-4914-a963-16969ae087f3", "comment": "Malware payload", "value": "6de87725ee0b65b40c1adedda7b154a793676759", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776992470, "uuid": "44b80b46-8080-4c30-a881-b53e77f15a7d", "comment": "Malware payload", "value": "ce51bd5eca7aa3aa6bd4a5e3c4c152b47d8d36fb9785b43b909aa5b5c907ad8eda7f11984500aa4c16888fc6eefb9d91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776992470, "uuid": "b65ca6fc-6faa-44e7-9cb0-9bd8a4c85aec", "value": "T1BEA68C73945224D8E1A9C9B4D1141652BDBC3C8B5738A3C7BAC471F65BBABE48E38730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776992470, "uuid": "182bc5f7-2433-44e4-a25d-59949c394d1c", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ5:cqYUQuVDt0TZEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776992470, "uuid": "0df64ac4-2f7a-494d-8b2b-290f15290a27", "value": 9895936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776992470, "uuid": "121a0be4-a43b-4a01-b35a-efaa61459665", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776992470, "uuid": "5d0516e2-51d2-4d0f-8d81-9278c82a8ccd", "value": "10a1aac9eb7707893306482216b9174dde795c20dd3ea69d8c5730f5f503f33d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70aa8124-3fd7-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1777032996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777032996, "uuid": "15edd28b-0831-4ae4-95c5-83e2901767ac", "comment": "Malware payload (VIPKeylogger)", "value": "9b79ef9dae388e3c2823ff29cb2591ec", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777032996, "uuid": "39d5a5b3-2618-4177-a8f3-11fccac2b7e4", "comment": "Malware payload (VIPKeylogger)", "value": "10a469c846cee31f6cd4b2070fe14e1efce95ede9c6be91e4507722c0e980aa7", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777032996, "uuid": "074950a5-422f-4f63-a427-569202f547d3", "comment": "Malware payload (VIPKeylogger)", "value": "87594d25c107c435ff05af106059ad50fcdcd59a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777032996, "uuid": "676e4695-94dc-4ef4-a7af-c92b212bb90c", "comment": "Malware payload (VIPKeylogger)", "value": "f7c886ca8fbe55b9fa462ff3ab2dabb7fe87e93ff151454a30ed64dfa11fb2fb667e2c90dd328a8bc6e4bc829dcc5f1f", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777032996, "uuid": "4b18d075-e1a4-4fcf-96c6-cab8fb5860a4", "value": "T1628423A61ED5CDF68CB91F74412AA7308D9013E60A588C86B9EC77CD2FD9E808ED1D4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777032996, "uuid": "867e72d9-e1c4-4d2d-8f7c-7d04503b4290", "value": "12288:YVAo9YMrFz2cpr3wCYm3xbpfqq8JejgHp:HoiUN2c2O3xbpSJeqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777032996, "uuid": "83972e56-b41a-43f7-b57c-1cac18b72a0c", "value": 402887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777032996, "uuid": "a531a5f4-fa9d-4a17-be85-cb7d7838dfd3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777032996, "uuid": "39a2f2f5-6505-4faf-b852-e0e8c25b7481", "value": "TofXANGh.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ca0345-3fa8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777012704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012704, "uuid": "86172ae6-0f72-4015-9f28-d0adf03bb057", "comment": "Malware payload", "value": "3f49c9a39c371356010a711e65782972", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012704, "uuid": "341b8a58-c06c-4d87-bfe4-7bea8af3def1", "comment": "Malware payload", "value": "1240bbd495a652a6dc20d31a2ea84eb959a2ffd4e33e809276c4a9095487e7d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012704, "uuid": "a6679bd1-e4c6-4b98-ab18-88dd559ee978", "comment": "Malware payload", "value": "d7934f032b6afc8bd37d7ace38753880edbfa3e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012704, "uuid": "151a6ca3-b26c-4907-9626-0b0ec5fcf703", "comment": "Malware payload", "value": "24d4000954b473de7a506527afd9c1db8fe54a5f72b7f15a147e7040a8b7e39da2fe2b2d5bc0adaaefce37b1db421056", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012704, "uuid": "472dca76-4aca-4f94-9d61-5d3209678c23", "value": "T1B2B32B49E9515B19C2E331FEFB8D418E33171FA8E3EA3125D9307BA023F5ADA0A76511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012704, "uuid": "fb75063e-92ae-43e8-9e24-e0769481a0f3", "value": "3072:+m6A5XfaThVIMQBi+DivYoOmaVWq5dW1nC:xfaTHIMQBiXv3aVWq5dMnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777012704, "uuid": "813b8628-aa20-48d8-9864-7cf5924bb2a8", "value": 116056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777012704, "uuid": "7748bc54-7c29-47d0-a53e-e3c95cc2751a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012704, "uuid": "4bbae7d5-3274-448e-903a-1f44466c1520", "value": "ARMV7L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d2e3ca-3f82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776996367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996367, "uuid": "12e67976-593a-428d-9661-7cea8d74dcd3", "comment": "Malware payload", "value": "2aeebef6ffaef4dc9edef17ac038f348", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996367, "uuid": "051350b1-7094-47c8-930a-b2cc4f9127ec", "comment": "Malware payload", "value": "1248b89cfd20420376a740e4005d6912420cfa78b85130652deadc3fab70cc05", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996367, "uuid": "af85ae43-8afc-4c4b-a419-6e6abdb118b9", "comment": "Malware payload", "value": "732910c3f2c29718cb57ac69622b5107c2c5b807", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996367, "uuid": "7cc5dcdb-5a7e-4d77-bada-8056ff05b095", "comment": "Malware payload", "value": "4bcb7fbcf8e3f3e904b5d926e9c15b57cf03e110bef9961aa5f3c0192ccf8f0db4d6b21e033c8e41ca055af823d1b7ac", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996367, "uuid": "e7ec7d40-a222-4c89-9703-8526255f5077", "value": "T1A4C08016817EC50ED56794920572951946A0EF4129349A318B40988871554906206042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996367, "uuid": "5f88f603-44bc-4935-8853-a163e92204b8", "value": "3:j+qAHmFEm8nhcDQBfBJpoNIkVViEaKC5SufyM1KvN+zsPcHhXpv:j+q9NqhnfBboNBnaZ5SuH1mQzskL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776996367, "uuid": "9a104065-4d47-4706-8326-99623832bef1", "value": 160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776996367, "uuid": "644b8113-77c5-4338-b229-a471a952cbfd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996367, "uuid": "cd8ee330-448c-4e91-9629-8c6f3bcf0eb7", "value": "chart.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc94effd-3fdd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777035808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035808, "uuid": "d0b6efb8-292c-4b23-adad-bb21b0e54c9e", "comment": "Malware payload", "value": "08bea2d932f81bd98c5213dfaf546b07", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035808, "uuid": "2ab5bbf6-7b10-4343-8635-1920fbc45a3e", "comment": "Malware payload", "value": "13b10bfab5e95d07ccc1e708866b4331e1dbf2230a242cc9c050ee01a5eed6ec", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035808, "uuid": "c221006b-d34e-4dd7-9458-320405708542", "comment": "Malware payload", "value": "26d86787f10ef879f33fbf7dcbd29645b682689f", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035808, "uuid": "7619dc69-aed0-4010-afea-8ec9c40ffb44", "comment": "Malware payload", "value": "aaffc6b9f63b43cf5966477f87474e8f6a6b68b7d72ebe50b2dada32a9467f1f7515d05bb7d5fae62eef93de8dcacaec", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777035808, "uuid": "95db4144-244c-491c-85c9-b7b31d866243", "value": "T130C5E19233DCFF47D541CE3BBA14E679419B9E229DF6E08CA563270909B96018F34BC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777035808, "uuid": "e6477d1b-5b21-4c11-b780-df5a730eb541", "value": "f83b773d6aefb66ee07af0238fb09c73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777035808, "uuid": "d47a37ec-c452-4583-8407-30cb84074f0f", "value": "49152:c7Z+eQk7rOmk5QBxOV1UlDzjzhBtohM+XLZBepdZjNFUkafGlI13uWbj2CgPppBW:iFQ78xOXUlD/z7toCJZjNFUkafGlI13v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777035808, "uuid": "51936a08-c3fd-48f3-869e-f36bf9a8cd25", "value": 2623488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777035808, "uuid": "a6878a9b-b060-4829-b242-8a650386c080", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777035808, "uuid": "1165eb87-2f24-4e5a-ae50-85374cf257f4", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ca9ebe-3fc0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777023066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023066, "uuid": "47a1081c-bfa1-4c92-b11a-266e5856ba82", "comment": "Malware payload", "value": "103adea4ecfc421ed528dca96a615e58", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023066, "uuid": "4d1f0a80-3426-492b-ace3-efccbbec3ce9", "comment": "Malware payload", "value": "14d641b575b7e4c717e3c26aac3ed2c48ba08ec8c6b3ec1b016c453fb4d33af3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023066, "uuid": "6d7945f2-b002-4ce8-aaae-c0ba951d7a56", "comment": "Malware payload", "value": "dac41c254e639ab0a683e095ec63bea400ed2db3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023066, "uuid": "3ac515d8-edaa-42a6-b069-2a3b52cc5e73", "comment": "Malware payload", "value": "962f20d5e6c207bd5a89b2135e7081306345ea42c8b013a3cb0a971c65b2f0220426f8c40e76c9352da21574488a99ed", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023066, "uuid": "a6f355cc-b54a-497a-8bc7-276a7c5c55b2", "value": "T14A75D193EB0A1F97C0EE8F34841A829B03686D939552C76EB69C3F5D6F3E3954F81448", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023066, "uuid": "8f5b1022-e23b-461c-853e-991da08aad65", "value": "24576:xxc/VPsVv2PnS3333333333333ZI3a33333D51uIOHX7j17srErzxmttSPOYpWOQ:SPS3333333333333ZI3a33333zlrOISK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777023066, "uuid": "119f8142-c7c1-4239-a567-6c0dafb4c97d", "value": 1559216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777023066, "uuid": "d86852ed-cc8e-4ac4-b2f1-6f1f3e8763d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023066, "uuid": "0b9b6822-3fd8-4777-8e0b-ed791732fc93", "value": "bot.mips64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c13ffb-4031-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777071825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071825, "uuid": "795cbb7c-5df4-49d2-9c13-4c4776459a30", "comment": "Malware payload", "value": "1fcbe52392533408a4f904d08af0eccd", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071825, "uuid": "3b746d1f-b009-4cd9-8caf-9a464b15e3fe", "comment": "Malware payload", "value": "15a403882bbe98cc3b5a1556455a067081ebf7a014e8e7dd4ffb7c6a25fcefd1", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071825, "uuid": "f9d12163-7fbb-4397-9f7d-25740377e125", "comment": "Malware payload", "value": "197281d6c7306c4d5c0feb5b13b5b9b88e4c90ed", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071825, "uuid": "84481d03-126f-4045-87fa-f21b828dd919", "comment": "Malware payload", "value": "9869055af873a5b1a2595f647d690de3a5c05c65abe05a87d1a1c73060ab07a828e81b110ce660f3f9a2fad733c7a423", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071825, "uuid": "4d639671-c32e-4f6f-a272-caedfa45f316", "value": "T1A5551240256F2B60CDAB306BA06F1DBD599E1A0E4707F8E36E6597C41727A8095E3CFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071825, "uuid": "e615877c-d33f-4067-8592-35fa244bd844", "value": "24576:PUgDRtj9XRQfU8SjRkXxVyLYcOqxrD/X8RtdjrQZtQYvHHJzbxHHgb:nJqIGhVkYcJZ7AfEb9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777071825, "uuid": "87edb6f7-636f-4f64-905d-dcbe705803c0", "value": 1398142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777071825, "uuid": "bb82b6a4-739c-4a88-98a9-aca792922311", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071825, "uuid": "02e1c869-7b93-4954-8ddd-ead2c2908d1a", "value": "update.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c73ab08-4033-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777072369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072369, "uuid": "ef245802-1266-4dcc-9920-f917170acec1", "comment": "Malware payload", "value": "aaacf54238991cf96be031e16b1bab5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072369, "uuid": "0d27e358-a9db-4137-aac3-0447f5f05490", "comment": "Malware payload", "value": "15be4beedf0e21f691117cc0ff4c4903603fa98096d2e55316a79c0689d33434", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072369, "uuid": "49e290bd-c483-4716-aeac-920e04940972", "comment": "Malware payload", "value": "2b31d5b6a7ed97a1b5b3fa9c9256487e126f8de4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072369, "uuid": "b21eb608-f13a-4eab-8d44-3d69cee19620", "comment": "Malware payload", "value": "4a0ee61d5e252d536986bc1de309ccb72a8bccb30e9089dee56b0a658518d7080226133d96615fc1f72beb8dc8b4c3fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072369, "uuid": "ac513a39-c5f8-424b-9a48-23be6019cfcd", "value": "T1CBC43806F8809F62C5D125B6F75F8268731747B9C3EB62069A189B343BD786F0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072369, "uuid": "3f63ddd3-c112-453e-821b-71cb40f599bc", "value": "12288:Yh7I9PgGukCQhysbwnopiXQ8gJodJm43F8prPEfbP24pMDe5aRrl:o7ILu/QksMnogXQ8g+Ym20MDMaRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777072369, "uuid": "66ecc887-1875-479b-bb3e-22796f6384c0", "value": 591396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777072369, "uuid": "d4c574fc-edab-4d4d-aba2-4d9e269bc3bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072369, "uuid": "3f414daf-b926-45a5-bd94-84be9ee01af8", "value": "l_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c854c38-3fb3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777017447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777017447, "uuid": "7eec46fb-89bb-43d2-be40-b4ccae7c7f12", "comment": "Malware payload (Mirai)", "value": "0ca2a40e9c0fa7f9d51f252bd4c43003", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777017447, "uuid": "d53b15fd-5552-433c-9f43-b3b3a0f7e458", "comment": "Malware payload (Mirai)", "value": "1608f9c477cd52dd4f36eb9af46cb65d7a719019d7ff60e858446c397cc75bde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777017447, "uuid": "251b9dd5-bc10-4b0f-a2a7-9be45b2f92ae", "comment": "Malware payload (Mirai)", "value": "ecd383415971c8408fd9508281ff3c66151b6a94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777017447, "uuid": "edd18c0a-9def-4919-ad44-9321df20e283", "comment": "Malware payload (Mirai)", "value": "99b918ef8aa47c5289f1c027a6234be28445c47f7ed0ef6fa75dc0902c5ad5bcec947c7e90109bc4ec9863df68c55e97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777017447, "uuid": "ed9c3366-71ee-46d5-9f6e-4c0e71d9fff7", "value": "T14A632B46FB03CBB3D84315F201A7AA6A4A31FE3A4C22CD86F3647DA4EB325C16615775", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777017447, "uuid": "0ada881e-7b90-4524-a5e7-91f5f7836b6e", "value": "1536:CmiNIYiApIWrvA/AHWzG/7lAQMKp954P/VBRbq3PmwdgIV:5YixWr+dCZAQMKpv4nVBRbqjK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777017447, "uuid": "841943d2-ee40-45c7-9096-4312edcfdc11", "value": 70208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777017447, "uuid": "ab2a5a82-7abf-4705-b23b-26ff91cf620a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777017447, "uuid": "f6f1d5d3-394f-492d-a641-96dfaa8bec99", "value": "I686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439e9474-3fbe-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1777022183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777022183, "uuid": "6cfdab05-1c42-45ca-83c5-98a25b224e3b", "comment": "Malware payload (Vidar)", "value": "0fc815e761d188eefea0120832bfae10", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777022183, "uuid": "729a2f7a-20a3-422e-9c3c-a1098f76042c", "comment": "Malware payload (Vidar)", "value": "1613a28b4f5c3d528e1d6a9e40a76a941af28cb8f671d9420235ea5923f7f585", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777022183, "uuid": "623b947c-8af9-4809-842f-42d5aa19de0a", "comment": "Malware payload (Vidar)", "value": "e18c6af95cb142f90f3ccae7b0ab9680b47a0877", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777022183, "uuid": "9201bd9b-9d6d-4839-a73a-86658613c256", "comment": "Malware payload (Vidar)", "value": "092dc8b2ed0c01c6983b1f62ad85803725d3e3f1aeedce019553478b65f6fe40265d1e6be640538d03bc67f6e8bc12ba", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777022183, "uuid": "f1ce0673-835d-4760-936c-61a45033e56f", "value": "T1E2B57C027C9105EDC099B73249F23581BB35B8190B3A37D32E92AA743E37BD15D7A74A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777022183, "uuid": "36571a0a-f580-4e9f-b754-06acae91bf0c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777022183, "uuid": "d56625a1-f327-4835-ad62-34af2b8e8e79", "value": "49152:JUnWfYUcL5WLBc75E2QwETjx9kSMC73fngq6USjdm:JLKlWBwETjfTw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777022183, "uuid": "e229005a-492d-4b6b-8e5c-e624d53c97a6", "value": 2452144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777022183, "uuid": "085cd819-6ac2-420e-94ff-81b7bf25126e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777022183, "uuid": "77526226-ab59-4952-b036-80a545d4adf4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d86bb97-4013-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1777058734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058734, "uuid": "423c3d2f-be8b-4f1a-a170-e46d99ebb2f0", "comment": "Malware payload (DCRat)", "value": "5aa3659d8379d7df25723ec91b4c4948", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058734, "uuid": "7b4ac322-2893-4907-a19c-909313fc6b9c", "comment": "Malware payload (DCRat)", "value": "165b1c1b49febea0873894eeb6c808170943d02da8cb7fc3fffa636528b339b2", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058734, "uuid": "2a3cc8ed-5529-4953-9278-070922bc0ed2", "comment": "Malware payload (DCRat)", "value": "b50864141b0c726b0b4b805d2807a641c16ccf17", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058734, "uuid": "96b55548-2d9d-4b60-a38b-7a5c4ed92294", "comment": "Malware payload (DCRat)", "value": "3e88da4a9c88ff58f5e2ffaada20342cf89c0d515293c4bc99a0d48674d5990515a6c09b5b7b11d898cd1977652de8f5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777058734, "uuid": "23113053-aea0-4737-bd3a-a1580675000a", "value": "T16B4549017E448A12F0191633C2FF464847B9AC516AA6E32FBEB9376D55123E37D0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777058734, "uuid": "97ad2cd3-4024-4032-8c89-b19b2275c173", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777058734, "uuid": "826f6319-3135-4ec0-ae63-4f7d78938792", "value": "24576:U2G/nvxW3Ww0t4bzRah02RQ530uBDduu7bcEry:UbA304bN+ROCuL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777058734, "uuid": "a2a5947a-97ec-4d1b-9cc9-f743396930f9", "value": 1164415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777058734, "uuid": "9ea3181c-c4a3-4700-9a1e-9eb3ef152a4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777058734, "uuid": "806d9807-625f-406d-af5d-bb0a3011dad8", "value": "DCRatBuild.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d9e477-3f7a-11f1-a769-42010a9c0008", "comment": "Malware payload (SuperCardX)", "timestamp": 1776993107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776993107, "uuid": "03deb66a-eec1-44f9-b474-735e8669d53a", "comment": "Malware payload (SuperCardX)", "value": "d6716468752179059d2194f0a73ddc33", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SuperCardX", "colour": "#322C56", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776993107, "uuid": "d5fa2693-ea92-44ec-9a47-96950685766b", "comment": "Malware payload (SuperCardX)", "value": "16f961b4f3f974109ae0de2546b092138bd29dcc1b8ec12efc487d34ddea2bd4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SuperCardX", "colour": "#322C56", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776993107, "uuid": "7bd14060-67b4-44aa-88fe-752124c094a6", "comment": "Malware payload (SuperCardX)", "value": "6444c6479f11358ba9c6a828867683be6eb0840d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SuperCardX", "colour": "#322C56", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776993107, "uuid": "6d343e89-67a3-4bcb-a757-f69a13657434", "comment": "Malware payload (SuperCardX)", "value": "a51397ac5b7a17452244b111ec14bc537f13a8cf3311ab692911ac90f349fec481a8d062ad08b5e617b28136c458c653", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SuperCardX", "colour": "#322C56", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776993107, "uuid": "aaa9032f-6e0e-4ecd-b746-23a33b8ea2fc", "value": "T13CB612C6F7D8A92FD83750B2CDB952B2114A4C068743DF576919730C69BB6E80F4ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776993107, "uuid": "c384d9e3-754e-47be-b43d-7a44d2949f7e", "value": "196608:F6hcWU9EKJAQHdgdIPJKCAHL+PE1HUgb9qPzXHEqq6IMRIQYr/oq3nO6Lf4Jt:IhGDJAkd+SFAr+PI0gb9yzXHE+IxQ2gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776993107, "uuid": "c8e8e81e-583e-488f-9079-525719222541", "value": 10924735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776993107, "uuid": "9040679b-b66a-430d-aee1-6af2fa9df923", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776993107, "uuid": "e887f8e6-ad94-4ab8-a798-a7fb61f18370", "value": "HANA_SMS.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be182cc3-3f85-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1776997907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997907, "uuid": "18dd9216-1fa1-4c18-bec3-ece97843f2ac", "comment": "Malware payload (MassLogger)", "value": "2f4574f8aff31dec6fc0c7ef31a51f85", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997907, "uuid": "790e39f7-7cd5-4ca6-a0ab-80b7c2180e8f", "comment": "Malware payload (MassLogger)", "value": "17c2f81cc2e3b987c9790caf88bfff34fec7cf00b4dadbe6ee913e482dec925a", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997907, "uuid": "1606b41f-13d4-4b06-94a2-f295c9c0d202", "comment": "Malware payload (MassLogger)", "value": "dc2e9244dd7e822a4a27595bc970b0cc64432fa1", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997907, "uuid": "d28f1a9e-e6a7-42dd-af9e-a71adbddcb1a", "comment": "Malware payload (MassLogger)", "value": "11a21abb6fa69308f8f5396e3b0c5dba6806a2871889575b51d1f4c2f5babb7f2a0d28ef1f9a3e011695d7ac3571717b", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997907, "uuid": "4ffb99d8-a0e4-4e33-a11e-92e301e00fec", "value": "T101041231FABD84C9150CE724B0CF1E11D7FB2A6244BFA64683A720931C9A76CF56856B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997907, "uuid": "9ef8e13c-0768-4cef-9a4c-d7415d1ee290", "value": "3072:5FAHkZYYXJDZc7asC1L7zTK+gBt9LsAqWvwZ/Y5yO48LmkKn66hGKuJuj:TAHuJ9sC1K9BtVHqW4LO48qpnHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776997907, "uuid": "8aad1619-3909-4cc5-a55a-9816c14bf790", "value": 173725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776997907, "uuid": "91582ba7-51b3-44a1-b5a0-4a487d3d9f40", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997907, "uuid": "65b3bce9-341e-47cf-86ed-a72ac8c536df", "value": "ESCAPE.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed1f81c3-3fc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777026333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777026333, "uuid": "296da8c1-8f08-4248-a78d-37458636624b", "comment": "Malware payload (Mirai)", "value": "0ab1fac88fc74f5da11076047752fcca", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777026333, "uuid": "bb428950-207e-4878-b435-a346c53fc199", "comment": "Malware payload (Mirai)", "value": "19831ec7fd93f7f4adefae92370a360645b9f5b84f1c04b7f1d077a954152f21", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777026333, "uuid": "9f544048-f010-4abc-ad9e-28b522c43ee0", "comment": "Malware payload (Mirai)", "value": "4a0164ae2bee797489828aa3423f6eebf6b8d600", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777026333, "uuid": "e3a13653-c420-4159-9de0-b00caf44c0b6", "comment": "Malware payload (Mirai)", "value": "3322cb9674857fd73946d9b6b3da48f4116d5a36e03a7e9745f078a811e7816683d95366293757d4587a1b1e181af3ba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777026333, "uuid": "81cd6478-bda5-47c3-9082-5054cd94f1e3", "value": "T116F2F1DCB4894235C912F679561C99AA05662AB40FD7FB06F036F2FEC2F50BB27B0095", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777026333, "uuid": "7b18c6bb-5236-4d8f-8e30-a3b5b6ecbc0a", "value": "768:+X5qCmK1MZJCilkcXAA18PkKNKxITHFAu4GxB+93d2:BK1yvkcz8MKNTHFAkBq3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777026333, "uuid": "16b638b0-3c34-454c-a5b8-31e61bcf1201", "value": 34532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777026333, "uuid": "1fbbbd23-40f5-48c5-aae2-890b8cfabf4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777026333, "uuid": "893586a6-5638-4c3f-89e1-a3c91b401da5", "value": "vision.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f420db4-3f82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776996352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996352, "uuid": "a55af147-5c67-46a1-bb2f-b6d9a1b2d7e3", "comment": "Malware payload", "value": "e10ee5aca1110943df795430addd4c7d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996352, "uuid": "4156752c-0136-4f8c-8846-4e2a7378f4c2", "comment": "Malware payload", "value": "1bd56ac941693acf0df95859305e6a2d54d9abe197928c68c49bf57bc90f08fe", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996352, "uuid": "7a371205-1030-4f77-a2ea-eeba85f6bbd3", "comment": "Malware payload", "value": "6164b034e2c6f95c2052a3d224d276f589bdc2fc", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996352, "uuid": "2b433fbe-65da-407b-a276-0fb5a120e4e3", "comment": "Malware payload", "value": "43bde51c6d13f50eb27a1ca325ae9d3f28695205808f4fe29a5e313482629a607462bad11aa75b4bab3fb6cdba6dea06", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996352, "uuid": "06de423d-d794-48bc-a6a4-c2e50df2d334", "value": "T14AB0923D218AC98B294655A30B76854C89E095802544ABA5CE41C7DD10B9508B9A6103", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996352, "uuid": "8c9505ff-9c96-40cd-9f42-2b140bdcb50c", "value": "3:FER/8ClVRK+pn2HoIkVViEaKC5iIW0y76d4Hhn:FERblVR/p2IBnaZ5izS4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776996352, "uuid": "017fcb2f-2a71-4e12-ba3e-73c6b8698781", "value": 120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776996352, "uuid": "5a8cb04e-9c2c-40a1-974e-0bc90903dd63", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996352, "uuid": "e43cc2c4-ecee-46df-a1a9-c904b37cc30a", "value": "$srt-startup_str_486.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159c51ae-3f9f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777008792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008792, "uuid": "82053992-cef7-44e7-bbfa-ff8102f3fda3", "comment": "Malware payload", "value": "ba56ea56b079a750e43af2688b96d201", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008792, "uuid": "ba7e8fb7-1547-41b0-a820-6aedf5fddbe5", "comment": "Malware payload", "value": "1bde358e28aed0805f12946c2a8995da1b986f59f75a332e121d78948e2c5516", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008792, "uuid": "7689f878-b7aa-48ed-b8e9-7662a0e0ea7d", "comment": "Malware payload", "value": "0300b69d374cd226a82160b6824b49324b3fdf22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008792, "uuid": "85eb6862-7ff7-441a-ad3d-f7ce0ebdda8d", "comment": "Malware payload", "value": "011dc8223907ffe563bb21f87c50c5d5a2b1f1e1e156184af4a8004ee0f3530dbdf0c1a4a1ff8e8e837e408ded28e923", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008792, "uuid": "ec63ca1b-0d09-44c0-8450-2c3f3a21a0bd", "value": "T1F7530210C1700DC8D0FEAF9B4A65B335EF715EF876A3C4F224D2D961F066C688A856E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008792, "uuid": "e0c2d0db-2405-46b4-9b9d-902d34e31add", "value": "1536:EkiUPzu+RfXY6li/0lbsj58R+ZrBHshWDZBHV2NJG0OF7uaEyL24u+qgw0VuL:I65RfoqS0lbC57ZLDZT2NJGhzf24u+qx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777008792, "uuid": "0fa512ac-2659-4487-825e-bc98cbdb802c", "value": 64264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777008792, "uuid": "d32f559f-ad58-49d7-8675-8be75712ac33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008792, "uuid": "ecf1d986-f6d0-4762-ba56-f0074f6e761d", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261b7944-402c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777069378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777069378, "uuid": "86ecb300-ffd4-4d70-9592-b475f2c77821", "comment": "Malware payload", "value": "1d6bb3377c9171f2d9916adb0adbc338", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777069378, "uuid": "f4388b19-cf74-49c7-af6e-1be0029950c7", "comment": "Malware payload", "value": "1c531a7e486eae9043b059048689f529db7b6a7eeadd47ad98915d1d38d3c8ee", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777069378, "uuid": "645eb17d-9195-4fd1-9991-b0d42c077fa7", "comment": "Malware payload", "value": "236e61840bc954b616c751a6b560151605742ecd", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777069378, "uuid": "50037fbf-5941-4b6f-b182-cfd7761cde05", "comment": "Malware payload", "value": "dab0f3aebcfe485f6c06d455bf08b0a29c275f29d092b6bf4a487df2d55371e49f3605ce293f7f3d4f2d14b0d3e772a5", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777069378, "uuid": "24955362-fb16-400d-8145-0f228ba53d3f", "value": "T16BD340CD8FBE44B9CE5AB868D1CF9E0362D9920B1D4DCA567E0FE5903F32B18505A5E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777069378, "uuid": "13b7af11-9a87-4765-831b-c013756332a5", "value": "768:Xq4fe4siuQIeETWBCIxZjB2PP5az0W+0zJeUAp7n3hpx75x575iIfhFgn8Eh/EnZ:RxtbuH5az0W+0Z45BZFgTRHKC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777069378, "uuid": "6be2f01e-a298-4cb8-93c0-83fcbdfb093b", "value": 133362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777069378, "uuid": "55598171-b8da-4a66-a5f1-5d8a8a5ce16d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777069378, "uuid": "97d5ce3c-9aaf-47b8-ad41-7551d190fb2f", "value": "Photos_Summer__59.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23aada4-3fcd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777028918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777028918, "uuid": "c294688f-f6cc-4c5e-83f2-051df4abe02a", "comment": "Malware payload", "value": "b06f00b1d9422e94a2b007b857f084a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777028918, "uuid": "2f7f7e40-aa64-4a57-8855-ad84ac6b2b0b", "comment": "Malware payload", "value": "1d2c7d7a9410bf6c582cb9036c98562b1b79db9b47e73d902da5675e4527319f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777028918, "uuid": "293e6a0c-325c-4c62-9740-9502f7b61f9d", "comment": "Malware payload", "value": "614be44191be9bdb04790337937f6d8114d2a362", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777028918, "uuid": "7fead438-10be-4954-8b76-ece3a3094745", "comment": "Malware payload", "value": "a28fc0483548fc89f9b654903a96ab222933c1d1efff77b6f27be45bd1e3f693b9a7d265ee4e1784c43787b738cc5cfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777028918, "uuid": "b293896f-e74a-4e4e-accd-2e7ca1543bdf", "value": "T1A006F012A54286FEDEA2063E84B3DF8DD46B691128ED3E061F947C4E1C3427235FD5AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777028918, "uuid": "dbdbf051-19b6-43c5-845c-ae6afcce67d1", "value": "70c03ba12545cd0bd3810f258a7c8c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777028918, "uuid": "b02aa032-fa04-4744-8071-78d7c36bbd10", "value": "49152:tmKCJxKj4ks4KL0A5pv74HoT+J2oy9WUWTRwuu0dYT2eljiTBx:tmWsksl009SJNy9olzWTH5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777028918, "uuid": "2e628e93-8507-41f2-95fb-f6a31dd0704c", "value": 3660912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777028918, "uuid": "f5226b91-8b79-451a-9e7a-d962897e5e4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777028918, "uuid": "82e47b98-0543-4d5b-a481-92b1613e3861", "value": "WH_1E_1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718d8c64-3fc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777024837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024837, "uuid": "30aa9f68-59fc-4dc5-889c-f4d095ab78df", "comment": "Malware payload (Mirai)", "value": "c2b7b6d354c1665ee4368da66a3a4800", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024837, "uuid": "73586623-6211-413f-9696-a63ca7a082bb", "comment": "Malware payload (Mirai)", "value": "1d39950fd081dd9e7fc2090bfc1c9d6d97d544f29147bdb7025bafedad56b5ac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024837, "uuid": "c1aa82ac-99dd-4ede-9561-298d0c43b002", "comment": "Malware payload (Mirai)", "value": "cd984011b81eeecb327e23d662706aab424e4338", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024837, "uuid": "128b26bf-fe36-4bde-b49e-b77fe8925777", "comment": "Malware payload (Mirai)", "value": "9b1ff6a2513ddeca95950e2fb7442eb759fbaf8abd7cd9e89963a0e38c800fcceec7e079cfdffebb8fad815a521a59d2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024837, "uuid": "13dbd715-7f6d-493f-bd41-f6af982823d5", "value": "T155C31B45FC405B23C6C612BBFB5E428D3B2A17E9D3EE720399255F60378685B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024837, "uuid": "8265b49a-2309-4a68-9b47-de1bb3810762", "value": "1536:pfKa0rG5yC/cMChygtcOBdWFAcJX4VlgXTAnoF0DUmZru451WhbVVlXWwywEReQt:5KaprMh7yOXWFh4UXsoF0DJZRvW9HWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024837, "uuid": "542649ea-02b8-42a4-b32b-25ec0d8fc163", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024837, "uuid": "63db98f8-0dda-4203-8b0c-d185e3b0563f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024837, "uuid": "8e9232d4-fd46-40d9-bf1a-aab617b430da", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2f86c2-3fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777012242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012242, "uuid": "24c0c9cf-ce5f-4b68-abeb-fd661bbe0081", "comment": "Malware payload (ConnectWise)", "value": "3ecc140ff8e73d835426dcb5a6cbced3", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012242, "uuid": "6107c484-0ef0-4134-8ac8-6d0244cd93b9", "comment": "Malware payload (ConnectWise)", "value": "1d688781a79012c8db3c948d86b9a9b26dde6b1e6bc70ee3f21e681be8a8711a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012242, "uuid": "b3671c2b-a6fb-4686-9e09-bf66029ad52a", "comment": "Malware payload (ConnectWise)", "value": "8897ffbfde4bf56479e0448c3b593bb3f10f857a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012242, "uuid": "13bb9047-204c-4bc0-95ff-f1c1c5664278", "comment": "Malware payload (ConnectWise)", "value": "55d8ab0e7c26c6fabc42003969e7037f8976cfd1fe02f7e73e01c825f64c916b8571a8750b59447535a30f3a9fe7292e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012242, "uuid": "fa879589-0d40-4873-be8d-b17d47d1ee0d", "value": "T11F646D11B9C48432C673383107B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012242, "uuid": "b227bb33-7264-4062-80a7-3ea1e82b9afe", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012242, "uuid": "8ff349eb-dc97-48b7-8d13-b3c5eead9aff", "value": "6144:dmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti99V:Y1iw7gryNkSV1hy1Z1u2JLI97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777012242, "uuid": "44b82b4e-8244-4431-9358-0425a8ac14d6", "value": 312536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777012242, "uuid": "ffd5c931-9788-493b-94a7-5d882a872dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012242, "uuid": "4e57850a-8070-458c-b24f-3ddc6d81714a", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec8b97b-3fc9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777026953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777026953, "uuid": "44f3c925-531c-4fa4-aeab-74f0af7b5314", "comment": "Malware payload", "value": "1ff3fade2ecd00882eefff12ebbb8783", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777026953, "uuid": "0d7ad6c5-0970-49aa-aa98-eccf7a5271ce", "comment": "Malware payload", "value": "1da4f7f001d239a54fab50eb7c3cbc985db392a3d4405e19c3a5d2035d591004", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777026953, "uuid": "8297ecb9-a84b-4d35-ab21-d8e8f3f08add", "comment": "Malware payload", "value": "1cb772bb82658593e2bf28330f4ad5e49041fec2", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777026953, "uuid": "a559062f-0216-4b8d-add2-2213ae794fea", "comment": "Malware payload", "value": "1774e9a17a3640c797531dbeaef33968f7d6d82bd7f04d55a21c20bf9c95566ea652275b92ed54f1b17728bc63c4830b", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777026953, "uuid": "df08358b-2e7a-4cc3-ac25-56e8b5067d21", "value": "T120038C52A6A414C4EAAEE9B0C170DE27E9B5B14A572196CF03B4CDA40F733D0E63D35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777026953, "uuid": "7b6b34b0-b246-4d8c-adc9-906038b12a03", "value": "ff87cc76b7f8139549af27a98ea0587f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777026953, "uuid": "d5bd6551-8f93-4cc6-93e6-fc9d8cd841c8", "value": "768:Ly2ZKY0j23v1lnJmk7h1QMzdibwWDeKEI3iFl9zb:ZrDNlnrhDzkbl2IK3zb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777026953, "uuid": "c4f37505-0672-499a-befa-1439f6f46d71", "value": 38064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777026953, "uuid": "d6cc3817-fc0a-4e10-b331-4ea7422eb3ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777026953, "uuid": "b3505201-6588-42c4-8c1d-b8c1cf6085fb", "value": "1da4f7f001d239a54fab50eb7c3cbc985db392a3d4405e19c3a5d2035d591004.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d21976-401a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777061699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061699, "uuid": "9883746b-096e-4bc3-97a9-f7dee8761f9a", "comment": "Malware payload", "value": "065933e79c3eb47f953f66753b266b97", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061699, "uuid": "371c5fe8-c97b-43be-8f19-0a463965c070", "comment": "Malware payload", "value": "1debe2d0aea09e790923193ec799a0dede6d43edf59ae3ec5f927c2363c967f1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061699, "uuid": "458ddd7e-ffb5-4d50-949f-bfa01f62c218", "comment": "Malware payload", "value": "e568632b9b908dda2b1251c83dc7132752fb06f9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061699, "uuid": "f93ce27d-48b2-4507-9c4b-c54a9a4ed6c2", "comment": "Malware payload", "value": "885b496f691a29c4ea7ba2a4b09ab1814f6af9f3add39f7c1c1310a19fcfd161fbceb3e7f997600d056c85905f94aec2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061699, "uuid": "5dca9198-3741-494f-8232-e0be79190fd1", "value": "T1DC34C34D5CF722215263B2B98B2FA40A3175E5032A0EDE147F5C93916F8863C96F6BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061699, "uuid": "8f542ebf-e19a-456c-b5a1-f42a3906b7da", "value": "6144:RE63mQZJwE4bkCo+vtrHLqrPtghkpKWo4:RE6+vtrHLqrPtghGKWo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777061699, "uuid": "d027379e-af56-4d16-9d5f-a481013e9991", "value": 249522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777061699, "uuid": "f53f96d7-9904-45ad-8a2d-9b03413903e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061699, "uuid": "597f4871-7e84-4c22-8fd9-7cb50fba9ce1", "value": "40_6yg_win32.dec.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3fb9f3-3faf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777015675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015675, "uuid": "df5dad45-d95c-4997-89e5-25200e84b732", "comment": "Malware payload", "value": "0d79aa49d2500d1b358b0fd9a374268d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015675, "uuid": "fa73c584-e7c3-40f8-b2cc-ebbc350991df", "comment": "Malware payload", "value": "1e26ba9bb2c1704b1fbf47866ee783c9ffc31c517b425300e2c38d757393450c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015675, "uuid": "a7e67fc4-fad9-4459-8d01-9a9471114655", "comment": "Malware payload", "value": "3508a6952c7f844e460abf60f3239f96154c5bb6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015675, "uuid": "77350aa5-8418-4354-9eaa-7e7f688b83d7", "comment": "Malware payload", "value": "25848c9b2f836d11c091457a2230879ba380b5d6a054c981e35d22f0771193051c209143e4357240813e85889c6560c8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015675, "uuid": "9d37ba13-d5fb-420d-83de-16324e25674d", "value": "T19B444B243AEA501DB1B3EF559FE474EADE6FBB233B12A46D1050034A4723D41DED263A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015675, "uuid": "a3fb7f89-52b4-4a19-a7b7-06edba503f10", "value": "6144:hVWx57Jc7Picy/qHKL/PqpDikoU4BjHlBkoWIUXRb7ngM:hec7PTyiKL/PqpDjo1jHlBkoWIqbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777015675, "uuid": "f719b397-51f7-4461-b854-af1c2081f51f", "value": 256988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777015675, "uuid": "489a7917-fcba-4c9c-b2cb-8e1478489d00", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015675, "uuid": "eabb133d-3769-402a-a4d2-cb6b361cb210", "value": "P.O 2026-0394120.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85684342-3fc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777024870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024870, "uuid": "58db5a99-c920-4243-86e1-d2b62dcb325a", "comment": "Malware payload (Mirai)", "value": "0cc43b82287ef80e6d8f640382915b94", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024870, "uuid": "f4eeb9b3-d8b5-43c3-8750-41db8eed5fd0", "comment": "Malware payload (Mirai)", "value": "1f034da4196be6b6bf55b26af1be078dcf649b508b02d959796f16426ccfb7dd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024870, "uuid": "2e47aa65-8b2f-4a32-ab92-ab01de344976", "comment": "Malware payload (Mirai)", "value": "812e3951ff7134339aab48d31e6694c12f3d2afb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024870, "uuid": "d7358c44-3c5b-4b06-99ad-cc4e9988ecd9", "comment": "Malware payload (Mirai)", "value": "5de44764457014e9fa6528b252d28d33b6c5ecfba63dd20120ae812108fc4f9dabc5b86e0e3de25a8a8b3102138cc406", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024870, "uuid": "a1d161cf-ee21-42c4-832f-e4235f4dcf2e", "value": "T1EC04B719AB510FBBDCAFDD3702E90B0139CC955B22A93B363674D528F54E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024870, "uuid": "a2c69c8e-a820-4936-b4a3-4d4cd740f212", "value": "1536:HwdqBezGeDBxeXJvkgBZOofcQq6K7yKshdUNmBvLZvU1SaZ6y985gkgXw5jxgK2e:HKpzG4e9kSfcQqW9v8SawFgXojl5vFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024870, "uuid": "63abf7c8-35a1-4e40-8a83-e97722b7611b", "value": 177760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024870, "uuid": "1c2e3246-2893-4e4f-8c00-9aa51edafd7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024870, "uuid": "8d7e7df3-5b5a-4197-af0a-5e8a8f15f51b", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67d537f-3f9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777008229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008229, "uuid": "cd185f20-24a1-49c3-81e7-1d4890f4f638", "comment": "Malware payload (Mirai)", "value": "992dbb483059f7741f75a01276985534", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008229, "uuid": "9e280d66-30af-4e12-b427-477e121d8ea2", "comment": "Malware payload (Mirai)", "value": "20a60c65a01208a991655335e6b50562a15987ee7c1ef01f0ee0eec4eefc920d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008229, "uuid": "c612c80e-a77d-465a-a35e-d5cf7cba1320", "comment": "Malware payload (Mirai)", "value": "a360a66ff3e5727ec93a737e2a3e908d7fc25f79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008229, "uuid": "4c2bb712-2e39-467d-b4d1-054ab0e6a19d", "comment": "Malware payload (Mirai)", "value": "1bc90eeb8196beb946f8ad652cbadfcdd036f9a643445164a4fbbaae0c71dbbfd275ea9de459c8741e950c38faae2ef0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008229, "uuid": "70618c2d-ca4a-41ff-93e9-4415c99d1f51", "value": "T1D9F3F981FA43CBF6E44707F012B7AB334531FD3A442AE686DB65FE7669219C0E609358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008229, "uuid": "4b7e5d19-5a4e-4fa3-aa83-ff10ab203eef", "value": "3072:IhMHNcqOf+vgGOBELOZWyiyU+n9KryhzEKnEIGR2uwiqRg3qzF58TMUmrvQPtrG2:ttcqOf+vgGOBELOZWyiJ+n9KrylEKnEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777008229, "uuid": "0d8ee246-b4b8-4bd3-92ef-1ab29e91375a", "value": 163248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777008229, "uuid": "5da412e0-02eb-4755-be6a-7320cfd17079", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008229, "uuid": "fab8a8e2-838c-4dc0-89b2-03f318d4025b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c78571fd-3f85-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776997923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997923, "uuid": "bfb77ece-e800-4d76-9f89-c4f89944d5ec", "comment": "Malware payload (PhantomStealer)", "value": "08d74c02bf3e854ffd5165069500a360", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997923, "uuid": "f289246d-3253-45bc-b8f0-b45c99a0db1f", "comment": "Malware payload (PhantomStealer)", "value": "20b1fc0ae274db47aaa283b690d2615ad850079072fd3c1a44604261b50a90f6", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997923, "uuid": "dc9c8fb8-fc85-456c-9c37-c28442a48ac6", "comment": "Malware payload (PhantomStealer)", "value": "debe31ce6143c4a1fc193842312256a5c9e5ed1e", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997923, "uuid": "b343d35d-578d-4be5-bb89-33f2d945c2f9", "comment": "Malware payload (PhantomStealer)", "value": "bf93bb59622dc20ef9cdb872bacdb05c0606ee35450a278c3d1fb6279e560b15f1508c980a9398bacaaf7b1b1d4c7935", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997923, "uuid": "f7f3a279-8b24-4cec-94d1-c3864c200e2f", "value": "T1942533305F3A4CAE85BC842C71376F9A5A214BB158CD04E7E3A54DEF07ADF2167AB412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997923, "uuid": "e54bbd7e-3356-4a00-920f-4eca24015ed4", "value": "24576:hDNCij967K4P6PPHrmy/DZ8b3RfBaJARixahd/vTRas:/F8byFmzqk/bks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776997923, "uuid": "fb0b3cd9-e729-4263-a57c-3372b4584c24", "value": 1047578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776997923, "uuid": "f427a6f8-c5e8-4678-97e9-cf5dcd6f7d71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997923, "uuid": "1eef7f5b-1449-4a4d-b4fe-b06ae44522fc", "value": "highlight.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c659a7e9-4001-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777051179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777051179, "uuid": "0a84a06e-a0fe-4b9a-b6bd-e9cf19eb43d9", "comment": "Malware payload", "value": "b233d893084d6ad2bc2e41cc70432302", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777051179, "uuid": "39c20498-e364-4980-b0ee-cebd4a94bfb2", "comment": "Malware payload", "value": "214a0ac4a34c37a19863a68521b908d7d2ae094987e68f2b73c6d9c44307cad4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777051179, "uuid": "17188117-20d2-4863-8dbe-05ab15e4aba0", "comment": "Malware payload", "value": "a34f01dd2593e5db34de93d046efc972e10212ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777051179, "uuid": "c1df6433-dd39-448a-bdff-1cd5c04c0d87", "comment": "Malware payload", "value": "514b452169736aa41a2685b562329820ffb3c16079e6094c1e95b6ba2a74c11a2984028d42f36a27b097b95a70db63fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777051179, "uuid": "fb58f936-fb2d-4a4d-9b7b-147a4597709a", "value": "T1EF350156BE156F2BC4A54279C4DBC134237BF0809B82B303B948E17A7D4636D8F1EB69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777051179, "uuid": "f924b202-40ea-4a50-9865-7db2b5dca234", "value": "24576:l0tqcI4qN/1sfElJokJ56nrGn+lANPuYqOclOdrDW2AbBtXR5xhqnWFOV3LdUXO:aiN9kiUyn+YHjDWTXHjqn1LKXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777051179, "uuid": "9a156fbf-2826-4d5b-83ac-2bd56e3b944a", "value": 1126644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777051179, "uuid": "60cd674a-db5f-4263-8a4d-9328964e13a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777051179, "uuid": "73ef5585-ddd4-4d65-9825-62c429976216", "value": "bot.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0486579-3fd3-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1777031358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031358, "uuid": "7c9f58ce-f165-4582-8962-0e4f8878898c", "comment": "Malware payload (MassLogger)", "value": "e3ea9010003f5e7d400a39a573b25ff4", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031358, "uuid": "5c4a72cc-9004-4768-b9c4-4a4b981ff26e", "comment": "Malware payload (MassLogger)", "value": "2168a3295dc3efc1cd46ba5c7052a95645bd92e09002b69ab4ec5277ef678c78", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031358, "uuid": "48f8eaea-c32d-4500-a8fb-85c407a50045", "comment": "Malware payload (MassLogger)", "value": "28bbf1e060b6d777a2a5f98a4d2707907f7057ae", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031358, "uuid": "602ac5e8-d395-401c-a3e6-932db5f1535c", "comment": "Malware payload (MassLogger)", "value": "a9927785ca86e1b24a7f49d797115639c5cc15c77c1edaa1ad4df28346d6152c0c94659b7ff12ba902832d6fc2a35917", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031358, "uuid": "acbcdbf9-6399-443e-a38f-accaaf8d8f05", "value": "T1BFE3F126E4882E6DCFFC6E1484BF061E23E0C6DF551D594DF7333E9A6FAA50842192C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031358, "uuid": "198e7c68-ec35-49c0-bb1f-18b7a53d85aa", "value": "3072:HbVFMumWPvnMJf61XirvT0E2KlqYBSLdh2zdPl26luPe7hL:HbD+W8p6E+uqoSLP258euPeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777031358, "uuid": "cb5cfd9e-991a-4736-a5e0-fc587b1fec12", "value": 148548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777031358, "uuid": "0a8cff17-ba2d-417c-9ddd-5c09ae2dfded", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031358, "uuid": "53b14321-22d8-4195-aaea-1cf0827fc06d", "value": "Body.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776ac29e-3f7d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776994353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994353, "uuid": "62fa65a8-6ca7-46f8-9930-a48ba42b825d", "comment": "Malware payload", "value": "d8932dbabf3d3bd5ac256c7351805929", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994353, "uuid": "4094df23-f004-482e-ab75-c3da7dfa369b", "comment": "Malware payload", "value": "2277e5849ca525d261923a8a66eee1839570c7bbd7b62231d5da88ddef396cb4", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994353, "uuid": "f71d7ed5-87bb-40e6-b7ed-788dcb8175c2", "comment": "Malware payload", "value": "7e0a0cc4dfea7afa6a1984988deeb12c618c336f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994353, "uuid": "756cfe52-ae2e-4bf3-9ffc-325f97e7d54d", "comment": "Malware payload", "value": "a857b17fe490ca76fe5e9c9cc9eb42ae7f5ee6446962e3d44aaa5a6cb03a83eb03cfff53885b06dbba8fc27d69776cd9", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776994353, "uuid": "e0dc75e9-be0b-4b3f-ace3-f7c60aeb935e", "value": "T1DDD023711230CA9CCA154C5C6C4B63ACB09B04FA5508EDB391414CD8D6874AC9D37BC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776994353, "uuid": "ec93ffec-64e3-42ac-af02-9e7c9f259cef", "value": "6:hC47bxrBeLuVFOOzCZGPe2jInIvKOZG1Bn23fbTqT:d5r+uVEOtjjInIA2CT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776994353, "uuid": "efaf5f95-1c44-4f00-bd8b-79ccc80e1359", "value": 220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776994353, "uuid": "3290baee-9715-4d67-9f85-64abdd5bca91", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776994353, "uuid": "4c048ed4-69da-48b1-856f-8a7825335eee", "value": "MKP47EOLMCbo.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f31ac2-3fae-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1777015308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015308, "uuid": "ce833ef9-9c7c-4d1a-b39c-73f91b83a74f", "comment": "Malware payload (XWorm)", "value": "937c0a09cb717d775df9c50633a2b016", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015308, "uuid": "76ac1037-2334-4c7f-9494-681fa0595000", "comment": "Malware payload (XWorm)", "value": "22e20c87b8a58256ba2d789c04fa52c109cd991dd82f270e4c4da5b72f057b77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015308, "uuid": "48bfeb65-e547-4a7f-b814-10b3880fb0f2", "comment": "Malware payload (XWorm)", "value": "af3a35ab5dc1813652743495a29d2d23a1e4062f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015308, "uuid": "b5f8f9d2-9344-4187-a66d-1ee28071051a", "comment": "Malware payload (XWorm)", "value": "6e6a1b59c1280d4109e5fd34dda49cb782ffd7c2d633c53b9cf031ba42d0e3b11895f832c9768ccbabc4cf0957b70acd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015308, "uuid": "4e3b6cb3-d56f-44d9-8d00-3db22866801d", "value": "T14505124A73D41B04C95A65F8D5E3463903F25AC732B6E3A43A940AE71E823F49CDA7CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015308, "uuid": "0b96ba7c-f238-4405-a29f-dcccf1805673", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015308, "uuid": "3e581796-0169-45fd-b6cc-a7e9e938ad89", "value": "12288:s4YMuM9GUK1dpwyT8PqPN6GOYF8n+oEr4ObwIxFIB/VcT02NWwYGMLIKi6L/2+Dt:sDdgFkdprgPFz+82xFIBiFtYVL9tDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777015308, "uuid": "af3ee83d-7292-41a0-a8f0-b0bf05402511", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777015308, "uuid": "383bf24e-dfeb-47c8-8614-915b3410c3c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015308, "uuid": "011efc89-3cce-43e3-97dd-a7bb64166b8d", "value": "QUOTATION-20260424_Price_Request_DX-DXVALVES.COM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb9fa72-401c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777062650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777062650, "uuid": "d0a968a4-17b6-4795-b494-7e80e9ed2745", "comment": "Malware payload", "value": "b70f5fc14ae07c078d4414f1bbadeb12", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777062650, "uuid": "922ab71f-1b14-44df-839e-a26476efa7e0", "comment": "Malware payload", "value": "23b3dcc5b5be9be8a926e7ec36f0a9b660ce1031e4937e7a878f96f13f81f2f7", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777062650, "uuid": "f0eea0ea-f2e6-43e3-a613-06fc5e1cf855", "comment": "Malware payload", "value": "334b01b2e05aea72b97372a4f04fa83cd2f3fc06", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777062650, "uuid": "e4b3c54b-6c06-4371-9968-5ae93c7ab5dd", "comment": "Malware payload", "value": "bd54109a5ed524dd1576b3df6c8550facb34c4b048cee7b3f665d635d43f431146733de5b1e3f4f6e2e4d52edecfd2eb", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777062650, "uuid": "2d8e2488-7183-40b1-bf4b-9290851a84b6", "value": "T1630412781508D9FAE2ED790DCA9E4958AC30FB87CA99AC5335F510F38BED55AB331108", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777062650, "uuid": "4a6650d8-a49a-45c3-bbe9-64dd73bfc181", "value": "3072:1c2qyDBXBE8zdqhlWeb0PtWPpnilHAEzLpBRJxenKKvjDKfBiSuiLn+QT2lEq:pqQdzdqAebUtWPsTzNBJxKvjDKfQQli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777062650, "uuid": "045761f4-1b78-403f-9564-2e1e876385b9", "value": 182180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777062650, "uuid": "bf91ad2a-1c70-4c5c-8458-a8be0b1a40c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777062650, "uuid": "84af7e5a-1bd3-43d4-8f72-ca4d0137113d", "value": "leading.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f816245f-4032-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777072307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072307, "uuid": "d153d06d-07a5-4083-948d-26afae4b4766", "comment": "Malware payload (Mirai)", "value": "e8c8b6bb075946c3e1dc5b8e50fde5bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072307, "uuid": "d605be92-8787-4a83-98b9-5f93c2228f1e", "comment": "Malware payload (Mirai)", "value": "23d6dd5ab92ea0d12350641da917957054b5a805886aa8b14c61b294f5644a68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072307, "uuid": "d8d55e57-8b9d-4ce4-9600-3e0eb210a462", "comment": "Malware payload (Mirai)", "value": "b1fe9fb9f9cfdf7b3a33128f64bc21927efeaca6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072307, "uuid": "8818cf05-2488-472b-8c4a-2925c33947ba", "comment": "Malware payload (Mirai)", "value": "30ceb7411715c1c9c814948419dea1ba0ee88586ea41642e9561d3f2ebb6cf3efbd6388f62c89115dd4a970487b1d2df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072307, "uuid": "f21c0db7-f537-4a7e-8517-203f6d7f9591", "value": "T144639D25E0459DA0C08E4A38B0E5CE380F13BD8582671EB69AC545E65847DFCF718FFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072307, "uuid": "d65a31fb-aafe-498a-b2ad-72bb1c80fa49", "value": "1536:faoJldiu8gbjwt2N+8TlxZ1/NMumAeRUfDVCN35:fpdiu8gX/T7BDeyfDVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777072307, "uuid": "c144b4ff-8be0-41b7-8564-576815747c87", "value": 70756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777072307, "uuid": "099b6799-3d33-4edb-90bb-bdb8c6ed1cad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072307, "uuid": "c9928197-429f-4f4d-898d-f51b1794a069", "value": "jade.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd828077-4001-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777051164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777051164, "uuid": "2c3bdf0f-4c67-4085-825c-b0a0def98ce4", "comment": "Malware payload", "value": "31a8219c1414578baaaceb2c43573f32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777051164, "uuid": "56b45444-a167-45db-85bf-086ef65331dd", "comment": "Malware payload", "value": "2458b41bb248817c2ebe09c7eada875684ff3987385ff4a7c7605cea918cae4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777051164, "uuid": "12777d5d-d29e-4616-8e00-fb8a91ded619", "comment": "Malware payload", "value": "2f40a310b9b4b66f46b163fd5237e5dd302fabaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777051164, "uuid": "7686c2c6-2140-4336-85e9-98e698682b0e", "comment": "Malware payload", "value": "24e3b10513267d42013ac3bb4103d8132a1886c506ccdc3ebec657f6329c971012826bb934183b9d255e14c57c29c7be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777051164, "uuid": "eee41e24-1421-4520-9e5f-580c961218e3", "value": "T14265CF9767248996C0706E3BE1A7EFB183A73E7119D96A0F9D48F73648733048F11DA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777051164, "uuid": "1123c0ee-b924-4ee3-bebf-b240dfd1c7dc", "value": "24576:fBAXobSBtriTNJDC6ygJdBaWa9ad7NzEC62gyOoETcdanUeKegjluq:KaCvWWU7YHyjEgMny7jluq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777051164, "uuid": "e2ecc84b-626b-4f18-a072-33196e922a98", "value": 1485861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777051164, "uuid": "c1998344-a54b-4dc2-a8f7-0f8b35ec4c65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777051164, "uuid": "6e62b29d-af4d-459d-8399-23f069a06a6c", "value": "bot.s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a785bda-4028-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1777067694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067694, "uuid": "b441c034-bb19-4513-bd81-dbe339c5f98d", "comment": "Malware payload (Efimer)", "value": "2df1306e1580909f8b240f27e909e233", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067694, "uuid": "dc033cb3-3fd3-4a5f-b51b-fc707338edfe", "comment": "Malware payload (Efimer)", "value": "245e58549d65dffd6e4ea7f176048abb34b9f157c2371395d1eb755e758d36f0", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067694, "uuid": "27321657-3a15-46ae-bb37-4baa3e9baa45", "comment": "Malware payload (Efimer)", "value": "62633c8f052485ef6cc380c02d3b293defe1e975", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067694, "uuid": "2313ad95-febf-4472-a72d-4eaabb94420a", "comment": "Malware payload (Efimer)", "value": "74d02c1303534f38ec8a47b9a3d708823a4fcb61c7f56b2c0320261e998d32b4f86cb6d953ca25c7e6c87c025f193f2b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067694, "uuid": "aaa66296-0e42-43ab-a5f8-85d36f1fcf45", "value": "T16CD6331D84E260FEC5ABD2747BF067F1E46CB8301335E83E8BA8E3766C63156551982B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067694, "uuid": "2f9a6e16-6341-4f6c-ab52-56f3dff2f45c", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067694, "uuid": "589abe6f-2972-4535-8ee7-03540f37c46c", "value": "393216:YK/UnSnQKPOv+77mAdKtXMCHWUjXXcuI3/PGTAI:Y/nSQKPOeNdKtXMb8XsH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777067694, "uuid": "a2702fc1-8038-47e2-9c62-e978fc410e46", "value": 12621614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777067694, "uuid": "bfe821e6-aa0e-4eed-a624-c7799c768bcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067694, "uuid": "75f2c2b9-621e-4541-b2ee-5d842f748a92", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc08c101-4003-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777052074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052074, "uuid": "7b866f29-4514-4463-be23-558a35f6dd3b", "comment": "Malware payload", "value": "0bdde2e8a30402a560de02a5556ed713", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052074, "uuid": "2c833074-fa31-4747-a7d0-cbf1442a4fe6", "comment": "Malware payload", "value": "246fb835d9ed0aa13b07a5a38f39997a3f9d80a6352d2064ed38ee03147fd1f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052074, "uuid": "86c8188a-cc6b-4548-85bc-5ec574d4f438", "comment": "Malware payload", "value": "a287749cc6badbe85f271000e3ad6720272d26cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052074, "uuid": "4166e2b4-3960-4dd6-a14b-748240a8962f", "comment": "Malware payload", "value": "2b7a63cde3fca8a666ac06254ad5ce7dcf29e534d2150fed72436861852fa443f3ccaff4a5f54261bb6e70c4190422c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052074, "uuid": "04aa7439-58e0-4bab-a65f-92514b3a9225", "value": "T1E265E0667711DFA1D354C63005F3C7645AF525A20BE2508AB278C32C7A21A6E6E1FEFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052074, "uuid": "cffc25d9-580d-4f8d-9e78-ab98b961f4c6", "value": "24576:t4CTgOHoJHSTQFzx+J8nVZkpDZmFhJeyxUwMAU//0Y0ioTOq/qoMPSrxXdJAsL6:t4CqoQFzxLVZknkzKHedSfSrrJA06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052074, "uuid": "0524c436-0c9e-49db-b740-f41b020f1e97", "value": 1484319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052074, "uuid": "142b4abc-bc6f-44c3-ae99-34860e8f259b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052074, "uuid": "ab6450eb-aa80-4f6d-b070-178bc8d8b1a5", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e38b1b3-3fa0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777009343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009343, "uuid": "79aaca7a-e78e-4f57-852f-ad4e0e2a13e1", "comment": "Malware payload", "value": "6e40cc76d0315714d738eed51e33a9f9", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009343, "uuid": "4fdabd8d-edb6-410f-a802-45e8f7703a75", "comment": "Malware payload", "value": "253ac59e7ce2fef4ad964f224190608334bc1ab16e708dc1602ef9c0ec890e59", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009343, "uuid": "cc26d48d-8f7e-4f00-ac4a-5b25fe88dce3", "comment": "Malware payload", "value": "f6ca575df6cd2e30b087720bb897984beaaf5c7d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009343, "uuid": "246c45d3-b25b-44d1-88e4-59eabdd842d7", "comment": "Malware payload", "value": "4c88ed398ef11689b3e61be135cfc3a70f3e029d2678ba6ca90d1d3ad8eb14078e83813bea741b55dc5a90ea110da970", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009343, "uuid": "320c7529-43fc-4d79-9cdc-3f5989cbc6dc", "value": "T18BD3E0CE4A8E88EDC76F7428425F5C438A8FA1234A5DC990BFEEFD513F1196170AA5D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009343, "uuid": "be73fea6-ea55-47f2-8101-0272d22c3f5b", "value": "768:6bF/PWCyLFzAsYmn2AL38ukyL0jTc8NjpCaXKHhNk8PXw6zdLatjSzaQaUa+Ma18:6cH2AbwaewzrRJRkTPk5saIdWoRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777009343, "uuid": "fdbd36b1-2864-44ba-aafe-a8374f46cc86", "value": 132531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777009343, "uuid": "bb1fda8a-d305-47f5-b388-942ccc0f8e78", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009343, "uuid": "6cca4cb5-8879-4972-91a0-696b1c48eb66", "value": "Images_Europe__28.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a22f02-3ffc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777048901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777048901, "uuid": "dc0d3b00-431c-49e7-bd95-cfd30747c6d1", "comment": "Malware payload (Mirai)", "value": "8e8288dbaab04ff4a147efa4de12d3ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777048901, "uuid": "fd836a17-db2e-4855-8042-42bec1cc2608", "comment": "Malware payload (Mirai)", "value": "25abde4852c1619df3a6f5141d71f404ad9079fc171bbf71f53496b3a3a97afc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777048901, "uuid": "0dd02ebb-6a8e-4512-a84e-531960a7d56f", "comment": "Malware payload (Mirai)", "value": "4d9d6d1220e223330be86e33a51ff4469af7449a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777048901, "uuid": "3e52c803-c4fd-4d64-bd1b-8475e74fd054", "comment": "Malware payload (Mirai)", "value": "068729dc44ff5470a9d841235f345511c000b0a0dd9f52f290aa5aed8d4d007b7a79cce8263920aa616b0fd498f947ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777048901, "uuid": "1cd26389-9415-43ac-9cd9-0b45b2a143da", "value": "T114230791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777048901, "uuid": "b030ae7d-8cfe-4deb-a2f0-00a19c4d64b4", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THN:5DmKF7Gxyk8cqoHAmWurAufsG5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777048901, "uuid": "d1c43652-a1ff-438c-b117-70db4326fcdd", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777048901, "uuid": "149c0319-4e1c-443b-a5e5-faab3677ef1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777048901, "uuid": "0743c713-2341-433f-b9cc-24a21b21cdbc", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008be7c6-3fe3-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1777037962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777037962, "uuid": "e91ad299-723e-4fe0-8c59-94b12e72ec1b", "comment": "Malware payload (a310Logger)", "value": "fede3b9deac06b64a267ebfdb75fb411", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail-mokasco-com", "colour": "#ADDA3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777037962, "uuid": "8fe3dd53-c663-4453-b6c7-7d181a5e33b7", "comment": "Malware payload (a310Logger)", "value": "25b2b81da374c6897fafabbe1e01143d86541424947c8c28d46cc0a956b10c49", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail-mokasco-com", "colour": "#ADDA3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777037962, "uuid": "8171bffe-4082-4230-aaf3-e7d2beda5175", "comment": "Malware payload (a310Logger)", "value": "8d2264a8eabb227b15e3cc2abe9a6483ce26dc4a", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail-mokasco-com", "colour": "#ADDA3E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777037962, "uuid": "131509ec-df1b-4b3c-85a1-a8e9a2295347", "comment": "Malware payload (a310Logger)", "value": "fc2e9dcbe67f4801ab07dc2a5baf9f11196b57251dcb0987c775c157a8b21b6e59d61d2f0b63f282721a40e078401f75", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail-mokasco-com", "colour": "#ADDA3E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777037962, "uuid": "d32cdb1b-a5cc-4517-8692-a3733057c7d5", "value": "T153944A13EB60A01EF1A389B0B9B5925A68267D351B98EC4BF3409F1A35715D3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777037962, "uuid": "4a958faf-f055-4aec-9dd6-6cd0fa801975", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777037962, "uuid": "c7c8bd03-7645-4396-b24f-623ebe5bba0a", "value": "6144:j/kr8d1/w5KA81IJ8GpF6nuTmOOUiBUrjRiXty/GGvWFiICVluyDmXZW/h2:jswjYKkJj6GmZUiqrMbG6EuyDmXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777037962, "uuid": "98908093-9d82-40c8-95c6-3b99b2f733d6", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777037962, "uuid": "d8e9c496-47d4-4fb4-b1ac-94d4b4b4a373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777037962, "uuid": "83bc664a-6763-48f4-a547-a70574e43456", "value": "Quotation request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82dc608-3fa8-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777012930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012930, "uuid": "ebf07518-b7cf-45e0-afa0-cc2e684f89f1", "comment": "Malware payload (ConnectWise)", "value": "c1c3a826386ce88a33b43189e45fe492", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012930, "uuid": "6bfa891c-bd9f-44bf-b263-5f27183df9cb", "comment": "Malware payload (ConnectWise)", "value": "25e1cebb91e9a6c351d04509ebde9e0caedca43c2031d3e2e4591224982234da", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012930, "uuid": "ab214e72-da7c-4b2e-b78c-09cc97a45f57", "comment": "Malware payload (ConnectWise)", "value": "dacfd40c957c7a8883dae58172b42100daee9285", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012930, "uuid": "7f33e085-96ad-4d4b-9e23-69506497e87c", "comment": "Malware payload (ConnectWise)", "value": "71748d98ebb20f46b6f969438b6ab7312920d6eb5c55c821f223ceb59dfdc6cbc6bcf847f85e5a7bc955cdf1cb9ea4b5", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012930, "uuid": "af3492b5-1ac2-4f4a-b966-e20d5cf287ff", "value": "T102836C43B5D188B5E9720E3118B1D9B4593F7E210E648EAF7398422E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012930, "uuid": "82f32192-880a-4689-8f3f-d0eca21bdc31", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012930, "uuid": "4469c1f8-3fd2-42ba-b72b-37713e5a369c", "value": "1536:CxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYj70JV:genkyfPAwiMq0RqRfbaWZJYYjwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777012930, "uuid": "f90333cb-8e19-4079-87d0-a22129908dd6", "value": 83160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777012930, "uuid": "5285a9bd-36c0-434d-a5e7-644db93f5f5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012930, "uuid": "4672ae09-4e4c-4fc6-bc0c-415bfe9f32ce", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af003797-3fa9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777013344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777013344, "uuid": "94dd2b3e-7f7d-4e6a-873d-abbc367ef5ad", "comment": "Malware payload (Mirai)", "value": "993543629d9b919c6aebe35d5f071a4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777013344, "uuid": "6a8ca137-5b1a-4e16-b6b1-6964303d80dd", "comment": "Malware payload (Mirai)", "value": "2639cea58eb054074923f9864d0ec50513c0a8d2896d0a2cb6bef80ee3443500", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777013344, "uuid": "ffa54eb3-b435-4125-a6f0-d99bf26192d5", "comment": "Malware payload (Mirai)", "value": "91fbf399d068a625e205b2f09d3566c88e366351", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777013344, "uuid": "187a04d5-e071-47d9-82f7-81dc561b1ef0", "comment": "Malware payload (Mirai)", "value": "ad7243d391547fad1f8a975b466b7a2af9c750a531e8babd438fdc5f83ada8b1c699c66ddb746e14bb8807878d4fc54e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777013344, "uuid": "38046c19-dcce-4531-806e-9b41e48c7f2d", "value": "T1A1830249D90D0173DDE2D6F46CDCC3A09C100A7EEF9ABE8404A4DBE4A910609FEE9296", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777013344, "uuid": "62e4ac0d-a6ad-479f-888a-83a76a79fd68", "value": "1536:B9HPxtCWQYqKt4H62wPXvMVujIjABrSU81MJq16caC4Vhc5ZSZYtM/eAEVK2KzkP:BhPxIbYqKjfPXvMVujI4rJ8soJ4cZmVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777013344, "uuid": "4b2d8383-a882-4b66-8500-7f88ab94283c", "value": 84500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777013344, "uuid": "d04bec3c-f05b-409d-83c5-5ab4a453e0c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777013344, "uuid": "000f281a-c471-48c0-9c3b-fbdc3f370302", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d59e190-4012-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777058250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058250, "uuid": "ce930cdd-c79a-42f6-bc68-2f161240941b", "comment": "Malware payload (Mirai)", "value": "b4a1987bf9c8b0f0ec93e2c61f8c4dad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "PoisonedRefresh", "colour": "#24B87C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058250, "uuid": "4d836f09-dda0-4ed2-9965-0591f902ef6f", "comment": "Malware payload (Mirai)", "value": "26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "PoisonedRefresh", "colour": "#24B87C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058250, "uuid": "d9a96b6d-cdad-44fa-8399-cb8b1e9e7eb9", "comment": "Malware payload (Mirai)", "value": "e2d6c74e815a07f555cd678f7ad0efedeae98ecd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "PoisonedRefresh", "colour": "#24B87C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058250, "uuid": "cc4fefc1-d64a-402e-bc61-53c445bba0b0", "comment": "Malware payload (Mirai)", "value": "53768f7ffc8459c8f13bca9fef5d79f3cd7b500954c007c8508e4a1f938b52bf5e1bbc4b6864a557976682970efdd1a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "PoisonedRefresh", "colour": "#24B87C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777058250, "uuid": "fe201953-2905-4880-b953-49b48b73418e", "value": "T11FD4E876F943D1F5C8633232431FF2BAB6245B6586560C0E6D1D0E28F737A50AB1A2DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777058250, "uuid": "c1f582af-38c5-47c7-9ace-18827a9b65a0", "value": "12288:kTUxjqTfq9+Ij3HQQBOPhS3PKhBOq6LZPW3SjlLh6Bejy0OCYIRwAYgl:kwxjqHSAfPhS3PKhBOq6LZPOSBLh6Ay4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777058250, "uuid": "70c202e6-c768-46bd-b094-2ae01f5cd6d0", "value": 614188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777058250, "uuid": "e4de2ebd-91b5-4d5f-8b29-450964019411", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777058250, "uuid": "4ed5b765-3f8e-4969-ac03-743d4566b0fd", "value": "httpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f4fb25-3f82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776996392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996392, "uuid": "d5bff5c5-2215-4abc-9e1e-01d1db070f12", "comment": "Malware payload", "value": "2fb29ceb3b4fd71910e3f0a7121d3974", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996392, "uuid": "4e2b43cc-6db9-4b37-a69a-d4657022f99b", "comment": "Malware payload", "value": "2735113c0607ed80260e301a3a358194deaafebe9d9e85c471eb445eb657b5ac", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996392, "uuid": "fd52b3b8-4aaa-43b9-bfef-968546657dd4", "comment": "Malware payload", "value": "1f00c792c9b896e62197e2442b0b6591abde4e49", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996392, "uuid": "39a98683-b2aa-4e74-baf1-c91f30ff6842", "comment": "Malware payload", "value": "c459b13419ca65439bd970c0bf9d164e4c3ca824fd4e4a59a7ccd0e15c1e24b6f40db7646ce1945655177ee191016bc9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996392, "uuid": "2690ba68-a6b5-4875-8d8a-fa378ce0aa35", "value": "T16CC08017817EC90F9D6790D34576551845E0FB8135349B31CF44D8C871514D16246042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996392, "uuid": "a1b58a18-5617-40f0-90f0-623c92f95e81", "value": "3:j+qAHmFEm8nhcDQBfBJpoNIkVViEaKC5SufyM1KvN+6fgrLkhHHhXpv:j+q9NqhnfBboNBnaZ5SuH1mQeEGHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776996392, "uuid": "a25fe418-da19-4726-b201-9f2dc3ad33c2", "value": 166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776996392, "uuid": "07648215-ecbe-4c27-ad47-8c5321bd923f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996392, "uuid": "ad7fd16c-d212-472c-b44c-36ae237c5147", "value": "Percentage.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516f169c-3fd4-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1777031655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031655, "uuid": "f31ad3b1-7e93-4336-a2c5-bb45eb569eea", "comment": "Malware payload (DarkTortilla)", "value": "3242964b93864dc993de384b67e000d7", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031655, "uuid": "7c120e43-ddd3-409a-bd60-b2f66eab26cf", "comment": "Malware payload (DarkTortilla)", "value": "275696fd221a3a3e6d1e8f367ab648d42734bfc4e2deacf8824aeca6546b74bd", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031655, "uuid": "fe6f8db0-8ad1-4305-864f-0e549f654777", "comment": "Malware payload (DarkTortilla)", "value": "2b67aa307b5bf67d62d90c0edc455d2d9b934af1", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031655, "uuid": "bc5d204d-584a-430e-9749-074ae197da14", "comment": "Malware payload (DarkTortilla)", "value": "976adde9c15c408087a8699629378629a7346ac54273385620e2dcd7f49480d02dda0da2533046df32296c277e69527f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031655, "uuid": "303fdf33-64cf-47fc-87ab-3135874469b7", "value": "T1F0F4BE299E82AF41CABE1B79C092481833F0E4539266E71A3FF901F51FA3BD5DD13952", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031655, "uuid": "e7a79418-123c-4af3-8451-9b3e1d8879a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031655, "uuid": "2fd627f6-2dbd-4a2b-a237-40cc5e7eb566", "value": "12288:vBCIb16qzL4yoP8kAsfZVUMtY3odZGvv/Zqifa0ApD46gt9Xzumaa:v8Ib16+fs7UNkZ/oLGsvthZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777031655, "uuid": "21cc7cb1-37d7-457d-9637-4ec6f9a7e75b", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777031655, "uuid": "36305b43-5512-4e59-b9c0-ec080788063a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031655, "uuid": "bddc9b0c-9076-437c-9f52-3dacb542a6a9", "value": "COTIZACION DE HEROS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57cca391-3fb0-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1777016204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777016204, "uuid": "5b7aa7f7-9215-4a12-adea-0c55f8b6a850", "comment": "Malware payload (RemcosRAT)", "value": "19e0563b053db87883ebddd5c54d8ebd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777016204, "uuid": "7fb913ed-e6c3-43b6-b148-3e1b477d2b18", "comment": "Malware payload (RemcosRAT)", "value": "2784de2c816381a25b4189510fe39760e1965e8405ea7e0237b70a69a53f2b8c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777016204, "uuid": "ae84c297-072b-4b73-b0f6-1daaef3fdd48", "comment": "Malware payload (RemcosRAT)", "value": "fe57998c733e0d7833770f705ad238064155408e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777016204, "uuid": "665b7b44-16b3-451d-a0fa-4fcd428ed42c", "comment": "Malware payload (RemcosRAT)", "value": "1d6b2f8451c82f0ffcebab5b9a85260bbe1ee7c06d82c59c32348ff321463c7b5aada2c9a98174a527fc7e5f47fdb03a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777016204, "uuid": "7c6b277e-22d9-4c90-bf03-706a79b0ab6d", "value": "T1F772629259178459EB919F8F5FA4313483783C17B8E4D2227E68F52ECE766820CDC9F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777016204, "uuid": "94099e0a-f29f-42cb-9ccc-1ce65b5ac3e9", "value": "48:v/zq/hJFlVYYKU6ERnKUd5lB8qM80efZ6MiH9YMH/TSEHAnp8VGf32p8wgvA4lRO:v/zq/xH+VGTo4lRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777016204, "uuid": "d4a186f2-32bc-42f4-b8e8-6ccf9f903771", "value": 16181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777016204, "uuid": "98094c80-232b-4836-a2b8-4c47fe299728", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777016204, "uuid": "a478d080-3c14-462c-b645-98342568c959", "value": "BAC374738483837383747473_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79dcfd48-3f86-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776998222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776998222, "uuid": "8514c8c3-694e-4cea-a74b-e621048cce03", "comment": "Malware payload", "value": "ffb45fa14e5dd1c189e8d6f4bf6e170b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776998222, "uuid": "bb6d7532-a320-4f81-84cd-ad2ca156305f", "comment": "Malware payload", "value": "27e03b69d4b1763f6b2aa808d44bbc06a8ce2287e8bb2617fa361b45c649ad52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776998222, "uuid": "01f1e3da-4f09-48bc-a0dc-b220e2bbdc77", "comment": "Malware payload", "value": "7021ff8cf42b596a28752f186ea6a9716b215740", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776998222, "uuid": "ca181707-22c6-4515-b244-45c5613bdfd3", "comment": "Malware payload", "value": "2f85638b0354c882c171250d3235f322cbaa7f3117557ed504f72cbc2dcdc3216d3c25e8c6a363a2163394c7e2a578de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776998222, "uuid": "8a000e52-7b6c-45d5-b531-c59239bea04f", "value": "T1ED348C46F7AA48F9ECB7C17EC9A10A12E6737C010364DBDB03A456565F236D0AD3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776998222, "uuid": "a9cb730f-56e2-49fc-a7f7-285404c222ae", "value": "668bc7640f4bff4dbced3f03b53a7419", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776998222, "uuid": "47b13d5e-45a4-487b-8f85-d746360347f3", "value": "6144:zhnGAY6uCmDZGaA6zuk+OUzEqcj3gczY4:zhVZuVtA60Ijw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776998222, "uuid": "609058d5-a763-414a-a5a9-4fbd2ed35e9e", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776998222, "uuid": "a64573ac-baa5-4f05-8674-bc809f6f4540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776998222, "uuid": "9b0d91db-eccf-45ee-a063-2a0a113b411a", "value": "BenchmarkTool.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587316fb-3fc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777024366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024366, "uuid": "802beedd-b300-4740-992e-d7a5b0af47bc", "comment": "Malware payload (Mirai)", "value": "8e38114b19c8f7abf9b261877201f069", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024366, "uuid": "0e365db1-b273-4c18-b90e-df7417e76de3", "comment": "Malware payload (Mirai)", "value": "28d9b4fbf99bea103bfa2aa0758f705347a5695ea4f722b783802c9e788a2a39", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024366, "uuid": "33f07e1a-9ccc-49cc-8eca-f43f11011643", "comment": "Malware payload (Mirai)", "value": "d8b827da624fcfdf2989db8d30ff0e556f18b6d2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024366, "uuid": "ff80aaec-e9dc-4b2b-a77c-a1c23d31d0a9", "comment": "Malware payload (Mirai)", "value": "1422ac1ac19ced12a1d642fddd6da9fb85d38857a302fa98f893a3d0fd24c9b9d08029d257b4f3dc78437d9c8ec86355", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024366, "uuid": "4a05c2a2-014e-4313-a3e7-e0f54f093775", "value": "T11E3172C660D29875BEF5F52732A8890178C5A2C751CF7F4AAEEC39E584CED08B445B83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024366, "uuid": "834034ff-44ba-40c4-a8ce-0f6b736a44c1", "value": "48:1pipbKpqp+rpy5pn6pR/spupRIpWpn+rpGp5:1ENKE8A58TUwjII843", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024366, "uuid": "0243d3d4-b1dd-42c5-885f-ef9e7ada533f", "value": 1713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024366, "uuid": "1b1d4622-d866-449a-8e81-3aee92711559", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024366, "uuid": "5942b128-8e82-4672-af74-2cb961124d40", "value": "Ciabins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e56f79b-3fe5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777038844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038844, "uuid": "04130908-c5c7-4a6e-a2e3-1a6aaf342612", "comment": "Malware payload (Mirai)", "value": "f56168301db07c72bd0c074c2af4edf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038844, "uuid": "9a706b26-6248-4410-9f15-47eb96000872", "comment": "Malware payload (Mirai)", "value": "29a562adc792a2262651f4c870ddaf22a86ad60375b4f185070e717ce3cf3231", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038844, "uuid": "7c84a9f4-46f2-4660-865a-eb19605771e1", "comment": "Malware payload (Mirai)", "value": "0af0e853e295405f0f20e47a049ac73d8a754471", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038844, "uuid": "d61dcc92-374e-401b-ad59-88207958b132", "comment": "Malware payload (Mirai)", "value": "f43a69bd940231999065cf672ea5336a169805fdf53de5fd732180f08834176645c536724b74d3acf69781959f346312", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038844, "uuid": "69e4875e-1dd6-4afe-90ea-576995bd14ac", "value": "T1B1048C72E8296ED9C1659070F0F5AF385BA3A15182431FBB68E7C2B95087D8DF109BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038844, "uuid": "e489a62b-5e58-4d74-a551-9f653673226a", "value": "3072:qAWepaVWtgTRBLJ30Dm2mJyfqXOhgWAUWMtPUhQXfJ0:qAWeftgTvLJ3Am28yfqeKNwOQXfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777038844, "uuid": "b087f975-4e16-4fce-b546-b54bbb98715f", "value": 187172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777038844, "uuid": "5ee83be5-e8cb-4a77-81f2-f9b27a40c002", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038844, "uuid": "416439e7-8d3e-452d-aa8e-a2082ed15fc2", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9504b1a6-3fdc-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777035205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035205, "uuid": "667f449d-5734-440e-bb4e-3708ab30d5ad", "comment": "Malware payload (Formbook)", "value": "7fb4af725fa2b2d250c50883fb278bab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035205, "uuid": "bb969cc5-f983-4d1a-aeee-380e0598d6cc", "comment": "Malware payload (Formbook)", "value": "2ac97d2b40b2ed7e0ff4050221fb68af6cff39073bbfdc40c3ef4febccd28efd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035205, "uuid": "6c5b3ee1-6642-4d32-a274-cae09f7af559", "comment": "Malware payload (Formbook)", "value": "9f5d04a904b82d9f340f243c7a5940d4adbb412e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035205, "uuid": "df422cca-b4a9-4894-b0de-42f164e15a42", "comment": "Malware payload (Formbook)", "value": "3ae524a5be793c355426768f8e4228de65a27105d5711c39d09247ef75f6705ecbc892f05758d3b756e1ac1ca6b0b32b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777035205, "uuid": "00e4e39e-3dbf-4eb5-91c6-e8cdf5b4a81b", "value": "T18563F0F3CD6568940431DC3DA7C553EC8C6DCCB02C608EB3D825ABA9A327EB245295B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777035205, "uuid": "31c853a1-8de4-4bbd-a170-bde55fd350f5", "value": "384:Pvr7VO3KTAi1dUUGXu17zbzAciaoPow75yIfD7ER8HdiWz2ZSq9N+IGqTQsBcR5o:U3e3pGXy73zAgogoyG088SMG6vrWsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777035205, "uuid": "1397bd38-bd45-446c-a89e-1022dd2adb15", "value": 68283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777035205, "uuid": "a09c7378-950b-4b63-9df5-b94fc37718a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777035205, "uuid": "c402851f-1486-439e-a10b-8e049e1b8c66", "value": "license.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeefa57e-4003-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777052106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052106, "uuid": "9071c3f2-9ecb-40cb-86b0-30a98595eec1", "comment": "Malware payload (Mirai)", "value": "00f8d9c7934e3b951c0ca8b279c5a4fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052106, "uuid": "4b62d697-c0fe-4550-880c-65fc9114d2e7", "comment": "Malware payload (Mirai)", "value": "2b9ea9f8c1fd8d585d0252b8761787f2dec03f5c6995c7d00c3a5374343e137d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052106, "uuid": "e5e783c6-30c0-4d4d-9067-6f3ec17b9e3d", "comment": "Malware payload (Mirai)", "value": "82d464ce94a10f3a8dd64aa2cd4f55933b50b507", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052106, "uuid": "b0630ed7-5f83-4ff0-844f-254b38cd1c2d", "comment": "Malware payload (Mirai)", "value": "56b16fc18565c37930098a43956c9cac88a49daac9beb638779e1d1288c133fd3a8da1a3f53e534e628146699bc19bff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052106, "uuid": "6429450b-69b7-46cc-ac76-37f92c133cfb", "value": "T1D0B2E1AC40940E05D85B41FF9AFE05E6E66184834AFFC7D99F270CC3E2B78A2791C618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052106, "uuid": "aa223e51-8e42-407c-b390-d5012767a576", "value": "384:MniiBi3f2PSrf64K5WFSlvNjJ6mAN8bhmglJbN2EIKHT0P6+PbhDYOK6sNreeCVk:xiBiv2PSbePxNNw8dtlJwEIGT0P1PbhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052106, "uuid": "8e6c7ff0-8f91-4a04-9416-75d95de2c8f1", "value": 23440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052106, "uuid": "3d8a9d35-7dbb-45cb-b6d9-494f2a918155", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052106, "uuid": "91ff3be7-97b7-4d39-91b1-a744f182464a", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724076c3-3fc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777024409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024409, "uuid": "e5fc3c96-aed6-484a-b641-ed0056acad90", "comment": "Malware payload (Mirai)", "value": "96b4a49fa026bc91a5dd2e1fd2e47042", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024409, "uuid": "3e5e6b48-a59c-4749-a1a5-0fe0a7478527", "comment": "Malware payload (Mirai)", "value": "2c203bf2914035458200a9300783e6a08d624693febf17650e8f8b6b39c18488", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024409, "uuid": "a7216e45-e6d1-4f14-b081-5e50c2c145f3", "comment": "Malware payload (Mirai)", "value": "ae4554ac1a2f2cbcaf8a462c4ff4724aa163855b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024409, "uuid": "5897c5f5-5c31-4c39-968a-37dbb24aee19", "comment": "Malware payload (Mirai)", "value": "800d96260cef62ae1e5240725383c25f5813962e7f0e70aacb879d75624ca285bc79a955b1ef5c759011b66b3b4de543", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024409, "uuid": "416b5d00-bc64-4891-9d12-2ac55d98817b", "value": "T1E5732987A9229FB7C006A4F065F54EB40B667D620E1B0AD97075FAE0437F4CEB50AB74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024409, "uuid": "5a7a0761-3ed1-4362-b456-385788227f6d", "value": "1536:EsCqT2P5qxWX1bKIqYotelzKp9AhBIC4o5:EsDdcX1eI0elGo7Iy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024409, "uuid": "4901c55f-50e1-485f-8a4b-e8184834179b", "value": 74748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024409, "uuid": "b80e1f14-f3e1-4985-ae7a-123081200bbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024409, "uuid": "8b709124-903a-4d10-9021-958348ebc1d5", "value": "SH4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a01d79-3faf-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1777015719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015719, "uuid": "8b97745a-9f4f-48c3-bbbe-4981c87e446b", "comment": "Malware payload (Formbook)", "value": "dcb3a082603492ef19ec7cae557f8830", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015719, "uuid": "84e8f70a-5f91-4a17-be44-0b841a711817", "comment": "Malware payload (Formbook)", "value": "2c6332b6b48802fdabb516ce53bffc15f532024cb2287de3428b67840303ea3a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015719, "uuid": "abaf7070-55d9-4975-9c04-920fa7d773d6", "comment": "Malware payload (Formbook)", "value": "05e47f28e678200658a86290d0d8d7a848ba542a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015719, "uuid": "c1d97273-5c3b-4ad6-8ff5-7403957c2069", "comment": "Malware payload (Formbook)", "value": "f2b5e30a63d1c3afb1cdc18857e9d79153f03352e599083785f719d55a6f9b021c008ca33d51e456466ce132f31fb22a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015719, "uuid": "c1e384c0-217d-41a8-99a5-47918e16a93f", "value": "T1D813C5CD36D7B0A54A2134B72D2B7457F62FEC80B24D8365F9D9A0DCB860B19E831678", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015719, "uuid": "aae4dfb4-2354-44ee-9d5d-754b38494c2c", "value": "768:8UO2xhgWLh5ofxirtzIQGDzTp5BVdDCRSzaN6RLht1i1455fMPCRyqa9:8vyhggIfqETfBTDCRSzaN6RLht1L51Mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777015719, "uuid": "70e3c63d-0aa0-466e-8253-c2e43ed856f4", "value": 43583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777015719, "uuid": "b45f2faf-c3b6-4fcf-bbc8-9b95fdbc3972", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015719, "uuid": "f8cc6211-a274-475f-b1f0-3a67e63802b8", "value": "TBT Teknik Sartname_Al\u0131m\u0131 Yap\u0131lacak Malzeme Listesi (184 Kalem).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc37683-3fd4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777031673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031673, "uuid": "7dc996a4-44a0-4d53-b0e1-03cfd739cc3c", "comment": "Malware payload", "value": "24de898aded065a5f5a8ad7c37ceefa9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031673, "uuid": "6e6c3cd5-e64b-422b-8f69-cb8260fd33a3", "comment": "Malware payload", "value": "2cb9f7a6e37cf5dacccc66a1c2bc17fd26edd3505d08cd1ae3c613806c2915f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031673, "uuid": "d7787900-cb67-4f5f-981f-8e6ee0251734", "comment": "Malware payload", "value": "d1b0dce825210ba806ae991d7c3ad1824a4e452d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031673, "uuid": "7db7e684-bec6-45ae-9313-26015edb2e38", "comment": "Malware payload", "value": "68b5a92df1444d2e560957bae9ba6ecd865091f3a3e13bf1d20105720e01969d52948351b5e8d74aee851bcac215d726", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031673, "uuid": "dccf037e-afec-4e35-b7ca-633c04c54848", "value": "T124742138AAFA0019B1B3EF54AEE47493D96FBB63370E985C1091034E4623D45EDE563E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031673, "uuid": "aa6171ee-7bb3-494f-b833-ed4396dcde79", "value": "6144:yDwm9036qHai/N20HDfnrjoo6N1IrQLsIKB4rO7IXVHhVe88:yEmG36qHawNvH7nrj/6N7LTOUnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777031673, "uuid": "b495c742-ad7c-4c9d-be22-52aed2f47931", "value": 338970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777031673, "uuid": "320a8802-82ca-4425-99e0-36987a2f3f4e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031673, "uuid": "a292c3b2-224a-4788-aa59-edf512a7fde1", "value": "PO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f5f6b4-3fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777029896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029896, "uuid": "97fc2b63-e009-41c8-9eba-1ec50fd0914d", "comment": "Malware payload (Mirai)", "value": "35689cc9a575eece98e8a4d95b595417", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029896, "uuid": "53137cc9-1bac-4e4f-87ba-e4d19ed3c9d4", "comment": "Malware payload (Mirai)", "value": "2cc11f3027d109c59508025e9de121cb18b0f3c606135943e7668a92478c5c2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029896, "uuid": "3869ab54-0a56-4b25-9418-3e1573d1675b", "comment": "Malware payload (Mirai)", "value": "d81d7026c760bc8499dd649ab86ddf7862a2672c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029896, "uuid": "fd95052b-87a3-4a10-abf7-7136e482b7bf", "comment": "Malware payload (Mirai)", "value": "9d094ca61e24a113bc7618d2e2fa6cd1c0fdd1f494bf3e57bd0d24538399953bfa5200eba5bd353da510803189a9dd47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029896, "uuid": "9b66d56f-f617-41b8-98d8-5bec00a86757", "value": "T1E193D706BF610FF7DC9BDC3705A92B05289C665A31A97B35BA30D818F64B21F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029896, "uuid": "0a0e4423-a5f4-40c3-b81f-c8040c3cbc79", "value": "1536:BF2GXYZ8a8fnwEvLNPENIdhs9WZx0ZCufqShX:BFjXYyCEx0rhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777029896, "uuid": "506f43b9-d616-4c12-946c-2c390f6cc2bd", "value": 89504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777029896, "uuid": "a30411da-4351-4b63-9303-5bb3d1de145b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029896, "uuid": "3208d705-cd4d-406b-979f-0845bfd83170", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6083226b-402c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777069476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777069476, "uuid": "d26e7585-b1d1-4851-ba35-fc0d59565d86", "comment": "Malware payload", "value": "319a1b032643edc229ff06ad711f69ef", "object_relation": "md5", "Tag": [ { "name": "canvahow-com", "colour": "#24CB59", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777069476, "uuid": "70f2e91a-e8aa-4b76-9880-8e54eb890ef1", "comment": "Malware payload", "value": "2d6140fd8a72fdbe19be8071f4b7a39a582edc970694a924d49d7a9ae06fbf72", "object_relation": "sha256", "Tag": [ { "name": "canvahow-com", "colour": "#24CB59", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777069476, "uuid": "93b9852b-b2fd-45dd-bbe1-52570a40f898", "comment": "Malware payload", "value": "d4732c0bfb70409c68793c04d6aed2918a02ef28", "object_relation": "sha1", "Tag": [ { "name": "canvahow-com", "colour": "#24CB59", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777069476, "uuid": "323aa658-5d35-4f61-90c3-06dfae010030", "comment": "Malware payload", "value": "8424bf4cf7cf6f0b909dd544d3088b2f35f1f107bee8a55701cf443ba136ef47ce27c760c6c066dfbfefe380ed78d510", "object_relation": "sha3-384", "Tag": [ { "name": "canvahow-com", "colour": "#24CB59", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777069476, "uuid": "a19bf11d-7b65-482c-b0f6-ca41ba6f7fa5", "value": "T174B59DC357DC08ED7B8444E942593A5354FBC26B2C9E528CF5E25A07763F8217A3ABB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777069476, "uuid": "b3c07666-830d-4f48-998f-781485365150", "value": "1536:mpu1/SzC9FJKMvMub5rAiGoXJQPrTArCROHQOoPshaybUgyUcXDFcETV2CKOunAu:mkkke6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777069476, "uuid": "5157d3c7-8db6-499e-9864-930502e90db4", "value": 2280107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777069476, "uuid": "f8f31909-3f33-494e-bc6f-b5dc256dafb7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777069476, "uuid": "fe7ed8af-eab8-4ca5-8e40-5a62b64265ad", "value": "spools.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2adc1d69-4028-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777067668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067668, "uuid": "a1f5d811-3517-4bd3-8b31-97989958940b", "comment": "Malware payload (Smoke Loader)", "value": "a7f46aa609d9ae94fd043550b101fa82", "object_relation": "md5", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "iuta-today", "colour": "#073681", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067668, "uuid": "ad65d9e8-fdf2-4002-a753-1d7f280be441", "comment": "Malware payload (Smoke Loader)", "value": "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718", "object_relation": "sha256", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "iuta-today", "colour": "#073681", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067668, "uuid": "236672b9-6df9-4b86-a631-0fcc502fcbfa", "comment": "Malware payload (Smoke Loader)", "value": "25b46be413e32f8768a5502291388f1475538cf1", "object_relation": "sha1", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "iuta-today", "colour": "#073681", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067668, "uuid": "a8f3d063-51e1-4e2e-80e8-dc67a41d7f05", "comment": "Malware payload (Smoke Loader)", "value": "c1e1f47b2c603de7040c7731fab26012c2b1d94b9224efe3865a32ae91dc860b04627392da296466642b53bed94422a4", "object_relation": "sha3-384", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "iuta-today", "colour": "#073681", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067668, "uuid": "90455bd2-c044-4fd7-a584-fb245c2fa01b", "value": "T18C954B067C9105EDC099B73248F23681BB35F8180B3627D32E95AA783E37BE05D7675A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067668, "uuid": "6c58ec1a-3441-4840-ab5e-6418be1de018", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067668, "uuid": "0d012747-e21c-4cbe-a2ea-5c6959cd3d74", "value": "49152:+wx3RNgJTlIO7so5xfb3o8konnLbwip/KMXdJ:+kkKSxkonn/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777067668, "uuid": "0de1783a-7c13-412c-bed6-8e063ddf3fd4", "value": 2048688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777067668, "uuid": "d428e60d-6ef3-4c49-b54a-da3883b0f5b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067668, "uuid": "9769a8a3-7fcc-45cc-b956-2573d2fddcf7", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c7ed22d-4000-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777050572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777050572, "uuid": "0f5e47e4-952f-4449-a0ae-5894a9a0fc32", "comment": "Malware payload", "value": "63d1fa3d64b889ba4fbf960134eafa2c", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777050572, "uuid": "0f5ea191-67c0-454c-ba42-0f57b492fdfe", "comment": "Malware payload", "value": "2e4b3f5491baf57b3111fa2a22e6ab0389a9ac16b9a31fe72a79370bc4d34e10", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777050572, "uuid": "2573b0cd-2f61-411d-9a80-8d718361bbc0", "comment": "Malware payload", "value": "22a4312bbffba4613dbd1e355d6ac413b57d0f97", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777050572, "uuid": "2e0f26e2-b34a-4cd3-b970-a64cc8df8d18", "comment": "Malware payload", "value": "2acb630cc71ff53edb3b6633edcc984a43e1f273fc63dd3e092894c8f6b5c7513e0268b8e7a6abe709e52a447c5f18e1", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777050572, "uuid": "081b61ba-32b2-4d04-9747-4cffd7b57a8f", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777050572, "uuid": "cb9718fb-436e-4fc7-9048-8d4deff91451", "value": "3:N8DSLNGGn:2OLUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777050572, "uuid": "aa77665b-4cdf-4579-b83f-57462bf51ff8", "value": 22, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777050572, "uuid": "757d5308-2438-4603-a20e-0b4fa0ac730e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777050572, "uuid": "ffde7d7a-6aec-4129-9386-29f8c34948c7", "value": "d&pushd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d0d523-4039-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777074966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074966, "uuid": "5e07a254-43fa-4a3a-a205-af2491b5843c", "comment": "Malware payload (Mirai)", "value": "0ab2edcc557dd7ae02c4762d8ba59499", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074966, "uuid": "0f2a15c2-57ce-4fd7-8600-551229e8c2a1", "comment": "Malware payload (Mirai)", "value": "2e749b4aa9b611d56680ea7d19d64a871cbbf7ba19972188facbdc7b9e47fb36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074966, "uuid": "d4a88927-0560-47e1-9e82-ed2a9add2b7e", "comment": "Malware payload (Mirai)", "value": "315b005216d122bdf5d56aa324511d2a2057b990", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074966, "uuid": "b8e66c33-8327-472c-8369-a6305d734630", "comment": "Malware payload (Mirai)", "value": "cde6a9531d22d3eed3e3c218490c9b0d0c25e22c8d506093a59d092da33635d36ab2ae9ac098ec62ddca1722380e8803", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074966, "uuid": "ef46415f-35ed-41c0-88ab-f3b0168db282", "value": "T1D204C6066B910FFBDCAFDD3746E9070139CCA51B22A93B363674D528F54A50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074966, "uuid": "99cd9e46-3f8a-473d-9600-e56ec2e8753a", "value": "1536:mK0x6RY7of9XhlmStvJtanth/d1ED6clk3C7bkcUlMQbZQzgWscTdUPgkUe5EQtH:70F78hcSxzath8IcgbXudUlUXQtZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777074966, "uuid": "a378e5f2-351f-4c83-bcf1-947e10a63386", "value": 177848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777074966, "uuid": "a495e71d-d9c6-439c-966e-ba87f3a0d784", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074966, "uuid": "04c1fb3d-9a8d-4b6d-a18a-fd05f4fbfb2e", "value": "jew.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ac0666-4031-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777071881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071881, "uuid": "470b2250-d86d-4ccc-82e8-f71269d4aeee", "comment": "Malware payload", "value": "aef8b097f8c7edae17b909e6356a62af", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071881, "uuid": "750767fd-4ac5-4475-bbb0-3f0edcdd278d", "comment": "Malware payload", "value": "2e9892827c1b83c1421c7f6cd806bed9f8dfd424607844e55b57d97e3b42ce58", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071881, "uuid": "09eeaeee-c744-4dfc-94da-9529f246551b", "comment": "Malware payload", "value": "9eee52880f640834a453b06795dd744684047fef", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071881, "uuid": "c81d01eb-e306-4153-aee4-829d45e3ea6d", "comment": "Malware payload", "value": "ed96da07b7e92767fc72d103ada57c4c0b2e576c75b742968cbda14263f9e4158e4c2ef7e12d90501ef3b432351f62a6", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071881, "uuid": "e3c60434-def8-47ce-8b3f-92218d6c8a5f", "value": "T1455523A00A247F6D070D873C241F2A5BD4214F05D44CBECF59E9A4CA77EBB41D693A7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071881, "uuid": "e9d758d5-672f-497e-9c9a-dc6e7e6cdf62", "value": "24576:0+wgkUGbo8/sb5ktKOiEnkDqFMrmZAJpn/lnDa61R/4oxCVMojcGM6H:0ht1JKGk/6CN6MoQKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777071881, "uuid": "fd4da463-fe44-479a-9bb5-81a8a2ac1be9", "value": 1346898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777071881, "uuid": "8c7c9026-ed2e-4c2e-b5ee-3da3c85abe86", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071881, "uuid": "6bfef1b9-1ab2-44c0-ad1d-22e65bb26e92", "value": "NqzZ9cVR6iDnn9.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f80d9602-3fad-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1777015184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015184, "uuid": "9ff876c1-c8c7-4e4e-ac23-d45574417233", "comment": "Malware payload (PhantomStealer)", "value": "44aaf205c86360e2ff041bd87ddcd9a4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015184, "uuid": "dfb58ed8-c98d-481f-8f9b-ad9fbeded367", "comment": "Malware payload (PhantomStealer)", "value": "2eca99293853acbca422c4b5d0acd446d3eafadcf1873a4a61b0a388d2c0f9f1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015184, "uuid": "2314d019-97d3-425e-b6e1-f96edbc8427f", "comment": "Malware payload (PhantomStealer)", "value": "8fc281f0d53e7188b1419e9bac8e95802a4ef140", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015184, "uuid": "02622444-bd3c-4e81-ae11-2524f4f7fe57", "comment": "Malware payload (PhantomStealer)", "value": "09cf954767e140cb44627871bfdb8bf4fdff46949f66af01ee9c27cdc2a3d5e47e3084a79f29b9b49697029038fea86b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015184, "uuid": "f875ba0c-4cbb-4485-a7f9-c6806e626540", "value": "T137542C203AFE501DB1B3AF995FE474A69E6FFA732A16945D1050034B4B23E40DDE273A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015184, "uuid": "c53de768-c3b0-4c63-a175-60dd0c7ec098", "value": "6144:W+RpGiBPOHoTfATI0UKsw8DwGgKi9dHm8fJFBrxIDr2vg6gvnOj87m8Ak:WRiBP+UfATI0UKt8DwGA9NRBFBrxIDrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777015184, "uuid": "e797157e-ca84-42a8-b20a-ab3b396b14ac", "value": 283786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777015184, "uuid": "cb306fba-2cb3-472d-8dbf-e5662e97a047", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015184, "uuid": "71ffcea5-eeec-4dc3-90be-ce5d8fb05411", "value": "SHIPPING DOCUMENTS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca34f46b-400b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777055480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055480, "uuid": "3c98ce85-65bd-49da-8c1d-306a175168e8", "comment": "Malware payload (Mirai)", "value": "4a337828aa363fad1aa1cef316a47ffe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055480, "uuid": "6b4eb307-e5c7-48b2-a4e7-c2d4bec0e0c3", "comment": "Malware payload (Mirai)", "value": "2f62d5dca47ef490addeec389585300adb39b62190ecdc397a829f3d4adaf3f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055480, "uuid": "df512430-12da-4e95-ae3e-fbcecab8b79a", "comment": "Malware payload (Mirai)", "value": "4f0397c462e9013da9cb481d60ea875e12f78443", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055480, "uuid": "b9cafcd0-50f9-4006-a8a4-2a01697de1a7", "comment": "Malware payload (Mirai)", "value": "38f2943eedd55ce21361dee0d3eaec14d1776400cdb52c7baa26a683ded37c93848139cf37fe1118e95b8208230357db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055480, "uuid": "edb5c4bd-6491-4e9e-b3af-461d49438a2f", "value": "T17D2309C8F443D9F9DC5A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055480, "uuid": "bc91e5d0-add1-4157-884d-95491d404c7f", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AGX57/4Qw7bn2ige:Gv4QPfZfW5XTOeoEzJ7AQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777055480, "uuid": "db21845a-2ba5-4a0e-9f91-7e743c434f08", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777055480, "uuid": "342aede1-2e57-43f1-8c58-61056242ecdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055480, "uuid": "11e6e50c-2cf8-47e5-bcdc-5a9c774b4e79", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ffa75af-3fe1-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1777037317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777037317, "uuid": "5b8140d2-86bc-4697-902a-ce2babed2194", "comment": "Malware payload (PureHVNC)", "value": "95c72a3267207206bccd67bfc4ae46b3", "object_relation": "md5", "Tag": [ { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777037317, "uuid": "d7b69c30-8d1a-4f24-bbb0-515b348e06ad", "comment": "Malware payload (PureHVNC)", "value": "2f78f2820a9cf84bd99ec2af2813555586d1c463a6b73cf8635c9fe3bcdc4ea3", "object_relation": "sha256", "Tag": [ { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777037317, "uuid": "d6f0b7ea-e646-4a45-869c-789cccd236f9", "comment": "Malware payload (PureHVNC)", "value": "3cba56ded064f8baaf79cea8c3a02f88fda81a1b", "object_relation": "sha1", "Tag": [ { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777037317, "uuid": "3354bd98-af05-49a7-bd59-8d00e5f77d45", "comment": "Malware payload (PureHVNC)", "value": "488f5134660bde5ebb238f3d0bbc6851bcbd37d1608dc41e27db798a87811de607c1367adf1d37b95956afae4c678e53", "object_relation": "sha3-384", "Tag": [ { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777037317, "uuid": "f1eb6308-a799-4530-bfe8-03576b521c83", "value": "T14DE6D04F51FB0E76F5ACBA8462FACA76F537569ED0D4000EB793992C90B09F88C05B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777037317, "uuid": "7d9a505b-403f-4fa4-a9d5-ef56fda29907", "value": "192:w+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1+1B:4VvDKXXtP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777037317, "uuid": "fe1928cd-72df-408e-bd28-cd7a6b4e06e3", "value": 14535654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777037317, "uuid": "ac0dc85a-2c6c-4214-bd94-acf847b34f8c", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777037317, "uuid": "7c13d564-4e7a-4261-9087-4ec507351e58", "value": "RE537613DE Rechnung 24-04-2026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbb4917-3fc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777024398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024398, "uuid": "22407a99-cb8d-4ab1-8707-75d471c8cf82", "comment": "Malware payload (Mirai)", "value": "4c21e2deb011894dc9efdf48d0b76c6f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024398, "uuid": "99e59752-16b7-40b4-a24b-f1e60ff95fb7", "comment": "Malware payload (Mirai)", "value": "2f7d62f92942a794d1bbc33a6447d2665b98538a9c7a49a236b1d1dd2423cc28", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024398, "uuid": "9b672867-7056-4de5-a0f2-ea760be48a99", "comment": "Malware payload (Mirai)", "value": "ac68d771748e84bd1aa12014bf9735d892eb4cd5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024398, "uuid": "969ba902-d72b-497d-8419-68078611814a", "comment": "Malware payload (Mirai)", "value": "9f219b3e4a5d757f7be5c5081e2e75e31a6e90919d02f2583838db8836ce1a95253d2716723568e2631f7c324f9e0c4c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024398, "uuid": "08d16343-7fe7-40b9-ae36-7579c16b54b9", "value": "T19A83084BAB1D0B47C0A76AF03E3727F4976EBEA111A445C0601AFEC143B29F17156FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024398, "uuid": "6a33269d-5158-439a-afef-5689434487fb", "value": "1536:0+iFdnIoUpmO802H3hyu767lAEhI953aNq37bAZEtv:PMZf6nI953qqN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024398, "uuid": "7d370640-1505-425a-a44c-215e4e1df649", "value": 84240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024398, "uuid": "49d1d2e1-42a8-462f-9c7b-4d8d6b2030b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024398, "uuid": "12bea741-a25e-460e-98a1-c385cfe268ee", "value": "POWERPC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18de967d-3fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777012233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012233, "uuid": "415b1839-4096-40c2-ac65-6fefd4c2545f", "comment": "Malware payload (ConnectWise)", "value": "0eedae0d6f73521733fb032355a4f275", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012233, "uuid": "a3f40d43-fff2-4d55-b4db-8c08a356d534", "comment": "Malware payload (ConnectWise)", "value": "2fbbe5a1790c35b582facc4ac1e7b71cc50ab6c0fde7c426f13d168d25b44e22", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012233, "uuid": "8c95645d-3dce-4717-bbd0-89d1512bd33e", "comment": "Malware payload (ConnectWise)", "value": "61425952c4315c586412f2ea2eee78b38b441a1f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012233, "uuid": "8755c999-2de7-4e44-b1ec-7c30ce837aa4", "comment": "Malware payload (ConnectWise)", "value": "e17ebb7290837e5472a02607bcf918cde65220842032533a079360f5342d8d277ef24c06e3037e7316a71d22dac2c48f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012233, "uuid": "5143796e-8e4d-44a8-8d9f-2a73262e7108", "value": "T1A2646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012233, "uuid": "a212dabf-59d7-4f34-9274-6efb9e5985f5", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012233, "uuid": "94bbadbe-122f-427f-9cf4-9182098b007f", "value": "6144:SmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:x1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777012233, "uuid": "f4482472-ce5c-4299-bcf2-a31a865a6e2a", "value": 312512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777012233, "uuid": "40844cee-6aa8-4454-8b0c-4b46ae0dd9ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012233, "uuid": "ac3a4d08-0128-4344-98e4-4e3c3e2ab377", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f992270f-4037-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777074457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074457, "uuid": "b6131430-5869-4641-99ec-a4787dd27107", "comment": "Malware payload", "value": "5e44a806263ee15f7a0cdd5a3cacbacf", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mpla-clo-cc", "colour": "#A1A587", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074457, "uuid": "079e874f-8d26-4f33-8924-1e96db99214e", "comment": "Malware payload", "value": "3194b61d652d50f11bca2edf4708a5ba322a190b6bd3d447b516507add5adbec", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mpla-clo-cc", "colour": "#A1A587", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074457, "uuid": "17d58edf-6f23-43e7-8f54-366ebb879371", "comment": "Malware payload", "value": "fc654f053ebdd25fec4ec4797402e212117b94f5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mpla-clo-cc", "colour": "#A1A587", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074457, "uuid": "0986ac1b-6907-42cd-a1ed-2cbd7eabeb6a", "comment": "Malware payload", "value": "e3f936931f9b82d14c48c9e6e970cebed4f02e765f031298744d6edb8508a2f312c3236cadcb3a2e48a6ad1755334f85", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "mpla-clo-cc", "colour": "#A1A587", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074457, "uuid": "329478ed-9025-4740-86fe-f3cc2c1db25c", "value": "T1DFB57CD357DC08AD7B8448E942593A1354FBC36B2C9E528CF5E25A07B63F4217A3AB70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074457, "uuid": "59898b6f-cb7a-418b-9bbd-c798de4bec56", "value": "1536:QNjc2PE0l0ldubktCZUsNQMcjb9Z7+pDc437W+30O0IoKhnbhFUjrQlNU7R440sx:QNqkkBvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777074457, "uuid": "e26bbb74-db46-4786-b559-8eb6019041cb", "value": 2277201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777074457, "uuid": "8d59692e-c7fc-473e-b735-d7ecc0b84b04", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074457, "uuid": "1fad764a-401b-4293-ada4-353f310a60b0", "value": "cl-ncl-following.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15ebed0-4004-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777052432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052432, "uuid": "580806bb-d628-48dc-bc35-9728af56b2cc", "comment": "Malware payload (ConnectWise)", "value": "368d112e43787c25815f32728cf3fbce", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052432, "uuid": "3ee2a359-52df-4f9d-b167-c8d2f6601b9c", "comment": "Malware payload (ConnectWise)", "value": "34a19c2071df46b14a28d612cc2eeeed032c74b0d9a84409a419c43a361021ce", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052432, "uuid": "974684b2-fc6b-4adb-afb2-5bf748122691", "comment": "Malware payload (ConnectWise)", "value": "1bb43235e69974b0e7ce17f0e0153835d616f758", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052432, "uuid": "e001a5aa-c984-4391-8eb9-93ee3fb809ec", "comment": "Malware payload (ConnectWise)", "value": "75dc905d523e44ae24ceaf024522be2c38f24b92c32b714bf211ffe4c66ad61283130783c4cb9f0f89e249808eddf0a6", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052432, "uuid": "2978f373-f4f9-471e-addb-3af3926fa71f", "value": "T12BA623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052432, "uuid": "1260755d-8d2e-415e-bbee-3471edf886e8", "value": "196608:DnCtVYqI5MvbWEpKkqUIJqKZnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqwnCtO:7CXvI5MvHxsJ/CXvI5MvHx6CXvI5MvHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052432, "uuid": "0b192235-6079-4b7f-95b6-d442c9ab2742", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052432, "uuid": "975900b2-ffc4-4b2c-a180-3520aaf25d27", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052432, "uuid": "12e157eb-9146-483f-b607-9dfead6f60ae", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66dc4b4c-4036-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777073782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073782, "uuid": "a53fa109-76c3-42fb-bc75-f1b126cc7e74", "comment": "Malware payload (Mirai)", "value": "0292ad11dca056fd0450de26a5b1d994", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073782, "uuid": "097e09aa-9347-465a-8cda-bbfde09b095b", "comment": "Malware payload (Mirai)", "value": "351e55951c1a1da82c1c766360f3b8c039fd28655e17c954fe9b231fcd294986", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073782, "uuid": "40682ebd-2552-463f-a5d8-7146270674bb", "comment": "Malware payload (Mirai)", "value": "79fcf477475e2ecdcad1f0fcab0efaf3d78aa038", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073782, "uuid": "765653d7-8f64-4d00-be79-55b76cd897cd", "comment": "Malware payload (Mirai)", "value": "28690d480021b070829aec0bdb31107a5594aec5d12e9975535885ae6993270ea0ab30461c347856e5a5365eff759ce0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073782, "uuid": "0a97c008-0e94-417a-ab28-4378c8c4c205", "value": "T178A44B65BC419B51D6D02ABEFF6E828933132BB8F3DE7122DD055B3067CB84A0E3A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073782, "uuid": "059f1c50-8269-4e87-8ba1-01ecce087a85", "value": "12288:W7fY+/fC8JTg2vLV8ZOxkxjRXgspXTFfr02ocaZQbORmdEFF/9VXpWah9ulkTg+e:w1aT0/DeHej/UkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777073782, "uuid": "a3be75eb-31b5-4016-8e51-44fb570be780", "value": 457824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777073782, "uuid": "8b75e3dc-fb9c-486c-bdc4-20868b8d2eb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073782, "uuid": "39d5a93d-4afe-4592-bd92-28958f050622", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2670c34-400b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777055521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055521, "uuid": "acd425bc-a720-4f58-9060-d22655336658", "comment": "Malware payload (Mirai)", "value": "d24d181c728e910dfab8beef41f4d673", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055521, "uuid": "d0d7f284-6cba-4e30-b88f-224361af7500", "comment": "Malware payload (Mirai)", "value": "369c7a42bfd090baba04ffd9e81b54835de4ab1b802dcd8bfde84e598f49f019", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055521, "uuid": "bab9c237-b9a7-434c-aa3c-08b31cba2d48", "comment": "Malware payload (Mirai)", "value": "763b23045f76143b8cbd0b928513f7cec0f78450", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055521, "uuid": "45aa4e4e-a7a3-4226-8d50-35bacc603c58", "comment": "Malware payload (Mirai)", "value": "d6be70556ed3b940884e1986a148956ab3ad796cbfb353eefe9f65d641237326412becf640db0a1dafc1faf61810c9ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055521, "uuid": "7a9aa2d3-98ad-4265-b8d9-8556a2648933", "value": "T187630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055521, "uuid": "b98f1dc8-42d6-4268-b73d-231cceb76e33", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777055521, "uuid": "3e5064d4-e40a-4845-a38b-db406933d656", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777055521, "uuid": "80cfb72f-b0f9-4c96-bf8f-c63718298e92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055521, "uuid": "82f27c9a-a52b-41ac-a43c-49a512424a35", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0017467c-4033-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777072321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072321, "uuid": "122ad6a5-28c2-4ddc-bab0-9cadc1f52451", "comment": "Malware payload (Mirai)", "value": "f02a85341e7d132281d53d4d06a2bf73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072321, "uuid": "36e6705d-5775-4c78-88c8-25d3c2510465", "comment": "Malware payload (Mirai)", "value": "36f9404b02c73eb73585e6db898925705a5f0b9a48aa0607b5e2aef924ec63ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072321, "uuid": "94307fd6-a4c5-4a5c-bb97-fc28f35306f0", "comment": "Malware payload (Mirai)", "value": "01df9578408c8ffb36078407c8451f8fb1523c5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072321, "uuid": "90da326d-5730-4bac-bca7-f47455f479ba", "comment": "Malware payload (Mirai)", "value": "440ebad09efc1a23d0ce6a6f8a72317e345485a171efe78be4fadfc7c6d5c4a5a7c75391dcd14daa0245db48e0d23222", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072321, "uuid": "ccbae362-7c8b-46dc-bd6a-02566f78afc3", "value": "T128634BC0B583D9F1DC16067430A7FF335E36F0F6622AE98BD3E46963AC466419407A9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072321, "uuid": "7d33c63a-fcee-4a72-81f3-24616b0b8009", "value": "1536:HafAEdoRs3D25y5uScmhYr/pNeITYNQZYwrg5ORCFYVX0ije:HeWs3D25y5Tcmhq/p4ITYNMs9FU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777072321, "uuid": "820796a8-34c6-4bc5-8df3-9bac5e8d67d7", "value": 70416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777072321, "uuid": "154533d0-a61a-4097-8c31-990a7d00e2e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072321, "uuid": "35e79e67-b162-4eb5-9dbd-44cc14c69c95", "value": "jade.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fbca9cf-3f79-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776992568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776992568, "uuid": "fe5117f3-4480-4cf4-b47f-e759f679bd59", "comment": "Malware payload", "value": "f5a5d95f6fe7c41311b7e81e5020b515", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776992568, "uuid": "133dbeae-994d-4f83-947c-247a052a588d", "comment": "Malware payload", "value": "380688f44fc28335e8a4e6adb3b08029af751d9411c653b06cb3494dc4046d0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776992568, "uuid": "9a62550a-c605-4357-8728-73bdec614580", "comment": "Malware payload", "value": "0b986881d7ebba8ddfb89143b518a3f823d4ebf2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776992568, "uuid": "6175fa6c-959e-437c-9266-3a2bd355306f", "comment": "Malware payload", "value": "5b1065f3a90a87520bc594ab3e43c114b589d1ea72ce90018c6da43d2e8bf6ce07175a8c7e205098259232146bb8bb54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776992568, "uuid": "fe9223b7-e9c7-40e1-ae3e-28ca15863664", "value": "T14ED3126AB1418DF0CBF5A00F0BFE1F105B9CF471DFB5A408C9C216DEA467D5A8A8A1B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776992568, "uuid": "92d16d75-c3f5-4029-8e14-82f94899b3d1", "value": "3072:vWHSnk22SbQuCcSnrGj3TIETOrzN/d2hm:v7lQRaj30gcN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776992568, "uuid": "f3a64ddb-2c48-483e-b606-7d351e056781", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776992568, "uuid": "d76bfc47-98b9-4b9a-8b2d-536cc6e13097", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776992568, "uuid": "6b0f1574-3cdb-4c2d-8fab-eba595948c00", "value": "380688f44fc28335e8a4e6adb3b08029af751d9411c653b06cb3494dc4046d0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79d20c0-4000-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1777050778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777050778, "uuid": "4f9e7cc5-ecca-482a-a09a-220d1bba1fe7", "comment": "Malware payload (WeedHack)", "value": "589b1d6ec4d60a3917fe21bc2de2a40c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777050778, "uuid": "c3dd07e9-6fe3-46b7-bbed-b235fe6bdb7d", "comment": "Malware payload (WeedHack)", "value": "3957dd39375b7823cc8dcb0204f94bd9e2e416556496b94f84f3b06c1c8ee02f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777050778, "uuid": "6a21a43f-7d18-4adc-a632-52880a2cd8ab", "comment": "Malware payload (WeedHack)", "value": "063d9095d93c146b3550a34004bdc0991b918175", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777050778, "uuid": "25331c77-1fd2-4b2b-b9a2-3dccddaa089a", "comment": "Malware payload (WeedHack)", "value": "54dbd2f1ccb76a3e8dd3c84681065014e5568b3c4ba52799d24f82a4dd9b500f1fd82f47824cf0e096455e9ce050e802", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777050778, "uuid": "bb08c138-2056-48b9-8759-928eb169aa62", "value": "T10394D62EFF95D568D04369304204A163B42C92CAF1C9E3AB1DA34D5A2D60F778B16FCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777050778, "uuid": "61160eef-66c1-41d1-b314-de58d32e496f", "value": "12288:R5j/oCKGG/WTlrXs+am4BqkDiohitmiFZ:DDlnB4Bao4FZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777050778, "uuid": "51791ba5-cc7f-46fa-b586-a9ac45c6bdf3", "value": 421231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777050778, "uuid": "eed17493-5839-4557-a4ea-292e18afcd1d", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777050778, "uuid": "901a3987-3c36-4ea7-87eb-574993a78e04", "value": "Donut_SMP_Dupe-1.0.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84534576-4001-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1777051068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777051068, "uuid": "991424fb-6132-4eb0-9389-9cb60f7769bf", "comment": "Malware payload (QuasarRAT)", "value": "09308c64c780b6fb501d66fec2138207", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777051068, "uuid": "83760292-1ee9-447c-a355-ea724426fbb0", "comment": "Malware payload (QuasarRAT)", "value": "3b16f98ebdbe6b3a333a0908d6eec33c754ba9028935fe17b8b02d9975b4616f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777051068, "uuid": "6d6517ab-ff63-49e2-aa83-bd87b2f24a77", "comment": "Malware payload (QuasarRAT)", "value": "07585cc5c6a995bd4b390b1259f6e3f392b5194a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777051068, "uuid": "bf162831-a077-4ce6-aa46-69baabf19c22", "comment": "Malware payload (QuasarRAT)", "value": "6a9fbe88a2b73f3e8d27afd0f56c01255c1b1764f7a40446c8e994b31e923425d3307f8672a201dbf0d11c958edf41ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777051068, "uuid": "a5ab3d68-3d83-4afe-ad1f-cf78a1fa0ae1", "value": "T144A47C4427E8922AF17E67B9E87194349BF9F417A467E74E8D00B5F928A7700DD00BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777051068, "uuid": "053106b8-c7df-4f85-9b5c-c4f9c30d0280", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777051068, "uuid": "451a85da-e82b-4e73-9b65-948b840f520f", "value": "6144:CTEgdc0YuX7IxUpGREWpfat1r1VJBudyZdYkfREcEbfWnbiefntAcTR32:CTEgdfYfxUuf6xU0dvREjKftAcd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777051068, "uuid": "d25e2f25-3ad2-40a1-a119-8dc362b7723a", "value": 452096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777051068, "uuid": "e1019136-05b3-4947-919a-d648c95c3969", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777051068, "uuid": "d10f84b2-b078-402c-8536-0c6dbe891c8c", "value": "schtasks.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c02a3d2-3fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777029874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029874, "uuid": "795057f6-95d2-4b38-85a2-e7aa31903b84", "comment": "Malware payload (Mirai)", "value": "a339c10c3f8e3c8d9cce401dd8a8eb26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029874, "uuid": "e85c7acf-1a0b-473a-90df-96a0d4a3210a", "comment": "Malware payload (Mirai)", "value": "3bffb48736b2b8bce58e86e7be860771d837c9f372b8aac35491eed10b80d1c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029874, "uuid": "88a06211-ae3e-47a3-ad9f-e53e72cfd8ed", "comment": "Malware payload (Mirai)", "value": "78562952340f3401446a05c68dd5046737a98131", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029874, "uuid": "36845f52-bcb9-4acf-9a9b-b26b27a7858d", "comment": "Malware payload (Mirai)", "value": "e234d6583967ac8d4a6852ee4ae6efdb2bb14453af212496e4c35ee5aed60cf0e715027ab44fea84e42c391834eec36d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029874, "uuid": "968bfbdf-ccbc-4afc-bfb7-3eaad3c3cbbb", "value": "T1FC730A85B9819B25C6D513BBF91F018E33165BE8E3DE73129D201F607BCA91B0D27E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029874, "uuid": "83a01a75-93d3-4460-a4d7-1ceb6cab5649", "value": "1536:S9KnGSGYfkiu/ZwQNCJEHQXglNU6bO3d5yAMw1f91uwcWIWinluUsPMrQ:aEkiUZJNZHKMNU6ba4XwtsluUsPMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777029874, "uuid": "387ca92e-e173-4e2f-ad32-88e029c1218e", "value": 79852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777029874, "uuid": "f1f01cfc-8fb9-4dbb-81e7-1040150e0c5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029874, "uuid": "a4a2969d-2cb1-4f29-8e90-8ac764263d23", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b41e50-3fa9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777013380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777013380, "uuid": "e0447ac7-eaa8-4173-8d4f-933c83f7bae9", "comment": "Malware payload (Mirai)", "value": "aab0540b6114612490a7ce3a4ec156df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777013380, "uuid": "2af5db16-d6bf-4224-bb17-5e0fc58dd2df", "comment": "Malware payload (Mirai)", "value": "3d2cfb952099b258690817c2f0561c79beefe752771024975ab66d43a9529a0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777013380, "uuid": "1d681db1-5522-4758-8749-f163b3ce14d7", "comment": "Malware payload (Mirai)", "value": "c0c65e27212219d42d3bcc6d283becc7c3d2accf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777013380, "uuid": "7ca63ba1-c3be-4bc8-9b33-5629f63cc014", "comment": "Malware payload (Mirai)", "value": "fdf5c447eabbb718d2858ed26f6bf009e5622d5179ebcedfe9183748f792e3bc23785ecb2fc4444698cc159fbc2a2397", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777013380, "uuid": "a513010e-58f6-467c-a24f-68e8fcd08e2b", "value": "T1EF247C99BA4F7E82D2C6D3F89F8BCB91312731958A4682F53D01132DC5C6DD98CE2B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777013380, "uuid": "e1de4032-223f-4ac7-ae4f-950835a5e55c", "value": "3072:kfDjt09HLyWCE5lZoFN1lwJslp4CKFMeveNevJjxtWjq8:mtWybEXSFLqJslp4ZaieN8FEjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777013380, "uuid": "6c94d6ca-f841-49ef-9821-b268aba57b07", "value": 211008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777013380, "uuid": "58f9586e-a47b-4d59-8fc6-2452eed2eb9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777013380, "uuid": "ae82c35e-27b2-42ee-adcd-61ab5af73a23", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef2417e-3f8f-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1777002096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777002096, "uuid": "fe085506-71e9-4c10-a446-15ec49c6cea2", "comment": "Malware payload (ValleyRAT)", "value": "27623783271c5081889fffd34a35ef89", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777002096, "uuid": "ebc80d8a-662a-4b6e-901a-d4b02ad4adb8", "comment": "Malware payload (ValleyRAT)", "value": "3d3baf5cef394a0a04afdb180133e1bc843d63b1173be1e53f4b7f630d311bd8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777002096, "uuid": "ce21e275-ea5a-4190-af7c-f4f621b2b5a5", "comment": "Malware payload (ValleyRAT)", "value": "260ecc663aaaec05f756d918bf4e2cb53e16b6a6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777002096, "uuid": "05cd6f9b-7870-493c-823f-ee81b8857d43", "comment": "Malware payload (ValleyRAT)", "value": "8c10ddd2eef63aaa9fee49e0466766f51cbe0b23467c4f0fb6c6d7ec59642efe115e5fea1d77ec94edf65dd3a18171e5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777002096, "uuid": "510769c0-c4d8-4376-bd92-441c2a69077d", "value": "T1BE645B2572D4E036D1AB29316A7787E64ABD7A7009F0D41F9BD40A2D2F32692F73131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777002096, "uuid": "84ee100c-341b-40b9-b49f-a8c0a5dff39d", "value": "733c634382deab64142c34fd392d09e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777002096, "uuid": "493d578e-3948-43e5-a4e9-031097e4a066", "value": "6144:Iyps1bBWuVWCH5XRXS57ooL7bmZdMXmnoU/XjKiFv9:zpurVWCZg5koDmZdMXMoU/XO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777002096, "uuid": "43ddbd82-1b20-46a1-a89b-3f5d99cd83c8", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777002096, "uuid": "553df019-0f24-4a60-986c-e5e0f4d0b79e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777002096, "uuid": "5adfc845-c255-4f30-ac90-95fb9db2e5c1", "value": "27623783271C5081889FFFD34A35EF89.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1fba81b-4000-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1777050769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777050769, "uuid": "bf3fd1a2-4688-4655-bafd-f45e42558443", "comment": "Malware payload (WeedHack)", "value": "1a7aaf67f0a09eb2d13082bde7ff4579", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777050769, "uuid": "636e3b6b-0c00-4e55-8e61-2d09fae435df", "comment": "Malware payload (WeedHack)", "value": "3d4688627a8d92528e579495ae5299369d738520658ec35de0b3c4632cb5fa91", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777050769, "uuid": "726e5afc-7286-49b0-a021-15a84b541eee", "comment": "Malware payload (WeedHack)", "value": "359284801025aea06a0f1fe6c2b1f84d2632d561", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777050769, "uuid": "fb9d73c8-91ae-497d-87ab-f0d7b79c6df5", "comment": "Malware payload (WeedHack)", "value": "ffd5468317b4f8ac21802a7d2c72387296b0b646b3f04bbe1dfe3ae2b60047267c412b46409b3fe9566422081a42f28d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777050769, "uuid": "42a54e28-660e-47a8-b7b6-99ca10772905", "value": "T11403E11AFE65D52ACA47E13120580D5BEDB4D3D3D88CF38B395108E98D56F68DF8218B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777050769, "uuid": "fd66f6e2-eea0-450c-961a-a362e4bff20e", "value": "768:7kqkYtBm9nLq4Zitdli1S5E0qmMfV4EcFV+kpeU5s0:4qkGBuNctb60qdfV1LkUgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777050769, "uuid": "1360abd5-8e93-46c3-aa4f-791c677d2570", "value": 38162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777050769, "uuid": "927bb031-4c4c-4ab9-a7e9-227d36d63ce4", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777050769, "uuid": "2efcedb7-f04a-4923-aa34-d6ea32aad907", "value": "Donut_SMP_Dupe-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fb9d63-3fc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777024850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024850, "uuid": "916b4fdd-f882-4c59-90b8-f76ceae89994", "comment": "Malware payload (Mirai)", "value": "ff0cfcf2bee247b66fa53b1b5d02d6d1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024850, "uuid": "623fae03-e62c-4e93-98c2-22ae1e87705d", "comment": "Malware payload (Mirai)", "value": "3ed5c0dad5c55dcb78e6b41e6d62489e2c3991f9901d1bf0ee63e969f99a98ad", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024850, "uuid": "8f72de70-8ec3-49bf-b85a-68d3c489595b", "comment": "Malware payload (Mirai)", "value": "f44594c4b609b06e127f5a07b6d33b2465ba0984", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024850, "uuid": "7d42eac6-e2d7-4b56-86e2-b7051ef559d8", "comment": "Malware payload (Mirai)", "value": "e4664b410996c851fb3edfde847bea69a2eb7dd45c63fc775bd5e2a522027b9e3d18e9686eb34910252762494cb36fbb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024850, "uuid": "3d2119d9-e39f-4f4d-89ed-8c191559b19a", "value": "T19FD30945F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378696B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024850, "uuid": "6fed6922-2b15-4582-8159-72c7ee9d4025", "value": "1536:IKdzElm18uZJNb4A7Fa8eAZHk4VB7fzTT7rFjg4SvDeeqZPt2Ulqawyw6RNPITip:IKp50EU8e947LLrFjzSSthtg61KM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024850, "uuid": "36a210f3-ce3e-454f-86a3-aaaa0c811b12", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024850, "uuid": "f21f868e-52cf-47a3-b7f6-f3c847c637a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024850, "uuid": "55d8851c-77a3-41b6-bb11-bdc07b42b14f", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000ffadf-3faf-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777015627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015627, "uuid": "d569ea26-2b9b-4e25-b638-cd0cc85d73a2", "comment": "Malware payload (AgentTesla)", "value": "dc3b63e876b0760bb447166258e88391", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015627, "uuid": "519e0158-3243-4173-acbf-e6f5e2ba9bcd", "comment": "Malware payload (AgentTesla)", "value": "3f51bc6dce142e122f9aa9db898590f5d22558eaac90d02baf69ef16c4388bfe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015627, "uuid": "bd7e6742-6821-49b1-95c8-99b262527a3f", "comment": "Malware payload (AgentTesla)", "value": "9068542aa862cc1ada95c1b62609b641228b27da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015627, "uuid": "6875a6ae-b98c-4402-97bf-167abbf56d4a", "comment": "Malware payload (AgentTesla)", "value": "de3ebd8dc217f20c7266827cdd3b19e871e2f6ed045c06f4689c7b0839017b698335ed8648da885eb5914f444fa6e551", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015627, "uuid": "a3b72b75-0cf1-40e3-a0c6-a491e58e0a2c", "value": "T12925CF219F132FD8E93E1B7C8142064863F0C4179776E76B6EF854F55EA2F94C92B0A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015627, "uuid": "4beae6e5-0653-40f0-82a3-033675920bcb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015627, "uuid": "229a3f42-4fe4-4e42-a06d-61a57c7b3f67", "value": "24576:e2pDXqzh7SPHMm38ePPq73O/WoGYd6/Dm2:xlqJSPsmMePS7uWvYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777015627, "uuid": "efc4dc3d-b7fd-461f-965d-01b97043e6fa", "value": 966144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777015627, "uuid": "824acfc4-5537-4560-a83a-86312e02d0aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015627, "uuid": "cee4fe05-36b2-4145-b1d5-594317aac203", "value": "factura proforma____pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae1f104-401a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777061682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061682, "uuid": "063c2c02-4371-4c53-befe-fef97828a5bd", "comment": "Malware payload", "value": "7d181f50fb4a48c97d19c9e91fe6bdd0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061682, "uuid": "e78cc7b5-990d-481c-900c-1d1bc3fa978a", "comment": "Malware payload", "value": "3f7f047c7a3405ecc40fbd0d91519958ce7ddc2f24223852d04c35364f12cc42", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061682, "uuid": "6d1da603-8487-47c4-b399-0bf068d5e27e", "comment": "Malware payload", "value": "f4310ae769e0865e450d12e2b358ec679629b885", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061682, "uuid": "6eb02c71-a227-41b2-93a4-760d0bbb063c", "comment": "Malware payload", "value": "db193d6d310cf18ad0d0ed7aecf6d31b34b6ff890628b15e40627b2aeb4ed6396b08847a0f23c78852599eb8c5ce0258", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061682, "uuid": "3566222c-6ae3-4713-a843-b485bf8a68f2", "value": "T1B925BF83D293915CF41AC1715B2EA273F533BC458B29AFE76790DA261633BD02B7A710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061682, "uuid": "55f5e9bc-c296-4163-a34e-1412fbda894c", "value": "5119aa243ba31aa561ba123ac413a1c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061682, "uuid": "1246cdef-92cb-4652-b84e-35188bb9e595", "value": "24576:0+pqt2TpOEe0JRh+w+uY5bkY5bBY5b6e:0ET8EeiRhfYiYDYEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777061682, "uuid": "c1abcc2f-b2ca-4b31-8bd7-ababbeb0f222", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777061682, "uuid": "2a553e14-8064-49ea-811f-edde821a44d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061682, "uuid": "7ef65e2d-ef02-4d86-83be-51a495475ae1", "value": "w.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b65b37-3f86-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1776998026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776998026, "uuid": "1987e70e-310d-45b2-ba9b-43f356817037", "comment": "Malware payload (MassLogger)", "value": "8235352d87d05ca2510cf029e3e6e8a4", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776998026, "uuid": "df22d62f-2039-4368-87b9-1e06cc9c6225", "comment": "Malware payload (MassLogger)", "value": "40e07f72ac2c9cecd2d2c09c1467c6bd56241a92f14326bf687518b95e5800e8", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776998026, "uuid": "b63671cc-bd36-476b-81a6-e03852542f0e", "comment": "Malware payload (MassLogger)", "value": "eddc619a92de2a6bf5c8199fbb7a4ae0e791730e", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776998026, "uuid": "9f2ea7ef-5f43-4340-ae84-3604b7018d59", "comment": "Malware payload (MassLogger)", "value": "df7854fe2d760549d24c260a76038b6dbf56c84310dd65ab1769699467db06b49925a618aa112183ae63ad2830846e68", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776998026, "uuid": "a5db72af-f040-4979-bb6e-296b4c73c43c", "value": "T14F9302041A75F6A034DD82A107E724DEEA3B802DF0DF6F105C6A42730D559E9DAB72AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776998026, "uuid": "83e7afb7-139a-4d24-9a34-bac5fd5dc866", "value": "1536:u9zWjYjuYW0534ho8msLSt25D6AOwhNjB70fVwPglPquCECs6+emri6bbXw5SoM9:8QYxoB5Lx0AZhNj50wolPfCcLHi62Sl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776998026, "uuid": "4a231ed4-4622-4b12-b9e5-c8bf9b339bbc", "value": 89300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776998026, "uuid": "26808b73-b051-4371-ad59-45d2ad8438f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776998026, "uuid": "1c5f77f3-a225-4f17-b3f4-e378e5cdb556", "value": "universal.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d6222a-3fc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777024395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024395, "uuid": "c29b4ce1-d948-4526-bacf-a8d8ebdb91fd", "comment": "Malware payload (Mirai)", "value": "ae62b761eab286b75c058d7f0bef1f70", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024395, "uuid": "f192f5bf-3511-4c4a-a3b9-caa187e1876e", "comment": "Malware payload (Mirai)", "value": "41ae9c9293e3fa20bb467cd3e0551837101ec592f84a12bb3a649dbb79cf7638", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024395, "uuid": "4d80d917-95df-4882-b7be-3a2ef3d9992e", "comment": "Malware payload (Mirai)", "value": "eb7a66d5599560fa8fbecee22347857f6a6f821f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024395, "uuid": "3aabe3fc-c255-4ef4-a7fc-fbd53aaf6b00", "comment": "Malware payload (Mirai)", "value": "eeaac47c4beca9b4bffaff28a1538a4eab51137691db22c550bb81b6d561c0e986e7e747c87efcf1428b34a0aec00926", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024395, "uuid": "c138f4bf-7b8a-4c73-9680-946ed2e8c01a", "value": "T11CC3632A7E11AFBFE178823007F75E70D7592ED626E18284E26CF7085E7128D185F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024395, "uuid": "b46e36c0-162c-4879-9969-6c22f14fe693", "value": "3072:Xe2mYO7knJ2Qy2qzbyW9Y9klr3z1xzFqCmff:O2gRhtHYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024395, "uuid": "73b1d93c-69be-4258-b42c-1168492faf3b", "value": 122096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024395, "uuid": "857d4b6c-a791-4792-b453-3ae05525fd88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024395, "uuid": "4e8b26d5-fb95-4c25-b565-a3b602700484", "value": "MIPS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f965d2a-3fa0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777009426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009426, "uuid": "47993425-8afc-4c2c-a845-08c47902a960", "comment": "Malware payload", "value": "3b08e2d1f9c8d840ab4424685247891c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009426, "uuid": "5674965c-dea6-467b-9965-aa922348f074", "comment": "Malware payload", "value": "41d6198671ef4105cda544e6293e45580ad98668d1433e0f42a2ed91f5fbc0b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009426, "uuid": "ae8b6176-864f-4b9a-b5ad-4dc313b7e699", "comment": "Malware payload", "value": "898dc61c9e577a50cca8831fed533c911972f918", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009426, "uuid": "c948d5b7-e6e5-459f-b699-2c4b4081ed7e", "comment": "Malware payload", "value": "47e77431e72190db05bc175f18ec4cff91aaf02a7408b562bc839e654161247e1770b853e1af2447ccbe90c1ebc5c649", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009426, "uuid": "5adbcd77-236b-45a9-b308-af7a3f8decc1", "value": "T1A3245D03B6A254FDC086C4F0575FA356EE3774684A1B75F77B843A313922EB18E09BA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009426, "uuid": "e50c9da1-4c88-418b-b71e-c75030c04a13", "value": "6144:1OscMZrsmxQ9cu2G4KnVgiMvFg5oX9uqy556:1O50sM9ul55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777009426, "uuid": "1a6788f5-d94f-4736-ac80-9d50288dd696", "value": 215248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777009426, "uuid": "9700c3dd-ff23-461e-a45b-545155d5a5f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009426, "uuid": "305bf6e6-f8c4-45ce-b7f2-ec72e988dade", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328d65f3-3fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777029885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029885, "uuid": "9b793592-7a0e-4064-b14f-600302c9d9f3", "comment": "Malware payload (Mirai)", "value": "66c192c1baa349306c22d8cf5d79aaef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029885, "uuid": "7d7fdc90-c762-4a50-9fcc-67027bbf6585", "comment": "Malware payload (Mirai)", "value": "41e5877f52d7d69353c51b97bd2f79b70d425251d5b917e39e273dc1724793d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029885, "uuid": "3bdeb473-b14b-4c2c-a9eb-4cc2c86ae3da", "comment": "Malware payload (Mirai)", "value": "b8de5ff233d8aa3de8547ee45bae1bb808f9aa02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029885, "uuid": "a88ede66-556f-45a4-9098-b59316b317fb", "comment": "Malware payload (Mirai)", "value": "e8a141a3d1dcb53407840841a64622ed7f21bc617a0e031b123351bce2a0982da7970781feafa501ff67553043a4a1ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029885, "uuid": "770e76f1-cf54-4675-a4ea-f5789943e46f", "value": "T1CA434AC4B183FAF1DC050178307BEB326E33F0B6613AED9BE7E455736855606960AA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029885, "uuid": "d52aa016-9c6b-48ae-a4cd-1a417b65973d", "value": "1536:yOssuiundFq4ZthwLi/pXUfx0WbsoPMdQZl7dDFfG:vzuXndFq4ZthB/VUfOWooPEQj7dhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777029885, "uuid": "829edce8-43cb-4428-a113-e4483d5dd055", "value": 60128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777029885, "uuid": "c5c6659c-9318-4c9e-9efc-6d7928a66180", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029885, "uuid": "e28fa76b-84a3-4446-8508-210cc62469cd", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e0d511-4004-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1777052438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052438, "uuid": "61c59610-684f-4f3c-b041-d693d6969a07", "comment": "Malware payload (RemcosRAT)", "value": "312c861e4003d12fcbc3ae450c5d0d4c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052438, "uuid": "0d9e9b9a-90ac-4953-942f-545e6255e91d", "comment": "Malware payload (RemcosRAT)", "value": "440836d991a02bc8e8d2e40b2d6512a78a6898ba0d4ef8188339e36584666bc9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052438, "uuid": "6fd7af91-31d0-47eb-9a61-af1041877b45", "comment": "Malware payload (RemcosRAT)", "value": "7ab3f1ca6d51916c0c5869d76ac90b490765f81f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052438, "uuid": "10529d5f-d112-4bb1-9c74-6ef9316fab3d", "comment": "Malware payload (RemcosRAT)", "value": "ae171850b29a0f58f6c4ef99d16ac92c38f5e55daf662235e310fb0e64ba85ac0b57e4cdd4db8c7f3b9fb344107897c6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052438, "uuid": "b168d194-73b2-4ef9-89f1-25a5caaad1cd", "value": "T1BF56658CD0A5708B68E2CB49D46E85F26D4E38FF9A1C9E92201F847C1C4CF77A96519F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052438, "uuid": "fcd53574-ecb1-4576-b893-1a3c39af687f", "value": "98304:u9GSkLqz954reIVeo5gmLHwDdCoqrZ86y2OfxscrDsVVXuSdW4Jf:tSYQaS7KguHQsoaO3xscrDWVwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052438, "uuid": "45a07845-7167-49be-83b8-619c2f4b1ed6", "value": 6385471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052438, "uuid": "d28f22cf-d22a-4e8a-ad1d-412bd050bf41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052438, "uuid": "46486eb4-e082-476b-810d-bd71d329cea9", "value": "Purchase_Order_2455.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21fbd600-3fdd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777035441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035441, "uuid": "ea436857-ed1f-4abc-b18e-5604418f4799", "comment": "Malware payload", "value": "28ee22efca59e7bb7a112dac920f4c49", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035441, "uuid": "a2ee3dea-8a98-49f0-acf2-69bde86ee214", "comment": "Malware payload", "value": "444bf92c2f0c7e735829ed6e7d537d01ca7f3dd98f2e2bcab1c16357a3abedec", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035441, "uuid": "42ee5187-957e-4373-adcd-4f6687c30f3e", "comment": "Malware payload", "value": "f7fc82d4cffd57420d7cbc66e5655e3ccdd1a5d5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035441, "uuid": "04a84c20-5837-44b9-aa26-f7782c816f44", "comment": "Malware payload", "value": "34179c50db2d7f7b4dce55ddb6f5b9962509c04afbcec11a88e985657ec0f5000923165e848f73ca048a01650cb71914", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777035441, "uuid": "1216a7ae-be62-49c8-8d42-c9e211529038", "value": "T154137D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777035441, "uuid": "a352637f-f91f-4d6b-8939-212619431503", "value": "768:bKXRWNGxVu9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b2lxxcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777035441, "uuid": "bb02d117-1033-4c64-a40f-395b61d16045", "value": 45515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777035441, "uuid": "b99ba64f-18d3-459f-b095-a95018190164", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777035441, "uuid": "b286321d-5f8b-4baf-a570-8fd81533ec26", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd9ef7f-3fc5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777025317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025317, "uuid": "3b892f38-82b0-43c3-b242-35aed3200c21", "comment": "Malware payload (Mirai)", "value": "04c0e2323594afab8d51b6a5fd2a5c1f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025317, "uuid": "d8b389e4-88bd-4d45-8327-b9ee774a81e2", "comment": "Malware payload (Mirai)", "value": "445fcda29838c653efc264ee6ed53f660db302687ae124c46b1548cb8d578612", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025317, "uuid": "02eac526-3e47-4247-ae1e-515bebf23d63", "comment": "Malware payload (Mirai)", "value": "b1083ddc45e817713fe2264af356ced701ea2144", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025317, "uuid": "049d0b7f-754a-48c2-9cc7-af391d475ccc", "comment": "Malware payload (Mirai)", "value": "97c3b8fe287003fbd89cc7fb06b1ece9954fe2d4e5b2dee3bf0f66b38cb37793605a7f5079ec5040bc66dcd426eede34", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025317, "uuid": "a5617d76-ca15-471e-a4e5-7b85290b3eac", "value": "T1CBE34D9AF802DE7EFC0BE57E44670D15FA30A3613243172D529BFDA3AC321A65D16E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025317, "uuid": "01faadcf-9429-4611-a7da-07980e6dcb48", "value": "3072:luWypdcGShA/EmPA39TsZJ243nxl9XzrTmddp:gCGShAMnThAxl9Tmddp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777025317, "uuid": "bb0e21ff-ac5e-4717-8034-dc5cf295bcaa", "value": 146888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777025317, "uuid": "45ff9374-ce14-4d9a-8c82-9f25f12bc26e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025317, "uuid": "73e971df-f0b1-400c-9f5d-02c27173e63e", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339264f3-4027-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777067253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067253, "uuid": "e18ae3fa-eb42-4746-9a5f-60982e1f5603", "comment": "Malware payload (Mirai)", "value": "f9c66986c8a0fb320078d2962b2e71f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067253, "uuid": "255f027b-5e20-4972-81e2-7bcb8efc7a03", "comment": "Malware payload (Mirai)", "value": "453d50f9c6a9da8391bd1771d0c5aacb3df900bd6dd313d1d49b154cfcd3b099", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067253, "uuid": "888ace11-61d4-481b-b268-10cd7bd46f2d", "comment": "Malware payload (Mirai)", "value": "51dee6a5de313574c430118dc6a786e04cc269f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067253, "uuid": "e9244f0b-fbc7-4397-9e78-966ff0eb6ad8", "comment": "Malware payload (Mirai)", "value": "c4d38882f9348dc4ad4a6ea53e06582d60ae8f09ce1c7b2d00c2bd96abf1d74e4296a283866801d4d43334e1a6b64fd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067253, "uuid": "2e1de0db-a246-4383-b2f3-79ab0bb92834", "value": "T16554891A3E22DF7FF66D867047B78930569876D62AE1D584F16CE60C1F2028E241F7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067253, "uuid": "7d27cc34-8533-4657-a591-4c0b35b42b41", "value": "6144:MILlMEl/9nUy+MtLy58TrMJ/VSwwsfFqjuI:z9nUIJjrqojuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777067253, "uuid": "0f3b9bf7-89ab-4fe2-9d8f-601c3507f947", "value": 304652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777067253, "uuid": "a317cffc-4ae4-4520-8f0b-de0de31df9b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067253, "uuid": "f60d866c-c5ca-4d3d-98b1-63bab70872d0", "value": "bin.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81deaf5f-4035-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1777073398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073398, "uuid": "1687628c-00e5-4683-8ee1-782ba2a2a017", "comment": "Malware payload (Gh0stRAT)", "value": "4ffb3a815e105311336f3edb7543ad5c", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcsoon-com", "colour": "#335CBD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073398, "uuid": "be9985fa-d012-41a8-bd41-3ba51413911f", "comment": "Malware payload (Gh0stRAT)", "value": "45a09b6ba6fac1a3dfc1e360ed225fb179ce86a5285402cfdc4d2db5358296e6", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcsoon-com", "colour": "#335CBD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073398, "uuid": "49e85f65-fa55-430c-8b68-9fe55e2bdd19", "comment": "Malware payload (Gh0stRAT)", "value": "235266495fc9b33de7bb46519c051b534a39744f", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcsoon-com", "colour": "#335CBD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073398, "uuid": "49030d63-35c4-42a4-b1b6-69085c10c663", "comment": "Malware payload (Gh0stRAT)", "value": "66d1fffcd48011191bca4405843775cca67c0415a219496522712b83ccbf3ad2eff3f293a931dd795918d6c2318e6086", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcsoon-com", "colour": "#335CBD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073398, "uuid": "66b1d4b3-1276-41bb-8e09-869e942ba468", "value": "T16517231A67DAD21EE99F11368E23B2B400FF1EF74129E9534EA17C9C8D749581E3B312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073398, "uuid": "3162e000-7738-4d11-9f89-6f2df1bf8c24", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073398, "uuid": "eec1b9d1-a52a-43e3-9c54-127bde7e4033", "value": "393216:yeZKdzNMLpVDkUS2iqZ4LQ9YclY+jXbOq4DD8ADgsQDYBbMGxrc:tINNMp1k6iv09YJgXbOqM8ADgHDqIGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777073398, "uuid": "e18a0e73-1c5e-4e63-9d20-5d3f7086c7df", "value": 19483199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777073398, "uuid": "6e1ebfbe-4683-4b05-9a34-953d2c6b7c96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073398, "uuid": "cbd8e5a7-4bd4-4689-af09-f8bf8c7dcff7", "value": "II2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f812c1fe-4027-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777067583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067583, "uuid": "bc96ac70-0376-4d9b-af6a-fac7de6a08aa", "comment": "Malware payload", "value": "70c33c51c4a510532664c97413c6deb9", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-6636", "colour": "#63DFA5", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067583, "uuid": "bec2784a-c176-4c35-86df-c6d4ef65a999", "comment": "Malware payload", "value": "47048819e5f587b8f4a08a9aa1219528d0176e38baf8448812f8a0b41a847c07", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-6636", "colour": "#63DFA5", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067583, "uuid": "2f4b2052-31af-44a7-b969-7dbc82b900ed", "comment": "Malware payload", "value": "bbf110600bab9e3f2cac94c9a1244682891bfdfb", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-6636", "colour": "#63DFA5", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067583, "uuid": "a310d016-73bb-4d00-8d98-db93b776a86c", "comment": "Malware payload", "value": "2eb86444557fb87096e07d1aba48cc7988f94d27dae21ad4442f7e27b3339b20f4db6146c764861fcd52a624039bc962", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-6636", "colour": "#63DFA5", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067583, "uuid": "da9cadb1-0f84-4778-92d1-a02d29110fbb", "value": "T1EE06335FC2111A0648D425458EF4370B5AF9A3FAAA777DB4BC7496FB68CB30270424BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067583, "uuid": "d7d02df1-dd40-43d8-8071-46d995176a12", "value": "98304:60LV4KF/GOGGoSkvVzSBFy5OrI4AxhfmtOKJsehntvEeH:6KFudvVipI4AxysInt9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777067583, "uuid": "a00fcdc4-d57e-471e-98ff-31b436071052", "value": 3926035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777067583, "uuid": "b151a815-f045-4bbf-b5ed-89df5db808a1", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067583, "uuid": "0c8917f8-fd47-431d-915a-8d9a43f38ddc", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be5603f9-4013-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777058896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058896, "uuid": "876ad650-3409-40a3-9a98-1b5ffa69f251", "comment": "Malware payload", "value": "0f66903a556b2a17db2c88078de9df18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058896, "uuid": "690cc490-35d8-47a2-9d84-475f9efefc40", "comment": "Malware payload", "value": "471c2173501d6174a0fbaf56580c95e1e2df7ab19995e10ee5bfac1411ee75d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058896, "uuid": "ef92ebe8-a18b-4b54-bc47-a4dcc340b5e1", "comment": "Malware payload", "value": "77209b67afd601c7c389881aded9a5d7df4a178d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058896, "uuid": "33780552-583d-4456-80a8-809cd80f5b21", "comment": "Malware payload", "value": "dab2d7b67bbe6feb87f8e5e1a13aef8c84bedff44db4108c67e62039b65f926268e8e95050255050ec6fc2f6617e7705", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777058896, "uuid": "b7c8bc1e-3b87-4d9c-bcc6-56ad0d5dab5a", "value": "T1DBE7338F291A8E92C80700F29F4BC7216D6F1CEB49D70952627D370B5AB97D85C2DB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777058896, "uuid": "4e8c62be-8222-4707-beb7-475969cf2e0c", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777058896, "uuid": "8e96e55d-c9f8-4077-90ae-2e295d310e0a", "value": "1572864:U4JmjmJe6v5RqvXg8RajRRS5Moo3x/lA2VIPmrR:U4c6J9hI7CXomA2VIWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777058896, "uuid": "7fcefde3-8ae1-49ad-8b2d-312d1ad8146d", "value": 68895384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777058896, "uuid": "d107c11c-093d-4a00-a84a-b7ba9816ad27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777058896, "uuid": "6b356390-8545-4538-ba55-b43f4406eb4c", "value": "setup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f121d5-3fc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777024890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024890, "uuid": "044696bb-dab7-42a9-888e-13c109845ec3", "comment": "Malware payload (Mirai)", "value": "ef44da0f8b8324d50c90729909036c50", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024890, "uuid": "682f24a5-9617-42ff-b5e3-80a6b9f5218d", "comment": "Malware payload (Mirai)", "value": "4800c6592215dd9fe08897807608e5f43e1974df939a736ac84aa49f5cc9c55c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024890, "uuid": "30db2e95-f87e-471c-b0c9-490487f12810", "comment": "Malware payload (Mirai)", "value": "6f967ef038cd11a9c24b04a8542dabbf1ea74f63", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024890, "uuid": "635ca6b8-2e96-42db-853d-85147ed964ff", "comment": "Malware payload (Mirai)", "value": "5ce226ce3a2b288731573324f7faf260848d49ce345efaaed81c4de0b29aaa534a1a35dbe5256eea5c5ac1c6bc647c2b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024890, "uuid": "ee9695a2-29ec-4fdf-ad6a-fde08fa0253e", "value": "T1BCB35BB3DC26AF98C655D074B0B08FB92F53A59482471FBE19B6C2B44443D8DFA05BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024890, "uuid": "ec4c1f6b-0ab2-4777-b785-694ef062fbf1", "value": "1536:OTW/VCxsHZus32Li62C8r2KjR5fPPVWABouWcD0W+T507w:OytCxs3x62N1jzVWBuWs0b+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024890, "uuid": "c543d8d6-be52-4808-a105-4f1ebb1da989", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024890, "uuid": "5316520e-90b8-4fcb-a9ea-f8b188f6721c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024890, "uuid": "a5addec4-1b4f-4b8b-8fa0-910eed71d27d", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed16efb-401a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777061689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061689, "uuid": "6834286f-ae80-4b66-bb58-1b29eaf1c87e", "comment": "Malware payload", "value": "153fb27ce2553ba7eceb4f585a76a103", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061689, "uuid": "3a1ba694-8e15-4b2d-aa72-8bee3c91dec2", "comment": "Malware payload", "value": "48a997b76fe8317c6c8e6ffa8af0b2e509e8987cd10c196e3a7cb4d8e05e9dc8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061689, "uuid": "ca375e9b-7709-421b-bc98-7062c60466dc", "comment": "Malware payload", "value": "b2e52774a5d1ff2093c38feb1a3208216db527bb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061689, "uuid": "b6bee589-946f-4d58-87a7-189eb1000de2", "comment": "Malware payload", "value": "0a1cd6178a2c8e125653e02dcaa6f2d0d7356a044cbc47bb65c4c795564ec91e9b73d72456ce8ebf976fc5a6297e6307", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061689, "uuid": "330bee6e-ac82-4f8e-9081-0024e6a96068", "value": "T1A7558E6E87A312C1DA7AA70472AE2A1D433E4C9F14F236497F0D1FD91F14A7A17B819C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061689, "uuid": "8486169d-52e3-48cb-9269-7296213da397", "value": "24576:Fr+7yxKk0/u/MjMRR+Athg+TOe3bWumU7yxKk0/u/MjMRR+Athg+TOe3bWumZ:Fr4C0oJC0oQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777061689, "uuid": "b8cdbe6a-a74d-4f9b-9c37-4523f94b0ee3", "value": 1386480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777061689, "uuid": "8d14782a-c1a0-4fd2-8397-3ab4e11fed0c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061689, "uuid": "24c283f7-f940-488c-b284-0b18ec18138b", "value": "153_bjv_darwin.dec.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d686330b-3f85-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1776997948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997948, "uuid": "e6163c17-f681-462d-a417-c300de742926", "comment": "Malware payload (VIPKeylogger)", "value": "1ce3ae3aa40216aafe8066f602b50aaf", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997948, "uuid": "dd554c39-5af0-4d05-b249-fb8c5b363b2a", "comment": "Malware payload (VIPKeylogger)", "value": "499422f120167b0924edbbd1d66f51101b36d53f83f7f56e65c020c7f2950f37", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997948, "uuid": "c8b1a30e-efef-406b-86a7-8a806dc5fbbd", "comment": "Malware payload (VIPKeylogger)", "value": "13335c7cb4c2ae7efb47d4601261529da8e28687", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997948, "uuid": "4c26db40-52ee-4d6b-a5bb-bac7ad00934a", "comment": "Malware payload (VIPKeylogger)", "value": "ebc3b4bf9cb57346fab7115bd6cc77120b0b9539f0aa4890d9f27ec42fcdf8d59b9e2227e3f4a776d1ecd31e79f53c1e", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997948, "uuid": "fa34ebba-43eb-455c-adba-60b92615d3e1", "value": "T169C302E02438FB4C5B5CDD5262EB57BB7B690864B1FE9C9DB032C6544CAEF0205E2939", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997948, "uuid": "a506f8ef-265c-4786-9c14-371b91d7fa67", "value": "3072:TqJO0zfeYAs/JmCdaJtr/X0bcS9WvEyq/FGvfAqz1cqyH:raLdCJX0t9WvEj9kFz1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776997948, "uuid": "4a7a0a9d-8c4b-4507-bc7d-e18eef3c46fe", "value": 122082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776997948, "uuid": "c262f05d-6c4f-4ece-bf34-b7ede83461e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997948, "uuid": "7c7fefa9-b3f3-4023-8432-39cf716784d0", "value": "night.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f431cb-3fc5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777025350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025350, "uuid": "b87a7fce-eebd-4c43-92ec-e971177a4a56", "comment": "Malware payload (Mirai)", "value": "01fb2ec83b60cd32d657c1446c776eaf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025350, "uuid": "73831a09-222c-4a77-b3a3-2184e22e9d9c", "comment": "Malware payload (Mirai)", "value": "4a207f94d7e4aa9dde9f11a020fb65cc2d67562921d6c2b8caeb1f172d36da6f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025350, "uuid": "7b6bf589-4396-41e0-8517-92e7af61377b", "comment": "Malware payload (Mirai)", "value": "550a6517d0de1e1bc0056eca2a32f434c7f7a108", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025350, "uuid": "8b6f3b3e-ca45-4990-8e22-cdc2d1309242", "comment": "Malware payload (Mirai)", "value": "635c868591ca07563a82e4e3fb27167f3d65bead5c5fddbbe5167d2c904518a888587aeba2b7fae43e1639deafd3e1b0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025350, "uuid": "0aebe2c9-0404-48c6-b2eb-c3ae8d017b9e", "value": "T12FD35C0673180E17D5A349B02A3F1BE083FED5D021F4BA89691F9B6A8676D3B1485FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025350, "uuid": "72244c76-af58-4e73-bc3e-a1baefc5eef7", "value": "3072:CV0zui1ZhMHJ6A+qrxfbOUm3+Q2Mc9Fkbn:LP1YO8dbOUmuQ2Mc3kbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777025350, "uuid": "d69f047c-aef9-4488-81b1-bd2af675e580", "value": 134336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777025350, "uuid": "e6ecfa63-8f96-4e68-a4c0-454bb5014998", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025350, "uuid": "2884d37c-cb67-43f7-b7fd-4e8ca89be791", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63bfee4a-4036-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777073777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073777, "uuid": "85f6a323-64ab-401d-bddc-cfa24090e4a8", "comment": "Malware payload (Mirai)", "value": "23e08db96cb16ce88675de71753590f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073777, "uuid": "e08f10bd-6759-4ad1-9e55-d933bf376928", "comment": "Malware payload (Mirai)", "value": "4a924ca1623816a78982753ed3f12af24cde0febfb1284f0af0baeac9dc7a6d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073777, "uuid": "435cffa3-f493-47b9-9b98-c695a3e552e4", "comment": "Malware payload (Mirai)", "value": "e21f8eae7596b5d45a1ef57de9ce3586371395b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073777, "uuid": "5f504cda-d74b-4510-a2c9-3760eb7d9f3d", "comment": "Malware payload (Mirai)", "value": "d6327aff100bcffc4daddf85f17676ef08d076c8a234dd70e0570fa302c58e377f618b896f7e01542eafe89418cd3590", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073777, "uuid": "8788f94d-43d8-47f4-9e7a-067222604224", "value": "T124D34B06730C0947D2632EF43A3F27E193EF9A8121E4F644355FAB8A9671E361586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073777, "uuid": "af3ed60d-7218-49e0-89ec-c55122a6cc61", "value": "1536:KWCPE5Uoe37Fa0I2YAcxfjIhEPFXlNn3VA7oKr4ZLvArjIEG+d3NkqQi5u+:K1p3lYAcxKEFu73r4arS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777073777, "uuid": "e75284f2-6b6c-4341-939c-9e6a30a6fea9", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777073777, "uuid": "4ec0eb6d-a80f-42ec-b917-40772f48eebe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073777, "uuid": "7c8609fe-a2ac-42b3-a52b-b75414135fc5", "value": "jew.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3506da12-401a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777061672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061672, "uuid": "0aa46e61-623a-4308-8289-42a4d74400a3", "comment": "Malware payload", "value": "e02e3a7eafdda5f4d3eb696795d1ee8b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061672, "uuid": "5730fb45-52e3-423f-9991-ffeb5af59d5e", "comment": "Malware payload", "value": "4b877a097b76ae8474a07ca3b35f959a7dbbc112ad73242b2537bfa28b0de7f5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061672, "uuid": "633c0bf7-17dc-4064-bee4-87ad33b701ca", "comment": "Malware payload", "value": "2fc3c3b86f6c0e3568fe846809cff55a71f108c1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061672, "uuid": "97097416-228a-4c12-80ff-a977b3ba5df4", "comment": "Malware payload", "value": "0918dc1d93c1cd12e00461ea7c3a6498ef8b57963365c3ad8e0ffab00f069f58d91e83d5272fe77152a2606f41ce1e73", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061672, "uuid": "52694671-2ee8-427f-9d07-9f7a74ec83f4", "value": "T170756D43E2A620ECC05FC170975B6722F93174055B38BDFB92D0D7352AA3E906B7AB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061672, "uuid": "104a640c-65f5-49f2-951b-68589f91f453", "value": "b712b3f1f6f5dde070c523d4407e5a3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061672, "uuid": "8d02d5ae-4ed9-456e-b714-203e5f85694b", "value": "24576:Qds9Esxlce6k91UOld2LMxmeDozCMZyFFp/EymOCUwPPSOP:QdaEglcAHNaYczYYyL2PPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777061672, "uuid": "0d2b089b-24ff-48bb-87d0-a4b3bf21e6ec", "value": 1566208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777061672, "uuid": "a9cdd327-e4ec-43b4-84ee-be523ccfda6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061672, "uuid": "58e0f014-6442-4403-870d-448e60e79fc3", "value": "f_ex86.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746c0fea-3fc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777024412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024412, "uuid": "c723b231-54bc-45a7-a62e-2497c4ff498b", "comment": "Malware payload (Mirai)", "value": "2e71134ce7911cf391abbc20f1a65199", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024412, "uuid": "ba671854-5b48-480a-b107-e4f3952ec968", "comment": "Malware payload (Mirai)", "value": "4c5979118963c5f00fee20087e7ea65f7a07234f6befd17a39b943aa5d294f61", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024412, "uuid": "b27c977c-3e70-4e32-99f7-d9ea4b0f951a", "comment": "Malware payload (Mirai)", "value": "d4aaef621dfeb861c8816701b8d28569a115b400", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024412, "uuid": "e367c92a-0aa5-4191-9368-f9dd6b2856ad", "comment": "Malware payload (Mirai)", "value": "073cd89081eb9d7b7d4b40e3105ebbae77ba2e3f7c18d26ce9cee5af2438cd0deab37a046bf8cdd54eabefcb331dae4d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024412, "uuid": "356c668c-ee90-4c46-a570-ae2747855289", "value": "T10893D62B7B130E23C0DA10B552F30231F5B9EF5938B84697B8A07D9D5F3AA8431567E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024412, "uuid": "394aa400-1ec3-42b6-827f-5631571558c5", "value": "768:rOIW6Z1CdCsBCJvoY6Tr5NbO5I7BTAiGeshU2lnWEa7tvARkO+N95VSEX1tVml2K:BW6S4Obs7x1WEctYUN95ktr3is7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024412, "uuid": "fe52cd66-18d2-48b6-a3a0-c2b050d2537d", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024412, "uuid": "64810e30-849c-4c9b-b0c6-dd46d82149b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024412, "uuid": "31093e4b-0612-49ca-a6d1-48d5747130e8", "value": "SPARC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54eab5ea-3fae-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1777015340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015340, "uuid": "4cfefb76-3897-4931-873a-d39b7009e4a4", "comment": "Malware payload (RemcosRAT)", "value": "65a8c3fb89c2a5ecdeacbbccabd37193", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015340, "uuid": "ad696d28-96cc-469e-b3ca-55d40a92e1a4", "comment": "Malware payload (RemcosRAT)", "value": "4c986689a876db9c727d0b2e29bcfd8d175b2126d4a5caca731475111e0253de", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015340, "uuid": "5c06d95a-285b-4b4c-883b-27ee8e30997c", "comment": "Malware payload (RemcosRAT)", "value": "26d83dac080a0f8118a4f07601003b6b04cb4406", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015340, "uuid": "1096a949-fa93-4a07-a3cd-b448b9ecb0b6", "comment": "Malware payload (RemcosRAT)", "value": "8ee52947e5dd85793cfdf731e35f2a18abb6d10bf0c4ed2378646670e6be46535f14b922410a9b8e44377902b208ffb5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015340, "uuid": "2a5454a5-17b9-4ad4-8e6a-e7202e8eb1b6", "value": "T1F39591B0D09888C85E63D4A54CF58E6DBA91E523139F5F5EAD2D0E93049BCAD31F2738", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015340, "uuid": "845141be-3778-4f44-92b0-63bdd4cb5c9e", "value": "96:R3Z3e3Z3e3Z3e3Z3e3Z3e3Z3e3Z3e3Z3e3Z3e3Z3e3Z3e3Z3e3Z3e3Z3e3Z3e3Zq:utJYsiUUB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777015340, "uuid": "3a5ef5ae-2cfb-4530-89b4-8a50c904e5c8", "value": 1973840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777015340, "uuid": "559ddc9f-9165-477b-8646-cb310b429266", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015340, "uuid": "283d79f4-5a15-411e-a1f6-e757b9196042", "value": "DHL Draft Documents for ref 6017257934.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c9d051-3fc5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777025301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025301, "uuid": "67d1fc83-de81-4e01-8dae-a1900aea9089", "comment": "Malware payload (Mirai)", "value": "17eb9a7e788042f71e1634e7de95a7c5", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025301, "uuid": "5a560cfe-6d3f-4424-9e8a-ef404593c03e", "comment": "Malware payload (Mirai)", "value": "4cf6605327711bb67d8784ede8398ce64802089898a562e639d48e28369310bc", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025301, "uuid": "5ff6bc10-3985-4757-9380-1d4176d741c0", "comment": "Malware payload (Mirai)", "value": "8ca895efe04edfd3d368b76261a5938c2e5f986b", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025301, "uuid": "1fc82d74-54d1-452d-98fd-461e84f23590", "comment": "Malware payload (Mirai)", "value": "63dfffda9155a4f6d02eb7285178753c15900e790bd685b7cfabe29116021e851de133292375bef469f672437587e739", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025301, "uuid": "41dfcdf4-f2a7-4356-b437-cce512390c01", "value": "T167343B45EA418A13C4D117BAF5AF418A3332A795D3DF730699286FB43B877AF0D63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025301, "uuid": "f37afb97-a88c-494c-8823-49229113a2d6", "value": "6144:sQYf71sTafH/a7KKck/l9InplzF6f9ihM/9eAU:sjxEiH/a7KKcktOpDPG/wJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777025301, "uuid": "edf4a16a-d5f1-45d5-8adc-27a07790192d", "value": 230968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777025301, "uuid": "7a5d7383-14f7-49b0-9aca-fba9195435c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025301, "uuid": "6b8e1639-6419-49a9-b7b9-6233397e6eaa", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132a6f93-3fe0-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1777036705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777036705, "uuid": "8d410070-1b55-4ee9-a52f-d2ec1dc0d75b", "comment": "Malware payload (LummaStealer)", "value": "29b42ea66238343322eacb9fd0c8b1b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777036705, "uuid": "2bb1299b-d880-4710-833b-89237965e07b", "comment": "Malware payload (LummaStealer)", "value": "4d5fd4d96346fb4b09dccb7836ca2dedd339622a6e6063b4dbec1af83cca94f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777036705, "uuid": "15e2b362-cc22-4d78-9587-8589185a01fe", "comment": "Malware payload (LummaStealer)", "value": "2ef48e359e02ff7bfdf099efeb38cb7a8deac775", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777036705, "uuid": "c0164236-a0af-4fc8-8db4-73d71b3c7887", "comment": "Malware payload (LummaStealer)", "value": "00cedfa5c7150a214261c813e65efedd4a41fd8b0ee1f1e1cbdccef1d5e8d45ee9156663630f2a07d8661dc03b437f6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777036705, "uuid": "09a75d12-8205-4387-80cf-4343cfab6ccc", "value": "T16A647C09DB7750E0D94A807530E9F33B5A342B2683288DDBDBD0DF58A963BE29477907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777036705, "uuid": "2efc0373-beba-4181-8c88-5ee24fae5bd0", "value": "8a08f05f951e29daf72a243fb2aa4e67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777036705, "uuid": "51daf0fb-6796-4a8a-9d10-f303ee6dce64", "value": "6144:gBpTG4BXpGV/5i0KwFEIw8LaggfR4IKqI1jgn+ICP8QSoM:YTPGrC3DDIVgCPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777036705, "uuid": "04926305-8790-4243-a75b-fa7ea6b3055b", "value": 317440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777036705, "uuid": "621dd308-029b-4339-9fb3-0eb6d6a7768e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777036705, "uuid": "f57c9815-5b76-422b-9744-84083f956c29", "value": "4d5fd4d96346fb4b09dccb7836ca2dedd339622a6e6063b4dbec1af83cca94f5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed3109e-3fd8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777033503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777033503, "uuid": "6e4816e7-3f21-4319-9323-c7995281a630", "comment": "Malware payload", "value": "2d351f33fb9816d2cecf6d041ea1576b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777033503, "uuid": "45c89d3c-dad5-4a42-90be-69d16a4fd732", "comment": "Malware payload", "value": "4d74543a4a1b60b26bfb299899fc2ef78d5310431dd93f4391e21044679f28ef", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777033503, "uuid": "b23f0c9e-e694-4017-a57b-1ca7a043a70a", "comment": "Malware payload", "value": "26b40e197b8d8fee0ab1b8d95c3fa4dbadf1e81a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777033503, "uuid": "5b39d18a-108b-4a61-a913-cc2c49769ffe", "comment": "Malware payload", "value": "3caf54ebe2e30d0a20dbba5ef731cf2e199958a4eb866aeef92b5eab7d0c821932a2afa8ce80f6b3342d31b4afd37f9f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777033503, "uuid": "da195e8c-6b2f-4170-ad1e-513aef88a359", "value": "T103D023011251CB1D050408071D95628CF0DA045E1F4CBF6146148C9C03C7C8CF5972C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777033503, "uuid": "f714e477-24ac-44a3-8299-3511239eeafa", "value": "6:hC47bxrBeLuVFOOr+DE1Bn23fXmSKOZG1Bn23fFzK:d5r+uVEOCDEf2OJ2JK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777033503, "uuid": "982daf64-c17f-4ac2-bb96-5b0c2a3ce986", "value": 207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777033503, "uuid": "5801b476-36db-412f-bda5-3f66f330dee0", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777033503, "uuid": "629837f9-8c70-41b8-ac62-fc964274f1c0", "value": "FdkG3vwVvlkI.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d76074b-3f9c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777007543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777007543, "uuid": "ab564e5e-3546-4afa-8cb8-5413eb7450a0", "comment": "Malware payload (Mirai)", "value": "486e957c9e046dc61aa4cb7ed788ef50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777007543, "uuid": "020b829a-886c-4ad2-8de7-3acae42d890c", "comment": "Malware payload (Mirai)", "value": "4ed93c0e3cf147ea02c76ae52dcbe37d89dfb49f6483381ba1f2f733345ac9d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777007543, "uuid": "67d2b268-ef87-4d71-9224-84a334ac4bba", "comment": "Malware payload (Mirai)", "value": "ae98c1cf309d57f3003756c4a51e7a2c5ab8560c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777007543, "uuid": "d7813d4c-028c-4bd1-9e13-396b739fe4c8", "comment": "Malware payload (Mirai)", "value": "d0faf806161dae5b42c447228db7bb3eec310916327463fd9b2f7c08b3b3274b6333c7b9ac27276f108d9c2b7db6c464", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777007543, "uuid": "c483c4b0-edf9-471c-b713-bfc99f3551ca", "value": "T1B58312D8A482ED89D38DAEFB067E5FADD0723046D502B5903A2DDC95C3E85419D34A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777007543, "uuid": "324f293b-00c9-46f0-9ef7-b9ba4d6f6050", "value": "1536:QbfK1A2zcAR7jS2UzOF4om0XZ/wLIOPVgrQu+emq4hJEzSoDnD:Qgz3R/fl4om6ZzOPVyaq4h+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777007543, "uuid": "c3f43470-d334-4107-a293-f3dd036cf97d", "value": 84520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777007543, "uuid": "11ead701-2a4b-4930-96e9-b17cbdc2445d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777007543, "uuid": "ae2aaee8-fe77-45fd-8846-e7eb69769fd1", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ab8b91-4004-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777052162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052162, "uuid": "d3734350-b59c-4a3b-b1c7-47f476b03fca", "comment": "Malware payload (Mirai)", "value": "2277d4395de7a5ff243685c9da1dedf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052162, "uuid": "89814d08-28cd-4be7-bf29-e63dc31f2160", "comment": "Malware payload (Mirai)", "value": "4f01ff790267f4973893e0029f93f8c42e6e31655f77f72cad80fceee31445ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052162, "uuid": "52f35328-0402-45f5-821d-8a8d34c87d9b", "comment": "Malware payload (Mirai)", "value": "f08771797999f895485ad26c85779c8b8e7ab770", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052162, "uuid": "5242fed5-9fe5-460e-b63b-bea885006f96", "comment": "Malware payload (Mirai)", "value": "f514c010b69602f9bb445c00aa65c3d850ea886581755485d3554b505937465b1e95ef6c1abe110269403c8d0745fdd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052162, "uuid": "d5c72c2c-65a3-45a0-800a-7752d542b86f", "value": "T1FA332889F747DAF0CC4305B0115FFB3BA936B8A12224DD77DBE0BAA37CB16425416A48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052162, "uuid": "eccc34fc-d1c3-43b8-8182-cf18e8d6b0b9", "value": "768:AYZ8SfvufWuq96fu8zOoevR0sRlzhJdt9QgcpOR9s0Jel/iE+nKPaO+hTvlwas:oSfvufWuq96f58X3jJelSK3+hjlwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052162, "uuid": "17a3ee29-34dc-4aee-a9cc-ababe31333f8", "value": 54204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052162, "uuid": "6c01b696-d680-4adb-b579-5b444892517c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052162, "uuid": "700b5c02-ab9d-4c22-af4a-48e26b6242df", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ea6d5e-4033-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777072363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072363, "uuid": "32cafaf5-b5d1-476a-87a4-06eb9489f67e", "comment": "Malware payload (Mirai)", "value": "fc0298f048bb4b99ee90d7b65fc82062", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072363, "uuid": "2fc43ad1-b17a-488a-9249-9368a2089ad2", "comment": "Malware payload (Mirai)", "value": "4f0daff2efc47bfcdca453d203cf6d3e5ad696340bfdb397e5655b65f121bd8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072363, "uuid": "8ac2a6ba-2422-459d-897a-d82eb1ef73ff", "comment": "Malware payload (Mirai)", "value": "97c62ddfb7c0659376e997b74bf2c73f546f379e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072363, "uuid": "42412085-a0db-47ce-b880-496c9d5c8f52", "comment": "Malware payload (Mirai)", "value": "5cf78a14cfb71d4b120d80f477ee9c36b4d38787aa496e455fa8cb717167c69c592f9dac6e34384227a834561fe0f8c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072363, "uuid": "52fbfed0-5877-48ad-9027-301b587d9475", "value": "T1D4A3A41E7E258F7CF799823447B78E22964833C626E1D541E29CEA015EB034E781FF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072363, "uuid": "caf65c27-148f-46fb-9708-223daab3f773", "value": "1536:U9aImucT6Wv4ZgarBYBo8ynm0lyRJui0j9K4lzHWyZ2fG9KS8N:zuWbv+zY7yTlyruDK4lzHWyZ2+98N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777072363, "uuid": "9a511866-5ecf-4004-bb89-7738ccfe1c87", "value": 97824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777072363, "uuid": "3f51696f-7fd1-4311-b4b3-810378a6a031", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072363, "uuid": "55b54783-0b34-458c-892c-d508d8db6319", "value": "jade.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881d7736-3f9e-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1777008554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008554, "uuid": "2f512887-de7a-49ef-804c-8377d6e6482a", "comment": "Malware payload (QuasarRAT)", "value": "bae875833816d4d58a657163e140dab7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008554, "uuid": "6029722f-69b5-4db0-9647-03323376a37e", "comment": "Malware payload (QuasarRAT)", "value": "4f64aa9ec86fdc36919d7dcb5f1bb095b7e3211d90532b5384d5c1b220186166", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008554, "uuid": "4c308130-8592-4154-9852-3491eb3bea4c", "comment": "Malware payload (QuasarRAT)", "value": "c8983b1dee3b33aa64df29cb6269bf05f9fb0ff8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008554, "uuid": "0d630b71-dfa5-4f45-bdb3-9a1eeda31bb1", "comment": "Malware payload (QuasarRAT)", "value": "657628e2d7c283fc9921731f16ef34e99f5efdaebbe93e4c65741d278b02c1d89b80012ef1a5c8982e9d415996d5c8ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008554, "uuid": "8ffbe2d5-9801-4a5e-94e7-e9b9aef48123", "value": "T181E56B0437F85E33E56BD2B3D5B05026A3F1F82AF363EB1B518167BA1C53B5488426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008554, "uuid": "639e9a9c-a5ea-4490-9600-7ac2ada59441", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008554, "uuid": "89b60273-34a8-4157-94e0-41e8d62f79db", "value": "49152:MvVqm2srax5MlP1lTsypIXXsYtjE9/aBxw5oGdQTHHB72eh2NT:MvUm2srax5MlP1lTsymXXsYtO//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777008554, "uuid": "f69165de-4c41-4a6e-b96e-adc10076417c", "value": 3273216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777008554, "uuid": "61b59d84-236f-4155-9da6-8a96398d1cbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008554, "uuid": "f514e53c-bd65-458e-a1c8-8a7518b723e1", "value": "kalyanoffice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93a8cf1-3f9d-11f1-a769-42010a9c0008", "comment": "Malware payload (XorDDoS)", "timestamp": 1777008180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008180, "uuid": "7e7e8e2e-85ab-4d08-9157-7337913d1150", "comment": "Malware payload (XorDDoS)", "value": "30a96252a7d31bf6b6c3b4b9b31d8dbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008180, "uuid": "23418401-ed3b-41c5-8291-487785638eff", "comment": "Malware payload (XorDDoS)", "value": "500150916281fdc7c246b3ad360a57324bd23b58004e94b082b4aa4acbc1dde8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008180, "uuid": "94ca58e7-809c-4856-8e4f-bd5bceb249a2", "comment": "Malware payload (XorDDoS)", "value": "e7b609f11f51aac7432ff4580232b41c3b69a22c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008180, "uuid": "927e0cac-0893-4a81-9120-2cfa3d3ba044", "comment": "Malware payload (XorDDoS)", "value": "9afe6019027d15514da2ec7d80a7e659373fd6732fb778c2ca9e130be5eadc3bc2650be9aba779c40d0aa3c99ee2cf26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008180, "uuid": "8252e3de-dd71-4fa1-9d05-1ba0d292ae27", "value": "T156B32801F742EBB8E68308F5087ADB64FF354D1B023088EBF7D166B4B8A1A9154E755E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008180, "uuid": "8db190e1-3eef-42c2-85e6-51cd3e443cc8", "value": "1536:wVrNxG8giUnvzkgJaWdOFkRCfni290e7vmrAcWA+WdObWrzxe/T7vqfFzLRrl+3p:wp68giUws+knSlGldL8/T7vqfvAzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777008180, "uuid": "eec9ad15-053e-499f-b777-77f9c39ec5e0", "value": 114768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777008180, "uuid": "4b48c4d3-d618-4826-a29e-6fd2a8e6c89a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008180, "uuid": "3adab84f-82a7-4a94-9dba-ee21770ee49c", "value": "new.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc33d6cf-3ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777043914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777043914, "uuid": "e06e2337-db4f-4040-9700-9c21c56ea660", "comment": "Malware payload", "value": "8905e137324e9bd697ed812a8febf712", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777043914, "uuid": "fdd2170f-53f1-486a-9133-21ba4403ecc7", "comment": "Malware payload", "value": "504fbe8ad953e5ba270fe0e25fbb494c3360dde794451ae241b52aa9a62f80bb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777043914, "uuid": "4988b587-af3a-4043-a8f0-1f5c9dc07d42", "comment": "Malware payload", "value": "ca02384463b882b629e8ff115991e88bd3fb4311", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777043914, "uuid": "95066e06-64be-41b4-8544-df25bf3b4056", "comment": "Malware payload", "value": "3de38174ede52a04b4c9cc2aef5f5e9379c22319ca91a348eb30ea9ef690ce9ee8c7ecc90aea671cad33a16fd19c78f6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777043914, "uuid": "d7d1b0a9-f677-4de4-bde5-da25010a5826", "value": "T1F9E4C05039B28571F4A902F00498ABAAAD78FDB14F1458CFE7C81E265D732D1BB747E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777043914, "uuid": "7b1c4a00-7a6e-45b4-bf9e-45311e588060", "value": "12288:uyVHL8SGOp7Ao6GI2pP5IQkzx/W+EbKD5n1l/s7rR04bqDY001b7undDGW:uyVH4HOpqaInE+DPl/s3R04bCI1fuiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777043914, "uuid": "439b0935-2221-47e0-b0df-66f38ba19692", "value": 669339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777043914, "uuid": "ab9e1a41-a773-4a3c-b4cb-acacb1e5030b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777043914, "uuid": "e819c160-40f1-49be-8f3d-a639c8f5d141", "value": "Gi\u1ea5y m\u1eddi.docx.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371c7cd6-401a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777061676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061676, "uuid": "74231658-f2bc-4f6f-a427-05645163d3da", "comment": "Malware payload", "value": "e2290ab56ed1f480ce39410457476425", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061676, "uuid": "6eb591a7-3f80-41d8-b83e-26bb41b4e837", "comment": "Malware payload", "value": "51e66f65e44bf216ec75c179a081060bec82a3f7944dcd0461ba3ab15d919435", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061676, "uuid": "5a269ce5-5a6d-49e6-bad6-1a894fa5f1d0", "comment": "Malware payload", "value": "099e1566ec2eb5a4fc0d0f2aa639850dd1004f75", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061676, "uuid": "65f65c9b-a875-4bd0-ac3f-214c05016199", "comment": "Malware payload", "value": "5b187edcf0c72a66e9a55c0e35c03ad71a1efe0d703160261c938dd188c5557dfb39cc386aa4f8b095beceba9de97be6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061676, "uuid": "c8353b48-36c2-4b6c-b08a-aaead736fa47", "value": "T1DA756D43E2A620ECC05FC170975B6722F93174055B38BDFB92D0D7352AA3E906B7AB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061676, "uuid": "9b81cd2c-d509-4499-b2ea-299a1bdea461", "value": "b712b3f1f6f5dde070c523d4407e5a3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061676, "uuid": "dddcd85f-2391-418b-aff0-bbd3df587be1", "value": "24576:Hds9Esxlce6k91UOld2LMxmeDozCMZyFFL/EymOCUwPPAJP:HdaEglcAHNaYczYqyL2PPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777061676, "uuid": "fc383532-0273-43e8-83ec-71bdbcf97291", "value": 1566208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777061676, "uuid": "654b83d7-551a-48bf-af2b-3bfaad58678a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061676, "uuid": "c57e9ccb-12d8-4789-a6be-67891efa94d2", "value": "f_ex86.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785170a3-4001-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777051048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777051048, "uuid": "0a5c7db1-e371-43bc-8915-07f71b59b58d", "comment": "Malware payload (AgentTesla)", "value": "feb4f1248ab6890c054008d8a26b190d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777051048, "uuid": "aa2b13c3-8326-459c-8943-c60754581c71", "comment": "Malware payload (AgentTesla)", "value": "53aca9b84d703c9ff6443e596e8f259d2b77c055675a37801705bcd4bf822436", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777051048, "uuid": "3588910d-3286-4ffb-bd1a-57397a6db370", "comment": "Malware payload (AgentTesla)", "value": "c0fe5b7cb5a6384e162968abf0a7c87b966d62ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777051048, "uuid": "aaee9316-0ae4-4229-accf-16a9efb0dfe2", "comment": "Malware payload (AgentTesla)", "value": "867d895ba669ad881a968b8e735b106f137aae53e8a2fdbb29ee542f12bb3bb094dcbcd3e8e83e4d329b1ddf5c0e6a3e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777051048, "uuid": "a341dd8b-ae81-4ca8-b159-3d64b046186e", "value": "T10D6502018BC02FA98F991B2D60FE210DE3B04ACF6415A94FEB33BD55BFA760592171B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777051048, "uuid": "1f67294e-f213-40db-81b5-804091c22ab5", "value": "24576:wqIUlhhztPh/ikUlF6NtltSKynzpcMnMDkABWBS6iW:wHoivZPV7nMAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777051048, "uuid": "43bcc831-3ed4-42a2-9758-ee3e494b91be", "value": 1545834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777051048, "uuid": "f77f99a5-da7a-4080-adce-f772fdec7192", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777051048, "uuid": "976d9e7d-97f6-4d64-be06-e4b210dc1a2d", "value": "Remesa_ABC_INV2026030013C.pdf31.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e05bf8-3fe5-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777038857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038857, "uuid": "d40650c8-48bd-4f5a-a175-db54e49743aa", "comment": "Malware payload (Gafgyt)", "value": "2d3eb5b4626ecd8f53c21c3028b9654d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038857, "uuid": "280e0b17-1376-4534-9a8d-9c3a955007ac", "comment": "Malware payload (Gafgyt)", "value": "54e010ea45d1b75e0d5dc9da8ca92ec1106b1ed7822a88df758cb146479b2e9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038857, "uuid": "67b68b11-b93d-4ede-9a3e-eb9a63afbcb8", "comment": "Malware payload (Gafgyt)", "value": "92bd99d4c6345247482b23656750698c6202135d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038857, "uuid": "c3c0da0e-a65c-4d69-b9ed-d8158adc4ad7", "comment": "Malware payload (Gafgyt)", "value": "e84d7d658084c83ba66f6bc430f6d36cb9b415e8bd96a6e45aa30374d991df9046673d71645f981cc4b1e3af6140d078", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038857, "uuid": "bb615b3f-2fde-49ad-aac6-09fcd410b4b7", "value": "T165A36B12693D1A1AD0D0643202BF0761B5F22BD916D4D99FFE320D5FEE66390292BEF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038857, "uuid": "4335e9d9-72bf-4054-b4db-80bc940ab5e6", "value": "3072:56t99pCuxc5arTxZIZAG1TjPNZKc87Dp7RX6T:56r5gqT/9MjPTKc879tXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777038857, "uuid": "3c8f60f3-319d-440a-bfc7-8f9a60d000c2", "value": 100664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777038857, "uuid": "e87ea4aa-b8b1-405d-94b5-d47f369faacb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038857, "uuid": "c3eada81-c3e6-42a5-a074-ef839cb35610", "value": "main_spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694e5ede-402e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777070350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777070350, "uuid": "81be182a-ef1f-431a-98cf-cdb2f27ef70e", "comment": "Malware payload", "value": "4cf1f134fafb83bc31c6a7af99202499", "object_relation": "md5", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "joerass-icu", "colour": "#819707", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777070350, "uuid": "f168de57-3057-411d-94fd-9bc2a274b2ed", "comment": "Malware payload", "value": "5580ad5be7d8ca45533b604d9b4edcfed791d4fb0be8140b0d7fc4cba17c42ac", "object_relation": "sha256", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "joerass-icu", "colour": "#819707", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777070350, "uuid": "cfa3a05e-f72a-4270-abc2-a919ec49bbca", "comment": "Malware payload", "value": "b7aa72930bdf9f0f87cf613481af54046d25f1ed", "object_relation": "sha1", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "joerass-icu", "colour": "#819707", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777070350, "uuid": "0ae210d8-c9fa-4755-8907-325da7ea74ac", "comment": "Malware payload", "value": "a4482326bfc0728cac2292a8493f8f3ebbfa1da7282a5dc1fc7029ccf3bae2e0b1b736b14595b9d311d7f275fb52839e", "object_relation": "sha3-384", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "joerass-icu", "colour": "#819707", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777070350, "uuid": "7bc77d44-f72f-4337-a9f8-682b887e6707", "value": "T17FA24BDB147A2039D37420B687778041F637E6173A45B9A93BAC47202F5A82295F3F9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777070350, "uuid": "9aa10aa0-bcd6-4948-82b0-9aa25cc501f6", "value": "384:9Uh3kprFxpDIaWFfgF9uvCljuF5GVTbCPgK2VjcX:8UJHpGFc94PciPk1cX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777070350, "uuid": "32af6a07-817b-4d99-840d-c9674dd76e7c", "value": 21709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777070350, "uuid": "4bde7db0-ce69-4927-8a8a-44baa56995a5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777070350, "uuid": "f7a01769-ab25-485b-b36d-bed8d964a5fa", "value": "ext.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "252034f9-3fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777029863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029863, "uuid": "3d7d6baa-6201-4411-b3c8-9e3482594990", "comment": "Malware payload (Mirai)", "value": "91f829d9dccf9d101de0180ca11bd39f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029863, "uuid": "b5545c59-2e78-45e0-b623-4c949b74bcba", "comment": "Malware payload (Mirai)", "value": "55c4bb14075bfbe162751d83df3cde167fde7e34c91646784526e25a5c96eee2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029863, "uuid": "541a3e8c-dbad-4a6e-85c1-ff0c1918c6b6", "comment": "Malware payload (Mirai)", "value": "5ea0bee1102e81b995d18ad290fbaf1a962e8ee3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029863, "uuid": "65d354e5-5c20-4dce-a00a-3ae453347064", "comment": "Malware payload (Mirai)", "value": "911cb0f4b7ec47f83877b8af12d965c02ada6df4bfefa31b230db02b7d562efb25f80dd6774dd3d35c88e5e03e465af5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029863, "uuid": "6f9cdd3a-4936-4472-a8b7-672d3f6c8359", "value": "T113533B02B2280A5FF9D319B0343F1FE197BEEAC035E0B689695ED7558635E332485E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029863, "uuid": "1a5931ef-1955-4eed-ae12-34255bf0c470", "value": "768:LtMLxtiRFwLoDnud1kvSeq7Q4dPfGAsLmZ8BBSzjrYiyR7gHX1SPgIaalA:RMLSBq14Se4GHLTBygfGXAgIV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777029863, "uuid": "7f83217d-ef92-425c-8080-2bd76a628a5b", "value": 64344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777029863, "uuid": "6f37f7c4-497f-4463-bafa-6ee1147f0669", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029863, "uuid": "623af23a-20ff-4bd4-acd2-3b4040316a49", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98bdbfff-3fc5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777025332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025332, "uuid": "194ae97f-995f-494d-8a1b-4293700c75dd", "comment": "Malware payload (Mirai)", "value": "a202f234ec8ec2a063f7fe95755e1b64", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025332, "uuid": "412f909d-12f6-4e58-b492-66df3e2607df", "comment": "Malware payload (Mirai)", "value": "560b364ae9923dc12fa14849658fe977ac34dcfdce3ddb9fd0bb07f277bd9fad", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025332, "uuid": "86e5b269-081b-4c40-85f5-2bcc73c1c2a5", "comment": "Malware payload (Mirai)", "value": "5bce640117509892d5f188eb486d974a2f22c15a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025332, "uuid": "7d550eb0-88f4-44d8-a5d0-fb3d180e5699", "comment": "Malware payload (Mirai)", "value": "5fd88861c9b83e6a91582b2d36f4c1857fe69d29bf33a76001c992ec0d65311482bdf2a46b7cff8d6e6d40610b9f05f3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025332, "uuid": "e04834dd-b696-4acf-9cd0-4d82803b52ba", "value": "T149F3C50E6E198F7CF79987344BB79E32965833872AE1C582E16CD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025332, "uuid": "550d4485-6cdc-4360-9866-3abd33cfc19e", "value": "3072:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/Q4vkTTzTT4BFZDiwY:MOATXjpCgqDJHDexBJKfjPV4kuMu8hJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777025332, "uuid": "ebf3618e-be21-4969-9849-5f779181503f", "value": 171724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777025332, "uuid": "dd3c380c-2090-4486-ae98-99087069ec64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025332, "uuid": "556f5c71-f4ba-4582-b922-c8815b027f22", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6be188-3fd7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777033177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777033177, "uuid": "46cbd278-927e-4deb-9edf-8426e45de403", "comment": "Malware payload", "value": "657a981677aed48db7404686e0b2ffb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VexxStealer", "colour": "#10C996", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777033177, "uuid": "41ff9d23-1ae1-4256-966d-11814713e143", "comment": "Malware payload", "value": "562cfdeae9adc7a27558e5e0a2b1e2a3d8cecf55e1e07ae1224634c2fea86fdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VexxStealer", "colour": "#10C996", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777033177, "uuid": "b2ab04a5-e075-48ff-a763-cb3852fd2540", "comment": "Malware payload", "value": "e1a586554b42a4d302d86af4162815895e21bddb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VexxStealer", "colour": "#10C996", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777033177, "uuid": "ca27e988-1bdf-4b81-a473-4a898c3c4ec6", "comment": "Malware payload", "value": "f0ee16c7a0e260f99b32736561371cf3e85dc834161756cdb5b2a6cd12352cb6ddf074461d0e912380aacad1d247a09a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VexxStealer", "colour": "#10C996", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777033177, "uuid": "6aa4e4af-c17e-4bdb-990e-6a9283b10e53", "value": "T12238337FF38F723AE42A5A3672B2A24580372A25C5021C5B96ECF48CDB257311D3D796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777033177, "uuid": "bcf5880f-5ec3-42ee-ad6c-25f71ca21a34", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777033177, "uuid": "81045731-5aa3-497d-a32d-5b3d5160c01d", "value": "1572864:yrZjC0CF8ztTjkSM1W5wnSLK8Rbz4LOte0I6T2KedYEtZmv/U0bDZqFgT1RzmL5t:C1CsaSQW5wr8RbzwLafEpg/U0bRqLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777033177, "uuid": "a0092a82-6523-4794-b8fa-104b2382483f", "value": 103014194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777033177, "uuid": "d1856261-8f07-4b82-b59a-4bce8062ce43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777033177, "uuid": "0e7811f9-1798-4989-b4b2-bb96259d3977", "value": "ezfn luncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cf6c99-3fc5-11f1-a769-42010a9c0008", "comment": "Malware payload (SnappyClient)", "timestamp": 1777025089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025089, "uuid": "e3d91fc9-b1cc-417d-91c9-42869d8b2dd5", "comment": "Malware payload (SnappyClient)", "value": "d9f556865406a4671d53df11689b1f64", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025089, "uuid": "cbec916c-23eb-458f-ae45-41b92ba3382c", "comment": "Malware payload (SnappyClient)", "value": "562d8f8381ad20a7140a5b7a060ff4ee60484eb815bf442f7071e293678ca95d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025089, "uuid": "4d3d52eb-c5eb-4a51-9936-d4b84abbc9d9", "comment": "Malware payload (SnappyClient)", "value": "6e335b9bfe088ecd73b839e6629d69ec5c43a535", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025089, "uuid": "071faf2f-34c2-4583-99bc-fdb292467995", "comment": "Malware payload (SnappyClient)", "value": "35be601ac638cd2729f80ee0a88208cccf3a608d4379b9d4f39c44c2cc4e2815138ba22f92405dd25b6299bf9906fdff", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025089, "uuid": "41735f60-83d3-4bd5-9fe5-f9bd933c1265", "value": "T15A6633C5B8866137D14398FA2E6556907DBBDC380F1DE003A8A5FE186D782F606D2FB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025089, "uuid": "e1c40266-530a-4028-a1bf-e95803ae2653", "value": "196608:Ogcs8Tl14t0TuL8cqRhQ9ijS4yQaBZ4ng:OKLCQShmijV8ag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777025089, "uuid": "9a9147ff-aeb4-4ef6-abd4-0b38c707024e", "value": 6926336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777025089, "uuid": "f26da872-40a4-4824-b4a1-777307f14e36", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025089, "uuid": "06b2629a-c7d2-4a08-b0ed-050aefd8fb09", "value": "YRJKHYWK.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca8f8cb-3fb0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777016158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777016158, "uuid": "e1c6c95d-a728-4b42-82ce-c8cd0f2756e7", "comment": "Malware payload", "value": "dc2187ba4b56ac3112be37e0fc2d5e0b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777016158, "uuid": "720520ef-6c59-4bc2-ba76-08bf9b74cc1e", "comment": "Malware payload", "value": "56847441b28553461d59d4a50fcb66fdf6b284c6e3024105597a4beae559565c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777016158, "uuid": "7203ed2a-976c-46c3-9e36-081d61e2c1f9", "comment": "Malware payload", "value": "c47a6c032f12ccd90171b104a561101bdbe524b5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777016158, "uuid": "f2d591cb-a41d-4283-8e88-84fdc4f4ff9f", "comment": "Malware payload", "value": "b11823ced30a97032e5cd96d75438ca725232953095cad388e633286cdd8b340c0647ed49634100f9590cc8ef670d45e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777016158, "uuid": "b59eac5b-3f0d-4681-b248-a36395f85025", "value": "T1BAE593DEF3158D5C6F03DE1E528128A6F3A05722911355ED0BEB8AF6D04DBE682F22D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777016158, "uuid": "ff28cd65-76b0-49da-9cdd-381dd1ae9063", "value": "192:XL/L/L/L/L/L/L/L/L/L/L/L/L/L/L/L/L/L/L/L/L/L/L/L/L/L/L/L/L/L/L/N:gY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777016158, "uuid": "cc67f037-8c2a-467d-ab91-ddca2d1e4aa5", "value": 3107253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777016158, "uuid": "d341c55d-3a58-45bd-a84f-b3c081f88a16", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777016158, "uuid": "175fc643-3f43-46cf-b180-e5a017b249e1", "value": "AWB# 880081422741_FedEx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaaeaefe-4026-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777067024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067024, "uuid": "3048d56c-17c2-4e7b-80c3-03259fa73933", "comment": "Malware payload", "value": "05623bbddc5f91ed93c9746fabbf6eaf", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "motivate-starkmond-cfd", "colour": "#22C6B2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067024, "uuid": "9265f285-a775-43cf-8d1b-4c125a643817", "comment": "Malware payload", "value": "56884beb34bec0e7ad864ca1a1297c534fb2ca9e9070220f4948c0d0625fbe65", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "motivate-starkmond-cfd", "colour": "#22C6B2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067024, "uuid": "f0610eec-88e4-4ed0-bf0a-a4d3b809eb29", "comment": "Malware payload", "value": "9756f42d45ca620b3c3012ec653a0adcc1af89b0", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "motivate-starkmond-cfd", "colour": "#22C6B2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067024, "uuid": "a9ca97ec-345b-4985-9396-4cf835329170", "comment": "Malware payload", "value": "c7a1ed23f12a85233665985120fe3fee51af29c9ad46669ca3f4f4bb4836da31c1e37f447b3273a72ec3d6741e25d806", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "motivate-starkmond-cfd", "colour": "#22C6B2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067024, "uuid": "bd34ea51-140d-4c5f-990b-ffe4bc3780e8", "value": "T1E14733EC831DD001F7A7FAFC705F065ED2659AA27AF8969B2B7426943DC31421E3530A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067024, "uuid": "8d270c6c-bb19-4714-b8ed-967472d4323c", "value": "393216:bZOGoFv8TQ9MwN5VcyRV/UUSYQpHaqSxPqls3qurH55+tLssy1wwYqWy+YzpoYX1:bZOJKVkFSYFcQrZ5kewshVBXmhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777067024, "uuid": "dcfde375-3deb-429a-bcb4-44122d3c7780", "value": 25230187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777067024, "uuid": "335d0032-936c-400c-a0c2-058d76f0092c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067024, "uuid": "87be5011-ff2f-44f2-8435-8de7d6bbf733", "value": "Main Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f1321e-3fb0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777016115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777016115, "uuid": "136574e5-e360-4b08-a862-bb08c8d1a01f", "comment": "Malware payload (AgentTesla)", "value": "cc9230cf2d5001475320d6537c826b28", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777016115, "uuid": "ec6e38d7-4d37-44e7-bda8-b7e7a69b0256", "comment": "Malware payload (AgentTesla)", "value": "57d130846364c8268fcd873605d074923f1d8b233f4f0372d66c10ac34d15b19", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777016115, "uuid": "d32c826e-df1e-45e9-895a-e02213e47bd1", "comment": "Malware payload (AgentTesla)", "value": "5a0a8e06c855ab8d00c24a37e5f8465fc52009c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777016115, "uuid": "318f39a7-daaa-4602-af6e-e803a04310d2", "comment": "Malware payload (AgentTesla)", "value": "518e4d118cb7c7f302227d12575322777f959ddc4b1236d7810788da0f53a24b3fbfd3186a257788134afdbe7b511f1a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777016115, "uuid": "40398c39-8fea-4e3d-9808-5bc49e82860a", "value": "T18BB4F12246DC3FB4CFE8062D80BF190D73E085DF9456698EEA377C4A6FEB545021B199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777016115, "uuid": "e258860a-a24c-4a62-8d78-d954a172f644", "value": "12288:Emq0AimHZpAnpHVE2+do+SBVZYdpaa0X+:EmNtmHZius+OrYdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777016115, "uuid": "be09d765-1e4f-4a9f-a2f7-f78e68e2a756", "value": 503392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777016115, "uuid": "c63070f0-4b44-480d-8083-1c0c0ae4538d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777016115, "uuid": "cb8e0936-7158-4af2-8930-829d6c1a2237", "value": "DECO5098765JGFG.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed29686b-400b-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1777055539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055539, "uuid": "423926d1-600d-45af-8157-2486eb3b7b02", "comment": "Malware payload (WeedHack)", "value": "b998b310976a080f364f890b4499784d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055539, "uuid": "3621587f-9478-4a57-9824-3f16b5f986cc", "comment": "Malware payload (WeedHack)", "value": "58c633f06bbdad0a053d6cbb777840e0ded3f46f8db19735ea70e072976e0d43", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055539, "uuid": "5287e103-a7f3-4d78-9a6c-511952619765", "comment": "Malware payload (WeedHack)", "value": "777629627e64fc06a0a436db7a47311a42d62b0b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055539, "uuid": "a1fa421c-1e3d-4c10-b918-03e6af3463b0", "comment": "Malware payload (WeedHack)", "value": "a5125021f08bd4ca46b12aba40c1244dc01fc5ad6f49a89040c2f48d49c7a9399c01b70269a815686e1d45b233c31ab8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055539, "uuid": "d26b945f-647a-43bf-aec4-682d31da3787", "value": "T1D494230D9A0CD919C7AA00F7BAF1D714D9EB1C1C14136E7E5D8A11CB3BAE39CE1A4E19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055539, "uuid": "d98a9a3a-b1c7-4dd2-a718-e65d6bbde156", "value": "6144:3IzVOs7mj+mIEY0ZsnP8gfqkv0kViKEMgbrp/oYG+iBuZ/bupU2NFo4YP/2hF7WK:3uOP6mI8KffjLVpexo1ZKbQ5DoJuYpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777055539, "uuid": "1ca192cc-51e6-4c23-b68e-c924cfc7384f", "value": 410710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777055539, "uuid": "a9c1d58d-d228-4533-b49f-300b6e569b57", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055539, "uuid": "075c79b8-6d69-4bfb-980b-ae2db706c675", "value": "Dupe-Mod.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10f756d-3fc5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777025427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025427, "uuid": "c2a1bb91-7959-4ff1-86a3-3cba3d55af98", "comment": "Malware payload (Mirai)", "value": "6b8df667994ee243fd8674681e57a1df", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025427, "uuid": "bcc40d8a-6626-4a23-8f54-1a6473ca88ed", "comment": "Malware payload (Mirai)", "value": "5a144d811cd1e11297357cb17cd3ec236c746599d7e8160b9b448548e82873e6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025427, "uuid": "e6e30e8e-c58c-41cf-b39b-c47e6d4df20d", "comment": "Malware payload (Mirai)", "value": "4748a74806fb3e467d2193dfed1c561fe39032dc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025427, "uuid": "1b398e02-886d-4e1a-a9bd-225635e3fe14", "comment": "Malware payload (Mirai)", "value": "d51038d24b43c5e2cff548409b856ea2931b701c4cee7d11fede88249c768b180f4e826dd91cfe7565d6fe64634a636e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025427, "uuid": "f45954e4-7f94-41b9-affa-a339010aaf01", "value": "T1CBB339C1BA43D4F5DC1641306177F73B9A32F0791239DA87E7A49E327C92A419D0A39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025427, "uuid": "5e8f50e0-69b3-4f0e-880c-49ee574b313e", "value": "3072:PbKW4dCLFaGFBu3/45g1rcV2wrzSr9bMFflk:Pbj4doYGFB0/45gdj9ulk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777025427, "uuid": "1ab05061-7c34-4771-b0aa-1a1d184ec22d", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777025427, "uuid": "85cc7f3e-0e36-4142-b604-be5bf5b261eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025427, "uuid": "99041363-7055-40ed-a8a9-ec3866245995", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3caf2506-401a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777061685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061685, "uuid": "1ec25967-306c-461d-9642-ea808b311f2d", "comment": "Malware payload", "value": "c495d2120fe8453eb2a47fcc73f09237", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061685, "uuid": "38cad515-6811-46e4-9fc9-ea7d97527155", "comment": "Malware payload", "value": "5b50ecba3041b74c8b9a4fd31cbea4c7c3f32e86b4610c6c2fb225b289e73d9a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061685, "uuid": "c8c494fe-9ab1-4e62-b1e3-6b644cd12b1a", "comment": "Malware payload", "value": "e468b10f75804fa6a1c09590a373b8e9cbccf6c9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061685, "uuid": "0ce04d75-5c39-4f6f-b1d4-9a5e46988f2b", "comment": "Malware payload", "value": "58aeb96ab5a2cd3e2d5d40910aaceaccd023bc7f16fdd674a9604e519d89e06bac6c0f676c3c142a878403711bc2a994", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061685, "uuid": "2d636ef7-a56e-4bb7-8d12-e967a0d1424b", "value": "T17E034C85B79400F8C1F94336F8756A8697B43076810A174F47B89D6A0EE3579E93E2CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061685, "uuid": "32f6077e-8920-44fd-a27a-cc62d3c0a635", "value": "3b2dcf30386c4c5da656dc4849549fac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061685, "uuid": "6641b2a7-dcfe-4ca4-a381-1f8d4c86c052", "value": "768:BrgSKCiRThYB38Mp74K4QMYot1reEiZnC:BrPKHl1BKa1repnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777061685, "uuid": "cdc7cd1a-5fed-4b4c-a19b-da9276acdf2f", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777061685, "uuid": "55d789be-5f5a-45ad-b657-01e02ac7e312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061685, "uuid": "310f78ad-c4ff-49fd-bc8c-0d466465300e", "value": "data", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b204ee-4037-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777074416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074416, "uuid": "7bb4c6bf-4683-4721-8a43-0377a029c6a9", "comment": "Malware payload (Mirai)", "value": "24021915c772445da497ac6635313982", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074416, "uuid": "5ef6ead5-dc91-49fa-bc92-c500e2ae0051", "comment": "Malware payload (Mirai)", "value": "5e6fe6508b8f2704ff323b92bfac82acbddf4750f541953ee97b37be8f7d78e0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074416, "uuid": "69a1949d-08db-40aa-8051-cc0436036678", "comment": "Malware payload (Mirai)", "value": "d196dee2b5e69292bd0fee531b8b0137cd9522fa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074416, "uuid": "cb9a4acc-40a6-44f9-8484-8c4e3b4b716e", "comment": "Malware payload (Mirai)", "value": "1bcf2135c6f749f7ccc2587bc4f8282abfb140c518ec1ad395ff909f5754fb190ec10670653bb01534e991edb6cd09fd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074416, "uuid": "e43c4e45-9aab-4fdc-9eab-f5c296cfe6e8", "value": "T181514185B3915472EFF69A7671B9D508748095A2AACA3F4DD8FC34A884CCF08A0D4F97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074416, "uuid": "64efef1e-3356-4449-9a36-7c89572d4c94", "value": "48:ip7YpZ0pWopuIpYcpaUp8O4ph0p+opTwpkQpGWpqypN8pKZ:iy895vhYUFer3Xww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777074416, "uuid": "d393d8c9-b1db-4564-ba2b-0a2ec9cf39ac", "value": 2764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777074416, "uuid": "6d4a2a27-4dd2-4df0-abaa-24b55cf2ca11", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074416, "uuid": "43c815cd-76e5-4c4b-a475-9a1e5865c64a", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c44be2-3fd3-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1777031421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031421, "uuid": "29bfc306-f2d0-4455-9dd5-e8b261fa21f1", "comment": "Malware payload (MassLogger)", "value": "c35853a81e9f0ca907e7acddc01071b7", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031421, "uuid": "291cac6d-0d4e-41bc-bbe8-19f217e03f9d", "comment": "Malware payload (MassLogger)", "value": "5eb94225a7d4d5aff1fbea4c97e210ddbebf6f09365f658a5571f7d6b8e0da5c", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031421, "uuid": "b8e47af1-9a9a-421a-86af-dcaea848f1e0", "comment": "Malware payload (MassLogger)", "value": "715ff4a61665e2ad78f636dd7535734b47962f14", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031421, "uuid": "49d8d97c-8944-4e54-a358-c70e2ac6f375", "comment": "Malware payload (MassLogger)", "value": "7c2872a8d550eba1805eea69d7f81d29f65736abc235cd2ef6322b239d3886e1505731a56c46373ee408731af4257721", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031421, "uuid": "a71609dc-12ea-43b0-a7c4-806d5ba742c4", "value": "T13AB312E82DBC8CC4AAB4AB29B466E29BC6D047E1147E3581F67CD39C7E1851012FC614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031421, "uuid": "a0e51786-c317-4178-b4eb-7bc2ef6c2427", "value": "3072:GMFVwx9yC1bojtxtJ9l24pJ9rszihy/dx6km:GMFmEWboZxxl2evr4iAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777031421, "uuid": "844ae47a-eb67-4342-8c9f-c076a62f49b3", "value": 108609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777031421, "uuid": "7da6d201-d3e9-4558-b2c4-9bf27026b20e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031421, "uuid": "f3166f04-b156-48e8-837a-7837ec9ad3f7", "value": "Objective.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c65e7f-4001-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777051171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777051171, "uuid": "90710f96-cd28-4535-8c97-5c6714bf2458", "comment": "Malware payload (Mirai)", "value": "d6b8ca833d215477b9ccbdd31924ab40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777051171, "uuid": "784b2bee-430a-4cb0-a66e-df1be960c45a", "comment": "Malware payload (Mirai)", "value": "5ee700439d14e04134add8751acaf5ff234f7b30522de72602063ac020f9f235", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777051171, "uuid": "78da49fa-f3a7-4f25-ad35-dee74a6ddc86", "comment": "Malware payload (Mirai)", "value": "e1495769960a7075fa6de958737a4201c8a9a4dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777051171, "uuid": "5a099d49-bd64-4699-9672-aed36d64b66e", "comment": "Malware payload (Mirai)", "value": "b62c5fda55ec350a68ac667b263e92b9c719f5ef421e5c5a3dbe1dd65c099f2d841cd7bd4ffb5efe39e151a7bc51724a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777051171, "uuid": "946bc455-ff41-4828-af86-a15312333500", "value": "T1B6F47C623711CF65D355C63005F3CB519AE125A20BE25089B2B8C7287E61A2E6D6FFFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777051171, "uuid": "5542c14e-7e7b-4136-8346-5ee31cf5835c", "value": "12288:YuQA4TZHDO1or0mohDfs8WOv6dZCR3fiNKdlz+LM8p9IJL+6N6W/D8h5BF:YxA4TZjO1ozUDf3WOv6yKN+lz+cJ6A70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777051171, "uuid": "4e224360-5b1b-4f9d-b7c2-021aace003fa", "value": 748464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777051171, "uuid": "4af99181-7bba-4f54-aba0-a4b4e13b025c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777051171, "uuid": "67a10654-eb69-40a9-9d11-5e68334c3256", "value": "l_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b12cf0-3f81-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776996115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996115, "uuid": "31ffd312-72d5-4076-90fe-338b59ad1aa0", "comment": "Malware payload (ValleyRAT)", "value": "92c8fbb402d18a69e58afd0f5ec16073", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996115, "uuid": "44fa9e4d-5157-4ea8-8896-4d3e7a49f682", "comment": "Malware payload (ValleyRAT)", "value": "5f64022132943a53ac6f6e0f003d94d14329439ec313d63ccd145795406ef156", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996115, "uuid": "36704477-7541-49fe-ab12-c8f53c878b28", "comment": "Malware payload (ValleyRAT)", "value": "3ade33f80a71cdfa5bec990b8503495fd258351c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996115, "uuid": "a20d36b0-0330-4ed1-a22c-2d70178e8d48", "comment": "Malware payload (ValleyRAT)", "value": "b41be438354b17c6a3cecc76b1d1401139fec2e0303a672b5271477127e2b66dbb6035a44e27d4c68281d326ffa09c58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996115, "uuid": "6ec491fa-46ae-4e3e-9c25-9d4c31340b0f", "value": "T1B8C63315B5F4F972C4111A312E96A3B126341CE1FF15A3AB9FC232DA96709C18E35FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996115, "uuid": "890002b5-6b7c-4c76-8a0b-6fe32f2beac2", "value": "99ee65c2db82c04251a5c24f214c8892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996115, "uuid": "0935432e-6617-4946-99d7-b8d83e3ea7e1", "value": "196608:0VvcDtnB+bfRriqagm4wI49wiJaDOMLnGDKht4CO4cQlA7MHs3MyGoAW:0XfRWqagm4Mw7DOyn6KhUQEMHcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776996115, "uuid": "faa67dad-50db-497b-a526-fa490a80d288", "value": 12551054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776996115, "uuid": "157c61ff-ba97-425e-a50d-6a074c653c87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996115, "uuid": "d9486cda-f4b5-4afd-8d98-876ab96cc3ea", "value": "5f64022132943a53ac6f6e0f003d94d14329439ec313d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25569e73-3fe5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777038883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038883, "uuid": "230c55cc-c8b5-4166-807d-423f03a31c33", "comment": "Malware payload (Mirai)", "value": "0d8fb648130cf537cb3b1785ce231d17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038883, "uuid": "b3c1e4bf-8f4a-41a7-9676-7d4a6abb883a", "comment": "Malware payload (Mirai)", "value": "5f89efd0e99a87d8aa01f0b17763e7864fcf5fd1d8714becb9f9dc9114380f86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038883, "uuid": "fad5e262-4dc6-4e0a-8ed6-a72890f8be5d", "comment": "Malware payload (Mirai)", "value": "337bf38bc94353f5a6fcdae703985c16c2189958", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038883, "uuid": "3c3839a4-c6ed-4bf5-8e08-5f2503f0bd4e", "comment": "Malware payload (Mirai)", "value": "d06938b73b11488ae38b5c7d167a63e6a99e52c12ab4a6632bd324f19b7472e45fcfee8089e5e3c463a16f86e84788e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038883, "uuid": "2ff4465a-6c50-4d04-8132-f95b2b9f24a6", "value": "T1A3241A46F8818F22D5D012BEFA1E128E331327B8D2DE72179D245F24778A96F0E7B945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038883, "uuid": "ccc5a34c-43dc-4fae-b0c5-b7f1a6b7a1f0", "value": "6144:pl4DsPTaiQoW6v2cQXzv6aTNg8mtNuBVhC+:paDseiQoW6v7QXj6aZXmtcB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777038883, "uuid": "fc78a052-cbaf-45d1-9827-7f272ca6a704", "value": 219964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777038883, "uuid": "0b6f0089-ba34-4621-982f-6b2db796db7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038883, "uuid": "d656a9fa-3a87-4b7d-8d33-ba020cf5b75d", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f3f2d8-3fa7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777012225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012225, "uuid": "c66dc808-ca93-4727-8e75-e1c09357ee97", "comment": "Malware payload", "value": "bc2464ef2b0534c1fb7cea9a09f1931e", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012225, "uuid": "07211967-3113-4cd2-b534-728d255a652a", "comment": "Malware payload", "value": "5fbe73c9c09b73a26ca7818a360ac038c149215129da949c76a3f9961c152a1f", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012225, "uuid": "64351612-ecb2-4be4-9472-c70c65706e6d", "comment": "Malware payload", "value": "0fbe6e29cfc23dd9c1ab0dd59e83e437d96a5c74", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012225, "uuid": "174cdf73-dded-4816-b658-a3ecd5400da9", "comment": "Malware payload", "value": "77ec77fd14959cce0a6d33d37b6cc8244465d8560de7cd01896a07f5e6c84bd99da07e0e1cf07a9a6bea45082da611b7", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012225, "uuid": "12bac322-a598-4dae-abff-de09a5b362bc", "value": "T1E1063348FEEEB395D3B14D3C6A336E90557CF85C887A58177F16EBB9CA14882B109309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012225, "uuid": "875e08b2-87ef-4121-8895-39c1a8a091e1", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012225, "uuid": "5f3d9325-1773-4371-aa65-4525d4bfe072", "value": "49152:ZtQQolaKfiBlffWWtkabWRQiltQFHadtlVFCVphirMpNE3qAkCfNQXowaH5:dCaKf0lHWWtkRQiI6dOVjirEa9jeX5aZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777012225, "uuid": "2196881a-e87f-458c-91d5-ad16c358f4d1", "value": 3683376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777012225, "uuid": "0b21bbe5-33ed-41f2-b7bc-c28508d984c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012225, "uuid": "9d65506e-4467-431b-b803-c76dfd4a8c11", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7ef2a8-402c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777069605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777069605, "uuid": "d0c13c7e-7b75-4ae1-9a48-a89154f6d695", "comment": "Malware payload", "value": "b7ab35033e570b3d130f3ea68a6dc559", "object_relation": "md5", "Tag": [ { "name": "91-92-241-102", "colour": "#0571C6", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777069605, "uuid": "d001db0f-2037-4123-a3ff-eb2dbabddd88", "comment": "Malware payload", "value": "5fc8743db873866abc03a405393656518d92572f0b9da148a88bd06c150e4513", "object_relation": "sha256", "Tag": [ { "name": "91-92-241-102", "colour": "#0571C6", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777069605, "uuid": "f0209ee9-8735-4f4b-8a23-9b924cd5f23f", "comment": "Malware payload", "value": "23fe0b15ddf6635077897e977e59f0f74b67b8fa", "object_relation": "sha1", "Tag": [ { "name": "91-92-241-102", "colour": "#0571C6", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777069605, "uuid": "078399da-37ef-431e-b5f6-aba37459b33b", "comment": "Malware payload", "value": "05f4b5c93687dd0507462e697067e4f03a32021867ccc4592a69e993f16ecf37dba3c8f7c5ce94af0d1910f6d731d6b9", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-241-102", "colour": "#0571C6", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777069605, "uuid": "60c92f1a-3eec-4a7a-a638-1f9180943e7e", "value": "T15407333BE18BA53DE0692E367972E110483B7E6165168C1296ECF48CCF295B11E3F793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777069605, "uuid": "719f6d98-1099-4803-bfcc-d33224676ea2", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777069605, "uuid": "b7f7fe77-6652-4995-9ace-377aad3246fb", "value": "393216:hb4qAr5JzPUACFjD93wbpsfYdyb6uLRpbhEAqfPD4a5sRy3GI3kGU:KX1JzPYN3wbpVyb6obhEAqz4a6qkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777069605, "uuid": "babd32f8-428a-4ff4-a19f-22e271b06f61", "value": 16919024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777069605, "uuid": "56be7694-4c31-47a3-b7da-e86badfbff91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777069605, "uuid": "b8978c7c-1441-4d5c-a67a-2ca762fc2ebb", "value": "setup_signed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbabc8da-4034-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777073092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073092, "uuid": "e9dbd7ce-1c68-4a4e-8bc2-fa64a7e244ce", "comment": "Malware payload", "value": "93b0bda6c9cb5bc1a9d1aa35ee743271", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073092, "uuid": "b6574274-196b-4ef2-a62f-c8d91527136f", "comment": "Malware payload", "value": "604ca05f6da631d092b3f9c798c9156a31e46eace4e478c48595950b1d44180e", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073092, "uuid": "6dda989d-8ae8-4329-9309-ddb4fa54479e", "comment": "Malware payload", "value": "0fb82db1684eb9409902edc82d3b950b924feaa0", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073092, "uuid": "1eae0370-4bbb-431b-bd1a-707d36ab458b", "comment": "Malware payload", "value": "d26aa109a319fc824850302189fb82af99a4aaa6be8c7e948ed99acdcf4878a70e4756bbf1dfdb63b9da0f3531028769", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073092, "uuid": "7ef0cec4-2064-4166-82aa-b373edb25346", "value": "T140D300C98ADFC8E9C72F6064051F8C078B5D9223052DD990BFEFAD923F568A076B95D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073092, "uuid": "40d9f9bd-9963-4a14-9faf-01a9c6c5c628", "value": "768:Toof5dh+WSemqJ7akdNTF4F7IoPyLzFHYR7tXmZMe6IAqaHLhEN4hLQIdtaz0Xi3:0S7+XmaIYePX84VJbBFt01nQbq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777073092, "uuid": "3816297d-431f-4b30-ba95-cee33d1625ee", "value": 131455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777073092, "uuid": "b5967609-7487-45d9-bed2-645ee09355fb", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073092, "uuid": "b8fca670-cc85-4f21-a457-b934e6595d8a", "value": "Local_Archive_Stable_7258.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb7ccfa-3fd4-11f1-a769-42010a9c0008", "comment": "Malware payload (HijackLoader)", "timestamp": 1777031887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031887, "uuid": "dfd4a954-d0e7-484c-8dcc-07badb4fea4e", "comment": "Malware payload (HijackLoader)", "value": "d655005a9e486b777c5142097faffaec", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031887, "uuid": "e435f75f-3803-4b12-92c0-477f7fabdd9d", "comment": "Malware payload (HijackLoader)", "value": "613fbd07c2986af21e5dda48dd505097ab34a7098a130c6c937b6d6d0f8863df", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031887, "uuid": "44e526a0-1998-4228-8394-2a6c10185f39", "comment": "Malware payload (HijackLoader)", "value": "886eafed1a6f3f66663d3a06ab2b4cbfde72e61a", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031887, "uuid": "01bc6637-88af-437e-bd38-93e31a1c8e80", "comment": "Malware payload (HijackLoader)", "value": "8acc5cf8c20fa95f919b73e33f4359798ca32847e3b005db9a61494cfac34f01c32aa3589348840c9bb9ea2ef3e4132a", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031887, "uuid": "d0f5cdd5-1a0b-4e1d-9d66-e24db2868367", "value": "T19C16332263834031F961DD3644F24411EE3B39B81AF660062DF4DA0E5EBDAD68EB9777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031887, "uuid": "ee004f0f-b669-4f53-8bc6-d2cdface8085", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031887, "uuid": "6c491ebb-5a82-4227-97ab-29f209ea0543", "value": "98304:NvHNQGiXY0im/Ro0/FzMPx/m0QaSVH0Lx74d:sGiXYc/W0lM1m0sVH09sd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777031887, "uuid": "c42893ea-44e3-44f3-89ec-e6553cb96b2e", "value": 4148363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777031887, "uuid": "f563819a-61c0-4669-b4d6-340b7d45938a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031887, "uuid": "08df8211-0fe3-4a8f-9781-8d68b97fd541", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484a8727-3fa3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777010595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777010595, "uuid": "4e6e6c3e-3841-426e-b026-e687f571eb71", "comment": "Malware payload (Mirai)", "value": "6f16787976cc8a4420e2eca154d36cba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777010595, "uuid": "9eca42f2-0d46-4403-8ebf-098198f77254", "comment": "Malware payload (Mirai)", "value": "61e2779702fbe93e41d2127a7f9a8ed4cd1c22d16e5af1b47c5f73be21b34ff2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777010595, "uuid": "00bc6b04-90f6-4e04-b710-5e5eb0a89058", "comment": "Malware payload (Mirai)", "value": "f97ad0191c8e2cca375dbe56cb79905007c48266", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777010595, "uuid": "b87f68a1-41b6-4e7c-9faa-0abbe3e9cd97", "comment": "Malware payload (Mirai)", "value": "53ee31f5fbe4a1617d4b08a0cba92a97c6afca526f81f47346b1823e456638a9d86975088823d0331e8b7b481a3a02fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777010595, "uuid": "0a02ddaa-e95e-4e7d-930d-7b358db98db4", "value": "T1305423E7CD0252E02035C7B3398E54D362616B88FD9C2C468C7AF4A49FEA5DF0275B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777010595, "uuid": "036dd312-07cb-4cab-8e22-956f0976cdca", "value": "6144:1RrkQjdkJRjBrP2KsCwVZHpcMifEHK1tk0wEmG9aXwTchfu:1eqODwHPifEHK1y011Tchfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777010595, "uuid": "9a0fa417-bf0f-4c0b-91c0-52019de77329", "value": 280600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777010595, "uuid": "df2ae9e1-5903-4e2e-ac6e-c0dbb74dce82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777010595, "uuid": "3590f6d1-2027-46b1-88f1-d2d02e5b2658", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d104c6-4034-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777073102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073102, "uuid": "ee11122e-fda6-4970-b093-85c8cd70208e", "comment": "Malware payload", "value": "34dca2f6f65e4f64a8e942ee8fcb82e3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073102, "uuid": "19d00d32-cf06-4b5d-bbcb-f90d0a32cfe8", "comment": "Malware payload", "value": "62583cde8c06394483c7b283539380697c1af4f98a927862e820d76375bbb2c5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073102, "uuid": "4aa70ce9-4cc9-4b9b-8ae3-d97a2fb7c728", "comment": "Malware payload", "value": "dafd2e67f2dae1b3866fdd6365f12f761256e841", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073102, "uuid": "ffec9913-7903-4dd4-a705-7fcbcd986d37", "comment": "Malware payload", "value": "d3fe5be0b336f33dc06c7244a26c08f7e4ca0ef6c9be56415fc24cc78e23ff9255fec1cb2d08dd410ed2606485b172b4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073102, "uuid": "dd5e95c3-b76d-433f-a457-dc87917fcb2a", "value": "T115137D6566813C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073102, "uuid": "5f0b8b73-c653-402f-88a4-83c96fd10641", "value": "768:bBXRWNGxVt9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b7lxkcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777073102, "uuid": "3a0d7338-7560-488c-adf8-5d2ccb3ec906", "value": 45523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777073102, "uuid": "f56a9c5f-419d-4039-86cf-88241e16085a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073102, "uuid": "21696c68-b4af-41a4-8a69-82e866d07173", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca992f40-4020-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777064500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777064500, "uuid": "3bedf936-8c9f-4034-b40b-1fd4f851e253", "comment": "Malware payload", "value": "509f93218d896071be02c0de956bdf9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777064500, "uuid": "7003324a-ed2d-43bf-a962-2864de72ce19", "comment": "Malware payload", "value": "62d1cd88bdd3f8533a49018d15d4a8397fcba68de94a3dd24b3a78133193a17c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777064500, "uuid": "12bbd940-d1de-48b2-88a6-a749b5e9efd8", "comment": "Malware payload", "value": "acf4aabd7acbcc9ae6d66584548ba1feef96ba73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777064500, "uuid": "1d28f1d9-1e10-41cf-aed3-ad1b84b38fc3", "comment": "Malware payload", "value": "ee3abc0381aff45e8262840d9dc9b048db50fb2e01e11c38327bb396853087ccc5ed8e69563f171e81a00fcd21801e7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777064500, "uuid": "7be814e5-87b0-4609-8715-1b875e0cdb73", "value": "T1D165CF97A7248856C0706E3BE1A7EBB183673E3119D86A0F9D48F77648B3344CF15DA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777064500, "uuid": "11922326-a6d4-43db-ad3c-794d04db8d3c", "value": "24576:fBAXobSBtriTNF24wn8UHRjOkCcHIga6MRxAg26+KkZQqqtY1P:Kiq8UHtfdFIxAB6+M5YJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777064500, "uuid": "99edc692-5d97-4f3b-8396-10efc10494d5", "value": 1485798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777064500, "uuid": "554632cf-0191-4f36-afc5-f0f87acc82fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777064500, "uuid": "f718496a-b08a-4ddb-93e3-4bddf4db8bdc", "value": "bot.s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000f00d8-3fe5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777038820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038820, "uuid": "0215ec9c-3ac1-4c35-82cd-dca78953ba6b", "comment": "Malware payload (Mirai)", "value": "9bfc29154a835933802ca64ab293efc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038820, "uuid": "3bbd02cb-7578-4464-9f0c-b599ec9b3df6", "comment": "Malware payload (Mirai)", "value": "630528dccbf57f83d49d896eee0b12d8381cc6cf74be0ed77583b6b6b620ed19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038820, "uuid": "3ad9c448-803c-43e6-bda9-22348e520004", "comment": "Malware payload (Mirai)", "value": "d1ef416c3af3deccf31f332ec43ebad8e968a94b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038820, "uuid": "034b61d1-fb2b-4222-9bad-bc4b399c0a1a", "comment": "Malware payload (Mirai)", "value": "42201d65b10b2d37e182fd177c8b9f44822e6676996fc06aaf9ce4a5171ea99b8b55d280b150898618388a6a7e8d0e0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038820, "uuid": "3ccf4fc0-5cf2-4e53-b9b3-b7e80be30c30", "value": "T1ED44E80ABB610EFBECABCD3746E91B0529CC640722A97B767574D914B54B20F0AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038820, "uuid": "ca9d1d38-e7c5-45d9-a573-0200435d2ba6", "value": "6144:jF2ThdOFRI2HknTDnlkP6DyMTmRaRzbi/xLPamdny5j91FOL3G5JW3fH6SDKK:jF2ThdOFRI2HkTDnlkP6DyMTmcpbi/xt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777038820, "uuid": "c8513aff-2cfe-4c8f-8c91-cd3fe9db8e6b", "value": 272672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777038820, "uuid": "c0b58519-667b-4c58-9bda-c474830851ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038820, "uuid": "49d0ed64-cf16-4aee-bc15-7f7e19b2e7bb", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47eb473f-4037-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777074159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074159, "uuid": "dcfc734b-afc9-43bb-8e67-53a078acf613", "comment": "Malware payload", "value": "5c0f9a6f3c4ef43922ef38775c70f4f9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074159, "uuid": "5ab995b1-4bb0-4a82-89ba-ba34d5c8fa2e", "comment": "Malware payload", "value": "6325c4ce4ae1edbec8e5e99e7cc6ac4efd3aa594da5c48c3c82572c1a0cff3e5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074159, "uuid": "c02e260b-440b-4186-a544-c130e97d745b", "comment": "Malware payload", "value": "609048e3dd712c3f490777557ee035bbe9ab1610", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074159, "uuid": "40ed20c2-b709-46be-b1cc-cfad4135c185", "comment": "Malware payload", "value": "78f83a221233df78629be1513df74a60325b3fca95618295eaa1c928805c49949f28c43daad08fa0816b0a5d07379c83", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074159, "uuid": "e86cbb7a-d399-419d-9357-ac38efebd7e1", "value": "T17562C315302D6C5AC962F4A0C8DF1947BBED52832C977BC16AE3305A7893787873E9C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074159, "uuid": "f38a614e-11c0-4a98-b188-2e63c1c7f88e", "value": "384:u/0RVk+D4FMoo+2pREjlN8ueIlfHTr/igB9DfEgNn3hgXNxc2FilJBOAoAnbEim6:GKUhbyOcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777074159, "uuid": "1d2ad24b-2f63-4365-bc69-14446234b7ab", "value": 15088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777074159, "uuid": "1503a167-c383-4c66-af57-fa8a1b664dc6", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074159, "uuid": "36b46ccb-2995-4885-b38a-1c2189a26731", "value": "run.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67639ea2-3fa0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777009358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009358, "uuid": "3fe11afb-1a0e-4c64-89ec-c64e9386b195", "comment": "Malware payload (Mirai)", "value": "b5c952852f51edd40ce36581ea53fe50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009358, "uuid": "c9d70766-c47d-45b7-b130-d54fd381ecb6", "comment": "Malware payload (Mirai)", "value": "634e5b383313246edd53d2f6ce5493079419ccdc3d69a35871d64c4c76f2760e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009358, "uuid": "a5d684c2-4d77-4eca-a41f-c7a14e4d4cb4", "comment": "Malware payload (Mirai)", "value": "fa36e39096219c573da073b5ed5c438b3b3235dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009358, "uuid": "ba3c665f-f8ab-42f2-844e-a0f42d539209", "comment": "Malware payload (Mirai)", "value": "1c43707b8dfe0714c041648e2cf9795a02d1d36cd40d5b5224260d74a49017c0ba3da4e5ace62b199c31c891dd6cbf7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009358, "uuid": "d1409c24-7a3e-4900-9e13-c32e6187190f", "value": "T14344E806AF610FF7D8ABDD3306EA1B0128CC681B26A53F36B674D968B50B54B19C3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009358, "uuid": "a2969710-11d2-4f27-83c7-408d8411b6a6", "value": "3072:1O2smVqR7JQ7GnAmhy3TCC4RRjgqcpRCEKbNBTRmZK3:1zsi2dQynk6RKqsCFrkZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777009358, "uuid": "0e353ef4-620b-406e-ad98-7f79ed3f1201", "value": 265012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777009358, "uuid": "dc134ab1-f36c-40d7-bf9c-a6f5ef814ca0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009358, "uuid": "0e50fc6e-c229-4f4c-95f2-a035af9e901e", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f2e8f8-3fa1-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1777009817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009817, "uuid": "5ba89d7a-2465-467a-8041-7649cb7cd997", "comment": "Malware payload (GuLoader)", "value": "7d9dea4a59e5b8127f3b6a93126f40ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009817, "uuid": "3fc32f0c-31fa-4be5-823c-d46b1a8dee9e", "comment": "Malware payload (GuLoader)", "value": "63ece28a652d79a12b1919ea09bb5999c37959c3172b9a0504a719805ca7e229", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009817, "uuid": "88e6dfd1-bc8b-4c65-b1a9-a380a2c6d5b0", "comment": "Malware payload (GuLoader)", "value": "cdbd1f97bf51fcb6cf21ebc6893184e2e84a43d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009817, "uuid": "da734b3a-d44b-4e9e-9b7d-70097344607e", "comment": "Malware payload (GuLoader)", "value": "7098bdf83534737cb3c2f2d8f206c2d11300fa7cae5e13b04a05c21609ada3082fbe3bb7ef9075ac866a0550cdf7a86a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009817, "uuid": "1ca1910d-3d75-4d89-8b81-f007cd945ca5", "value": "T14DF4D086B93C33F4D7A49F3F50826556CA473C7B5B05A5A29244BB3603714B3EB23E26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009817, "uuid": "a08bc363-d8bb-40c3-9eaa-8f775c46d6e4", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009817, "uuid": "e9ae5d5d-485e-4c6d-aeb5-e8819d658679", "value": "12288:OTAwG5oepSXhv7UiJO1pjNFJ950Q/zLX1Rj3ITWemYWQJ9OI8SlSC:OTAwG5Sxy50wLFRyzmqJ9Fvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777009817, "uuid": "fbc6903c-fc82-4cf6-8d81-abb45df83915", "value": 727962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777009817, "uuid": "83df1524-bf07-48c8-abe7-97b91754e0ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009817, "uuid": "fd68571a-77aa-44a9-8379-d126e4f17e3f", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99a8473-3fa1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777009899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009899, "uuid": "0e5db647-042f-4a67-999a-d15f8e116b61", "comment": "Malware payload (Mirai)", "value": "f09ec9a8c231825bdd92e4ca715ba203", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009899, "uuid": "950b1180-9a12-4060-aec5-786f3a43906d", "comment": "Malware payload (Mirai)", "value": "640b19b8dd91986eb609c7323946b4252a2477e3c87b9f725aa61f593f19a635", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009899, "uuid": "b9456340-59b2-4810-8529-091106f4a607", "comment": "Malware payload (Mirai)", "value": "fc9445b3daa9d49610c75ca8bfa6949371589e68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009899, "uuid": "b2930d4d-7165-4f9f-834c-5c4034df6055", "comment": "Malware payload (Mirai)", "value": "d187c8f50f7afaaf55b36632ecd3542b5c79e0a64550e2a75c51c74112a5b8efe779c3b86daf84584915dc7770d3bcf2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009899, "uuid": "50914641-e198-45d2-ab91-849b99f87733", "value": "T19A246B537B878FA3C2246A754AF382385ADA3B170AA3C4D7C3B95B0167559903C2DFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009899, "uuid": "c10d4990-a235-4277-9c0a-2843d940d36a", "value": "3072:jNu1SLWsx707Gb7oZR5+BZUMzKoUvo4GK+RABKEjnM+w1qgTU95F2Mn8j0w6j:k1SisYk8ZR5+R+vQXEjXwtYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777009899, "uuid": "7d91d00a-2f56-467f-8c18-4fb4f7375ddf", "value": 218184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777009899, "uuid": "7f95008c-81c0-49dd-92d3-a38fd992e52c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009899, "uuid": "d0d3c20b-941e-4730-8cf6-71a768c40af3", "value": "mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f26c97-4027-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777067249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067249, "uuid": "4ae0f2c4-53f0-4790-82dc-95e18fb02fdc", "comment": "Malware payload (Mirai)", "value": "da8f55004e542890460736e660b9c424", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067249, "uuid": "4d3ea3b2-a957-4914-8805-46842a65a58c", "comment": "Malware payload (Mirai)", "value": "6460913d7b8307ea0a7f38f6e78e68387c7df372c8693ff7bb5c4af4dfc60ed4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067249, "uuid": "2a881f01-effb-46fb-9fa9-bc338b40dd5a", "comment": "Malware payload (Mirai)", "value": "dfa86d30918ca51225894734fade826256b7675b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067249, "uuid": "2bc19af9-55bb-4d41-bd05-3de905fb5564", "comment": "Malware payload (Mirai)", "value": "29d0aa2d0ab59e82bc7649135c953a25442997a2e4762ee33c5f9bb0ccf8dc6c312dbb45474d7af550e403846c197eb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067249, "uuid": "2ba685c7-700d-4fba-a8ca-18e0c3a29841", "value": "T1F454D60A7B519EF7D46FCD3305F98B0128CCB45335642B7A3670EA5DB62A58B0AD38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067249, "uuid": "97193311-0632-45f0-856c-63fffb54af75", "value": "3072:FXb0nryFoAuINHwtxiN2asQdzD7WPtOrTqBkE7S6VjlpnGqpLmT4Zm:FAr/AuINHwhEJDx/JEFj5JmTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777067249, "uuid": "39f24100-39ae-41c8-865c-5a2b06a75c0d", "value": 305548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777067249, "uuid": "96bb6243-5969-4fdc-ade7-73b407744cb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067249, "uuid": "c322c425-6ad5-4cf4-b0b5-a0e5a7dd8d53", "value": "bin.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e3b58ec-3fe5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777038924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038924, "uuid": "32488ffb-c1e6-4290-9cb2-fb486fa44778", "comment": "Malware payload (Mirai)", "value": "59c1dbd3a926c5238763732188ff289e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038924, "uuid": "c84174b8-33e7-410a-bcb9-4ccbe6bfd6d9", "comment": "Malware payload (Mirai)", "value": "65a73c35bd3aa9862c7774f09c84963354e5efbfdd90806b75bbc4fc5f2c175a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038924, "uuid": "bcda7ed1-e1e1-4619-88eb-499dddceebde", "comment": "Malware payload (Mirai)", "value": "7394dccaeb3d205da6f1b24e2454c18a215b09d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038924, "uuid": "980dd929-f561-4a03-8c8e-7f9117a8c324", "comment": "Malware payload (Mirai)", "value": "00142c496c28395ce6b0da98adeb0bdbc1a4ab043f811a33407b02a709ddb2ca7c7e325d25105cee39618dc1925bea5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038924, "uuid": "48a555a9-e37b-4942-be3d-e5a8a5c10ff3", "value": "T1BD241A45FC528E23C6D412BBFB6E428D372617B9D2EE3117DD211F21378651B0A7B582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038924, "uuid": "7737e57c-9a3c-4b12-890a-999bbc4740f2", "value": "3072:C+Fpn2CE/eGHKx/bMUTz1zEHb2A49Z/ilaeak4efS/beS:FFpn2Cq7KlMUNzo6A491ilai4efS/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777038924, "uuid": "08710ed7-4738-4a1e-9c2c-51d2a026b044", "value": 211680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777038924, "uuid": "4034afd2-5ab3-43b5-b221-846a47a1fb1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038924, "uuid": "a61245b0-5c2a-4789-897d-735cd2892ad4", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5e13e5-3f9f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777008779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008779, "uuid": "00cfd4dd-9da6-4b5b-b9cc-5ebd278e72d0", "comment": "Malware payload (Mirai)", "value": "4b13b525505ff5fc003c22a9382a7bc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008779, "uuid": "0ad5e58e-596a-4b40-a4ca-a92b8dfc638e", "comment": "Malware payload (Mirai)", "value": "66273723b54321eaf2581cdf7d2bf1d5f747fd3d4fbb3c61785b002ccf8d96d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008779, "uuid": "75f74738-58ea-41b6-84c1-ca8f8c384cd7", "comment": "Malware payload (Mirai)", "value": "8c2464a7e34547d932d2e51369212d9addaea8b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008779, "uuid": "f92a1257-315b-420b-963f-eaa5418e9ed1", "comment": "Malware payload (Mirai)", "value": "2c327f7722ad51040a42a10f836e9f34da1b330e7aced454431eca539d82f23c772f42c721debd23fdc5650716ee7b26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008779, "uuid": "43ace47b-104c-41ca-ad74-0a281199805a", "value": "T1A934E791A4118ADFCE0158FA77AC4F342B817C70861B1FBD5D5194A8A28F8DFF1C6BA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008779, "uuid": "4ab60014-ca32-4b9c-b3eb-2a94879a668c", "value": "3072:+crNi7iPQo7OTnrdGcgIP6E2S5GdqlXs3locdWndRZItX:+cJwielVgIyJS5GdqlXCfodktX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777008779, "uuid": "e5bf85b3-f81d-4d6f-86bb-3c511133f0d0", "value": 251172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777008779, "uuid": "0882fddb-c111-48d8-adc2-f22dc4160d87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008779, "uuid": "8df756fe-f8f7-402f-8fe4-5f5187790ecc", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e34d223-3f7a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776992915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776992915, "uuid": "18ac5733-1d30-483a-83a0-29845a44ebc9", "comment": "Malware payload (RemcosRAT)", "value": "d4302d76d91af8bc39ef48d8a2f7ba86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776992915, "uuid": "5cb2dbab-e4ae-497e-8a88-cb2ff270012c", "comment": "Malware payload (RemcosRAT)", "value": "667b71e6f8389bf64ec8db65407fec3a449f055d6be8e1e27763532489f68ce2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776992915, "uuid": "91cbdab0-c924-481b-9886-f2d8b43458e1", "comment": "Malware payload (RemcosRAT)", "value": "99f12dfec037753d4c60abb7149889cbb333e7c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776992915, "uuid": "587976b4-e2fb-4e26-91df-a99bd6095440", "comment": "Malware payload (RemcosRAT)", "value": "c00884f4b785eee25b98142348f0cfd85edcac64cda88fea11c5d5627d08b6bed2b14a5461a87e12e621cf0c0477b520", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776992915, "uuid": "9266554c-a387-497d-a295-af0a1963113f", "value": "T184F4D086F93C33F4D3609E3F50826546CA473C775B05A5A2A245BB3A06715B3FB23E26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776992915, "uuid": "866a4f60-d898-403a-a1b9-b90f96268d5f", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776992915, "uuid": "78f7f349-73a5-41ed-8bcb-15b9eea0a97a", "value": "12288:OTAwG5oepSXhv7UiJO1pjNFJ950Q/zPhmAcMqrABZQjSJ9OI8SlqOLv4kUq:OTAwG5Sxy50wP0mJ/vJ9FvJT4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776992915, "uuid": "4cf8cc37-ff3e-4330-bdb6-a77da8814374", "value": 789369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776992915, "uuid": "4196a75d-e7bb-44aa-9279-b2e352879b9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776992915, "uuid": "1e46c633-91dd-4148-b84e-211e150d666e", "value": "scan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc486a7-4004-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777052453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052453, "uuid": "c27b2492-0cc9-4161-ada6-2812579d9791", "comment": "Malware payload (ConnectWise)", "value": "b1511b3adf263223b7e5d949d255e2ee", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052453, "uuid": "8acec62d-dc48-4044-af39-318a2072820d", "comment": "Malware payload (ConnectWise)", "value": "672162a723b931ff10c09328c3b71e01be02e4546c7000e7fa5d3b0bbd6ee5dc", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052453, "uuid": "ce2d67af-e9e8-436c-b288-2285b26f9308", "comment": "Malware payload (ConnectWise)", "value": "2d317571bb3e271eb594f77045fe6718143a2480", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052453, "uuid": "7ecd1dbc-3737-4ee0-8768-d1fe6bc51f12", "comment": "Malware payload (ConnectWise)", "value": "0a5486fdb672b574433a31030e83975cbeee989cd6600c58ff2527fc336c6b52db79cda17f549dd156c7a28050d142c7", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052453, "uuid": "49a5c428-8a0c-4203-baf7-9e01fc3306d1", "value": "T1A5A623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052453, "uuid": "df5851a4-f060-4114-9bcd-2f9acd78b357", "value": "196608:XnCtVYqI5MvbWEpKkq+IJqKknCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqOnCtO:XCXvI5MvHxiJaCXvI5MvHx6CXvI5MvHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052453, "uuid": "e12dec8a-789c-4571-bc76-5a5788995c4a", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052453, "uuid": "fd22136c-2e91-4fca-abab-9a11fad4dcca", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052453, "uuid": "05e20902-53d0-4e67-a382-07f016b73f0a", "value": "ScreenConnect.ClientSetup2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffae8848-3f85-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776998017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776998017, "uuid": "6ca8ab3a-0f0d-42d4-bbfc-51b869c23b3c", "comment": "Malware payload (PhantomStealer)", "value": "3626f3856910ced326c79c8ac64e51df", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776998017, "uuid": "0327e81c-e40c-46f4-ab35-c6dd1c42ef9e", "comment": "Malware payload (PhantomStealer)", "value": "6916eee5b360a12e04506e146dbc10b4ff95ba397c4b247b25817600078deac5", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776998017, "uuid": "ba5dca0c-7121-4072-9c88-974f0f638fd0", "comment": "Malware payload (PhantomStealer)", "value": "8ebf193ccda96d8fafebdb98ab2119ca580f15dc", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776998017, "uuid": "dcf38c7e-55ae-4137-a165-f0c95a7adaa3", "comment": "Malware payload (PhantomStealer)", "value": "f7bdff2d51fd10c978fb551454fa14709108a06e42b4f63afe17d8fea3d18e344049aab20b44da77159168d4af11162b", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776998017, "uuid": "caa27d56-ee40-4d72-b0b9-886fedb9e83f", "value": "T1F50523235AD59FB1951CCF68B96F5B4E2BE33F58641E41CA83C6045900DF7E3308A6AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776998017, "uuid": "60b6f631-67f3-4086-9d50-6e2d9d939d35", "value": "12288:fiEwfA+LQCu/iRX5/ZUUZHKB/OXQnKpeqos21FJMsAWIA5I85CXBs1hsS6/pz/ZR:qEXfGxZHSmX/pb9sAZ809b9i1uqju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776998017, "uuid": "09e66eaa-79b3-45da-ae74-d47d8111497c", "value": 839872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776998017, "uuid": "85988603-eab9-4b04-aa24-5a27c77537e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776998017, "uuid": "da56d126-91bd-4e66-9496-5338a0db782e", "value": "THANKS.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2db204e-4003-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777052086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052086, "uuid": "b43bdaa9-e853-4a88-8b4b-085b054599dc", "comment": "Malware payload (Mirai)", "value": "ad67bacdc25b5ffd079676ad58300290", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052086, "uuid": "108b2bca-4104-4ca8-9b2a-cf031caa861b", "comment": "Malware payload (Mirai)", "value": "698a0e6bc511beacd836d42215e4a80ce102c38b735c2082d13cf61636a6143d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052086, "uuid": "55663195-6a14-42fa-b014-e1e819cb4e1a", "comment": "Malware payload (Mirai)", "value": "a005fb018c5b9c242610d3bbd21c61d382aff0fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052086, "uuid": "51918c58-3c0b-4508-ab74-35d2f32ce98f", "comment": "Malware payload (Mirai)", "value": "48f1483194d4219b728f0611f662ad647b82fb8fe317f99b758077e7fae8e418c67f6660d5959b6980c096df3af22985", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052086, "uuid": "1a797ea8-16c4-4028-ba57-37ee421a0877", "value": "T109431891BC819A23C5D4137AF56E56CD372433E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052086, "uuid": "653b5528-e6b0-48d8-b8d5-3719a9b1c342", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052086, "uuid": "9b058fda-8ec6-48e5-a310-9525b5c4641c", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052086, "uuid": "40df95f7-fbd8-40f7-84c6-e261fd8572f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052086, "uuid": "048c5cb8-8c43-445c-b179-6b38b79566ee", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b4ed31-3f9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777008208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008208, "uuid": "e681ab1f-4bc7-467f-946d-544d73286f07", "comment": "Malware payload (Mirai)", "value": "48871c10de6e8a2cd61806ef49b91d41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008208, "uuid": "6773186e-8a33-4264-a74d-4e2e60454280", "comment": "Malware payload (Mirai)", "value": "69a3f8207de0386d28e743b27f532b3413d83f5b57b88213f633c6061fdb3361", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008208, "uuid": "36b641f1-ffe7-406a-8bd3-f87b4a140da1", "comment": "Malware payload (Mirai)", "value": "a724ec5bd4f7502fc5d3ef03fa4b3391785929c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008208, "uuid": "2348ecd0-aaae-42d8-af70-7b2d1eaef430", "comment": "Malware payload (Mirai)", "value": "edb1db11faca12e7ec8fb111877e4d2a74079748c6e21d2cd2bebe57ff433a59b639d6722dad1985d8816c2a77c45716", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008208, "uuid": "d18fd336-04c7-4cda-8ce5-b3eda33422a9", "value": "T10963022D5727C1BDF6A7237F8A7646C43FA046BA94554F473016C366CA8349C38A3DCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008208, "uuid": "44cac5fa-53b5-4a34-a02b-dd4bfa262750", "value": "1536:UNbGBpdlMjmZ1vOaajCCyvcqtCX6ldLL3hfqGrdZDyVSz:UN2dsmZ4aqCCda0qxvDyV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777008208, "uuid": "e167ed33-c396-4fbc-8715-643311d103f4", "value": 70304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777008208, "uuid": "01e77c22-c755-4a11-b6b9-b45d10572713", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008208, "uuid": "4c294152-4eeb-49c2-a79f-80a3acb90175", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd507ecb-4000-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1777050788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777050788, "uuid": "d918f79b-a7a9-4ba1-be7c-a5088eeb1f3d", "comment": "Malware payload (WeedHack)", "value": "862c653a7f28104a01e2c01f85505aa3", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777050788, "uuid": "3d858ced-3189-4778-ab5f-4180a04e7831", "comment": "Malware payload (WeedHack)", "value": "6bf794d1450d481c9716bb1bfef6f6ed951b6a0ac414bab1cebe49e2a25fbda1", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777050788, "uuid": "6582859e-9e99-4a43-8607-36885f426cc0", "comment": "Malware payload (WeedHack)", "value": "ea9a8c95f74b7c313bbb0f0cf8a71f45251fb6fa", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777050788, "uuid": "ef4a30e4-d1c6-4672-b666-5f9401e18bb2", "comment": "Malware payload (WeedHack)", "value": "b44b75d7218a5e9f359dd237d646667a44f1a3a6649eac58b08ad8ba6ab26e1db6894803d4725cd92a8b14847e8421f3", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777050788, "uuid": "5b6a0150-2b74-440c-9285-9aeb39a9212b", "value": "T110D3E9ADBDCEC439D403B8B210C589237D2846D99455B72F1DD04B8E0876F6AEF52ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777050788, "uuid": "5e7c233a-729d-4a87-af49-802f3a68916e", "value": "1536:w8uqEnqmyUAQ8ZNQ8R5lo0cqhDfcIv8g+0SL6e3Lu3cZ1QcOjpdRalsmTI7TRUkK:7tZvUAQ8vX5NDD501l6cuJhmoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777050788, "uuid": "7cd1b24e-38a1-48da-bc19-0274457b9072", "value": 138672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777050788, "uuid": "bf98d909-9eea-4774-ade2-3f68604a12c6", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777050788, "uuid": "3d6af235-0568-4a88-87c5-c7856ca36ab7", "value": "Donut_SMP_Dupe-1.0.2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff3173d7-3fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1777030229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777030229, "uuid": "bffbe218-4319-453d-b25d-57d2924bd53f", "comment": "Malware payload (RemcosRAT)", "value": "7938a268a58b8d4778ff831b83fe63d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777030229, "uuid": "7e4535fb-8fdb-4be1-8367-168e54d75f86", "comment": "Malware payload (RemcosRAT)", "value": "6c74937b5fb434fb47dfe295355896e819ee33614c77078a7f09dee169fa0e59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777030229, "uuid": "bbfc11f1-4338-4f5a-ad1f-1bbedf8cf8fe", "comment": "Malware payload (RemcosRAT)", "value": "eb676b4acce261e3d5141340641b4bdc903769c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777030229, "uuid": "91ae644a-6d05-499b-b68e-eba113004ab8", "comment": "Malware payload (RemcosRAT)", "value": "f69a4ae5344f301261f4aaaf7cd063a2d5e719a6893a7d3de012c2556522fd59c81f31a54d481c014c851c9e23faecda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777030229, "uuid": "956c420e-fef4-416e-8907-a24f11745944", "value": "T115F4E086B53C33E8D7745E7F50826545CB173C775B05A1A2A284BB3A12724B3FB23E26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777030229, "uuid": "5e2ef4bd-4a2f-4388-9eea-f5bc64a547cf", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777030229, "uuid": "29452c97-7146-4c1a-ad8c-2a737a5afd84", "value": "12288:OTAwG5oepSXhv7UiJO1pjNFJ950Q/z02P5cLunfVYJrBrx+J9OI8Sl4DD:OTAwG5Sxy50w02BiPrwJ9Fv4DD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777030229, "uuid": "b6ed2941-eafd-4b61-9d71-1c7572d8a513", "value": 785816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777030229, "uuid": "d593d9ba-a8cb-4827-8284-c538a1a7322e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777030229, "uuid": "d4e3fd33-a934-47d3-bc25-0607950d981b", "value": "Employee Performance Reports 2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07aeeb45-4033-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777072334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072334, "uuid": "37bc9788-b4f9-4cd5-82d0-4391143e8acc", "comment": "Malware payload (Mirai)", "value": "74a2e3ac96799115792d68a03332edbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072334, "uuid": "9deb5665-ae9b-495a-873e-51eaada2b502", "comment": "Malware payload (Mirai)", "value": "6d3dbc8b0a3eb05c88a8c1c82ba67218064cb0d839ab93b8c3e1803b3f5947dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072334, "uuid": "9d3846bf-cec1-4840-bdb1-6394b2930a0d", "comment": "Malware payload (Mirai)", "value": "08b3ab9a156b5725ce9eba7f7b57a8215a1563e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072334, "uuid": "b8ad3c26-95e0-49e7-821a-45c017f2eb80", "comment": "Malware payload (Mirai)", "value": "dffb0e4caa2c2452514c07a24f41b60f5f879d4dea43a57a8a4774d525a04fb163059cf1766ad964cba01f83ff99b652", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072334, "uuid": "4bdf1584-3c04-46e5-b784-f32566944a1f", "value": "T155E35C46FA818A13C4D517BAB9AF01493332A79493DB730789285FB43FC6B6F0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072334, "uuid": "3e92a3a1-ea71-4b3f-ad4b-e1aa8ccdbd5f", "value": "3072:58rdTYxoe/awaxxi9Yd1sDRW37hFsYPXfMYM/9zjdWe:58ZTYeegn1sDRW3VFzXfLM/9NWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777072334, "uuid": "8780abd6-5e3c-4dbe-b7c4-dee07e9021e0", "value": 153795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777072334, "uuid": "65c90711-d7f7-45e9-b1a5-43d5bfd58261", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072334, "uuid": "5fc049c3-b88d-4700-9004-a8de2b6b41f0", "value": "jade.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ace806-3f9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777008225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008225, "uuid": "286ff339-c260-4245-95dd-3cbe3750489e", "comment": "Malware payload (Mirai)", "value": "76729e4970f91c48cec65ac6d35e2886", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008225, "uuid": "27df637f-2547-4e89-9752-40018b326dc1", "comment": "Malware payload (Mirai)", "value": "6d71e672947197f4a253effbd6b4423a4074c27b067989e1529cfdca29099470", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008225, "uuid": "22a9626a-c2d1-4ce9-a3d0-10c8824fd1aa", "comment": "Malware payload (Mirai)", "value": "fe318dd6401978a98b07c612cc70a3efb300b458", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008225, "uuid": "2dc69444-42cf-44a4-9d6f-0fb2dbf78c7d", "comment": "Malware payload (Mirai)", "value": "7358141c6730818073f5902c223e99df62ccccadfa91016a59e34a1db4e874d08c2efd051b40a9e8a365498cec0ecee8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008225, "uuid": "3dcee5a6-c90d-4281-94e2-ae847e4d099a", "value": "T11C241A42B8418E16D5C522B6FA6E028D33173B78D2DE7212CD246F547BCADEB0DB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008225, "uuid": "0575f9ca-77f5-4c43-ba13-5c3c40e8f2ff", "value": "6144:6/pi8cq3COOkFE4f2a/lft8d95RrErrCS:6YMJNf2a/781Rrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777008225, "uuid": "d9d4942b-f788-4368-a672-c3e03eb941b2", "value": 210292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777008225, "uuid": "4bc0206d-75fc-479d-b80c-4fa014c73244", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008225, "uuid": "06f8b6bc-059e-416c-819e-4695817185b5", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec3f9c7-3fc5-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777025316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025316, "uuid": "59d2cfcb-4fb6-4661-81e9-41ee985ce405", "comment": "Malware payload (Gafgyt)", "value": "c141f288ce2db443cba5a6150859b6bb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025316, "uuid": "e2d6b90b-d5f3-4580-9938-4a5f2e09bfb6", "comment": "Malware payload (Gafgyt)", "value": "6d9217bb4ab9157b76d3a21b4dea2210197df82081202026e687034454dc6244", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025316, "uuid": "d7273571-f5fe-4467-b53f-057499529c45", "comment": "Malware payload (Gafgyt)", "value": "fbbb681fb1d8b388a3805274b8dac057903bdfb5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025316, "uuid": "7cb64274-86a5-4522-ad10-0d5558786fe2", "comment": "Malware payload (Gafgyt)", "value": "bf8760c7d9abab61122cdf87817b93dcb82bf06f8f254dfc0e45f3006fda9a1506936179a17700c8112a5c4ba957ab4a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025316, "uuid": "7ecf024a-32aa-4520-a430-36d21e5a461d", "value": "T12CC092AA72A340CF8B64CE0CF856CCC9604780DD65A4AB6CD1A43E2E55E99386817257", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025316, "uuid": "6eab3111-9b6f-42e0-98fb-e3371a824d26", "value": "3:GRFiGuLWisi/vaGN3zOdV3LKiovGQJwGuLWisi/vaGN3zOdV3LKiovn:SiDWFsSaKLKiovpwDWFsSaKLKiovn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777025316, "uuid": "59959a36-65d1-4cd7-8a80-1431fcc6ff3f", "value": 130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777025316, "uuid": "1e5a8030-e1d1-46ac-bc54-1e4d2139d9f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025316, "uuid": "d5aeda53-f800-41d7-8dae-707f93613d41", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a73188-3ffc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777048872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777048872, "uuid": "f60bdb84-1299-4236-9a9d-83f2ede9ac75", "comment": "Malware payload (Mirai)", "value": "7997df296a348d06c0be9eac67ce46ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777048872, "uuid": "4ac2d2a6-3bc1-4e80-bb90-4bce4056d130", "comment": "Malware payload (Mirai)", "value": "6e4fb9d1744961bff999e99c33ae2321b2bda63ddf71421b2ba4aa2db6bb8e7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777048872, "uuid": "50d4b2cb-2ff2-412b-a5c5-bb8e271fc960", "comment": "Malware payload (Mirai)", "value": "52fb561fe0d865e62da1c42197ecf014076d9cd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777048872, "uuid": "95460cb2-7a6b-4e4e-a95e-3c26c5e8a45a", "comment": "Malware payload (Mirai)", "value": "e7eec7deff68358d9387ef677f4d32b51135c9659f23cbb5cc33a0f542181c1dc5c3dc395c6f08eeebbcecd0cf80b1f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777048872, "uuid": "8ffbaa00-c838-400c-b9e0-a1b6c721e20f", "value": "T13182CF3061AB74E4CBF14435FAEE8EC6971A0BF8D0FC369317586B78894650225F93CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777048872, "uuid": "e45337aa-d93c-45c0-be82-92bcead52756", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaxIhymdGUop5h5le:2dV0P6+kom0tVAoNvm+to16s3Uoznle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777048872, "uuid": "ff11b133-9bc7-4751-bb63-d71116e55bf0", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777048872, "uuid": "bc870427-53d1-4637-b9b5-2410c1c27e4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777048872, "uuid": "85aa2b97-3418-4c13-af99-3027e004120d", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8be5c08-3fbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777022782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777022782, "uuid": "69628483-49cd-4cbf-9b2d-4e22c1cd264a", "comment": "Malware payload (Mirai)", "value": "098a28addecef07235c2325b7e43ab7b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777022782, "uuid": "056cad3d-a691-41df-bdea-732ef5618592", "comment": "Malware payload (Mirai)", "value": "6f1646d1e569aaead8d59c51bd2a30fb18940674ceba44ae010e8bf334e9a995", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777022782, "uuid": "e509600c-4776-427d-bd3b-594903c83f36", "comment": "Malware payload (Mirai)", "value": "4c23263e093331c6428c2ee48bd11461ab3da263", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777022782, "uuid": "658292f7-0f4f-446d-a1ca-23f78aee5b96", "comment": "Malware payload (Mirai)", "value": "b5ea1bb1f4ce390784fa66d6ae6bde752ac5efff4c5b578c221cf349126d9b44d33e547ffebb8157e9fde303e31ba5cc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777022782, "uuid": "6d3a33b7-523c-4b50-9461-4ed889e3f11e", "value": "T19B4195E415E0B0B574F9FC052659597270E7A0A9BC892E9CBDB43434C9ECA88F0372CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777022782, "uuid": "e62cb23e-29ec-467e-b9b7-be45e5028e43", "value": "48:tTALcTvTFLlsATYLU7HT5LBA4TTaL1YRdTfLT2iT5LXRwFB:DtwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777022782, "uuid": "45bb1b1a-f488-44a7-998b-f189fe9bdaee", "value": 2428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777022782, "uuid": "1eed003a-cff4-434f-8b19-0f7ac3a5df05", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777022782, "uuid": "5421e788-8041-4006-b8a6-ebdaf475cc16", "value": "jewn.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa115ac4-3fd8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777033522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777033522, "uuid": "a48dde9e-88a6-46fe-8db1-711d9149da9e", "comment": "Malware payload", "value": "da7de898a2851bd7710d4de947c9fc38", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777033522, "uuid": "a834bcc0-556b-4bca-bd7b-070fc97b1ae9", "comment": "Malware payload", "value": "70a04d019e17240e5858fadbd4441c5bff643abfc5c449c43c1392799bf22309", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777033522, "uuid": "78bd0c1f-32e5-45c7-8755-26bd38cecc1c", "comment": "Malware payload", "value": "9ab8d398d8be27f2d6d91817c64051bde9b0f92c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777033522, "uuid": "ff27b4f4-4e2a-4c9c-9cfe-aefc630f9aba", "comment": "Malware payload", "value": "633ea428467df73d41e16a663de778dec0f11395c52879e88f72dff31b307008471c12ee5467fcc5b04a077a12f2d50c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777033522, "uuid": "98f980d5-dd1f-450a-afd9-9117dfab7a1a", "value": "T17BD023011245C61D090048071CD5A2CCF0E9045E1F0CFF618515885D03C7CCC7997681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777033522, "uuid": "e59c4561-a8cf-4bca-90fa-dcac31afaa01", "value": "6:hC47bxrBeLuVFOOr+DE1Bn23fXmSKOZG1Bn23fHNdhn:d5r+uVEOCDEf2OJ2Vdhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777033522, "uuid": "911934c5-56af-466a-8492-8cc9b89f223b", "value": 207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777033522, "uuid": "8585ef10-49bf-4724-a743-60d527a7bd41", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777033522, "uuid": "99547f66-82bc-485c-afe6-6bbacab20a89", "value": "QoF78O0VnmyQ.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eeffd5b-4033-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777072346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072346, "uuid": "6a11d73f-5e50-4d00-9fd5-12ff9b4b30b8", "comment": "Malware payload (Mirai)", "value": "0ec2031af6162d469a9102f30744b38e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072346, "uuid": "06c8ff3e-f018-4072-a0d4-9f3506d83b44", "comment": "Malware payload (Mirai)", "value": "70fffe870954340ed36a6992bff41c74c07286f3c512ca6fa8ac9c19fe4b051c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072346, "uuid": "8ef65972-24ed-4168-baef-fa70d9f8432c", "comment": "Malware payload (Mirai)", "value": "2ef4947716ad04f982f9c028ff237d4aa85139a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072346, "uuid": "c8ae1d85-9a11-420c-a287-09e926a3722d", "comment": "Malware payload (Mirai)", "value": "d3355cf2e4e1e51bbbd044374f16ceb1e3d59856e7a8fc39329847167cf3587eab29b2537fc6835c1b033096ecfc92f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072346, "uuid": "dd97a4cb-4aea-4f23-9357-1c66d2be4f65", "value": "T13C83F995BC818A11C5D413BAF92E018E331267ECE3DFB2139D205F647BCA92B0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072346, "uuid": "6810cf8d-0ef9-47b3-97cf-242da583541c", "value": "1536:qwnbgppr+uMTshDVC7CQmrVQ0Fbxw6P1SDhwc85mv/5XPacAIJiPTQhrGgQJc:YpeT7LGV7F9XPcSv6gchrGgQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777072346, "uuid": "c42e4fe7-10e4-4c14-bf81-a11d8210b0cc", "value": 87980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777072346, "uuid": "1f06d027-75c4-42fb-a09c-51a2709cf95a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072346, "uuid": "03c6a901-7380-4870-b547-bb291379ea80", "value": "jade.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd9915b-4033-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1777072425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072425, "uuid": "9c76b21b-26e6-479d-aa41-38ad3d763229", "comment": "Malware payload (Stealc)", "value": "1a130a9975c3f5ad8977a58fbfe06e18", "object_relation": "md5", "Tag": [ { "name": "83-217-208-25", "colour": "#D4EE02", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072425, "uuid": "fbe39578-3dba-4b58-b092-a23c96ba0c8d", "comment": "Malware payload (Stealc)", "value": "711199755fc55ac8185e64fe03bcc07aade1d449bd30e4bf7b898436d6eb3685", "object_relation": "sha256", "Tag": [ { "name": "83-217-208-25", "colour": "#D4EE02", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072425, "uuid": "4bb65853-50bb-44c9-88d9-ec8f30d20ca2", "comment": "Malware payload (Stealc)", "value": "ec1875f605e5856ab101bfbdb4bdbb29733fc366", "object_relation": "sha1", "Tag": [ { "name": "83-217-208-25", "colour": "#D4EE02", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072425, "uuid": "1fae1a64-5f9c-4e43-beab-7b74ba0dfb1b", "comment": "Malware payload (Stealc)", "value": "1189a1428da7c19cf334526a39599bf183c80092aac65554d396adff6eb3a0bb2b78464995058675c29d6a86eb788add", "object_relation": "sha3-384", "Tag": [ { "name": "83-217-208-25", "colour": "#D4EE02", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072425, "uuid": "38415b6f-4eaf-4e7a-87bf-7ec6d2f3819b", "value": "T1963548F850087458D0CAAB750740BB1DB474ACAD6BB00AB3DAB7FE65CB3EA83761D154", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072425, "uuid": "cff012dd-79e0-4455-8bd4-5b8fa8d29b97", "value": "24576:/CUYZcuL5nZWtds61LuD0Ax8M1Phrw5dJYP1T:/3YZcAItd1uHnP1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777072425, "uuid": "69323618-3963-48da-9bd0-fa8b1f689066", "value": 1128128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777072425, "uuid": "3b2fe630-408f-4822-894b-67a1b066c373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072425, "uuid": "24322f90-7b0f-40c0-a61c-e445efda1a33", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d4b354-4027-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777067368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067368, "uuid": "41161c83-ee80-41bc-87b7-571a1c550dbe", "comment": "Malware payload", "value": "5c27059f11a274ae9392c6c59c99d238", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "joerass-icu", "colour": "#819707", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067368, "uuid": "ece86025-0894-4dfc-8b32-b9c6ae27492b", "comment": "Malware payload", "value": "72b7b27fc9d3d590d41efcff44172d81915a30e2c3d19ec158010501f20bf8f5", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "joerass-icu", "colour": "#819707", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067368, "uuid": "63e0e593-a147-46ca-8516-dbd1b19bedd6", "comment": "Malware payload", "value": "7c4b8eeaef260ea12cc16ebebd6bc6168705bf24", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "joerass-icu", "colour": "#819707", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067368, "uuid": "add9a8e2-a7cc-438c-8d2c-8f8d8704a21d", "comment": "Malware payload", "value": "388a2f34426aa79f9aafd17a988653486e2459e0bdedebc877cad79ce81ceba12dc89e0ec4376b7926ae1b635eaa6f32", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "joerass-icu", "colour": "#819707", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067368, "uuid": "90a65dc8-022e-431b-835b-b29cf6fc6159", "value": "T1FB5733B9459043DBFBBFC933C1654A0A108C1CA4C567913DEAEB830D0E976DA2B4D6F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067368, "uuid": "827e978d-317f-42ad-a221-5f95f25edaf4", "value": "786432:H08oYWzqqrOHmDeNndQHh8uPdS7gC1oGWiLK6b:HbNorvaldmlc7gC1mA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777067368, "uuid": "5723482c-6619-4562-a9dd-a0ff48979d57", "value": 28137308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777067368, "uuid": "48bba9b1-480a-4500-a017-6d6a581105ce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067368, "uuid": "3abc2f61-b962-4a3e-b3a6-b69401ccf1cd", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be06aa0e-3fd3-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1777031408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031408, "uuid": "c8a6ba68-803f-497e-9084-943d9421af08", "comment": "Malware payload (VIPKeylogger)", "value": "8bcd3c044ab998de7c4414e27c7f2606", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031408, "uuid": "46813a33-4cbf-4e1c-b5f6-36e3fdeaa69d", "comment": "Malware payload (VIPKeylogger)", "value": "72f84baa1495278d7c162ef90d6428030db333aec673f5739d61907aa4cf1aed", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031408, "uuid": "d9bac180-4a55-44ba-9146-56bc1bc674f7", "comment": "Malware payload (VIPKeylogger)", "value": "2e038794a89f43528adcca3f0220ab535cfa4266", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031408, "uuid": "746077d6-7b36-495f-b7fe-cdcf50e8174a", "comment": "Malware payload (VIPKeylogger)", "value": "daecf85606ec84c1a0a8d19c56224007eb46733e497a492336e4dffc9c82cec65c896ed70d81c2354955b2f7c22cc991", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031408, "uuid": "d436eb9a-b06c-4729-aec6-edeeed86a2ca", "value": "T151041221BF8B57DB2F4016F52566F9EEE28CCA6042E5258BA59C4147FC1714282BF8CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031408, "uuid": "6b5f1562-1585-4cdd-aab8-d84358e288fe", "value": "3072:yiee5YnAnWzDMP4AmSJGHmzbGp/Q3qOzcNih0uSty8SR435SMise/t0P9qK:yi6NPM1qp/QacFh24NMise/t0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777031408, "uuid": "c6eafc61-2744-489b-9d9d-17fac270cb51", "value": 181024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777031408, "uuid": "866b2c18-1e49-460e-a9cd-9ac2f185f1c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031408, "uuid": "68c842b0-aae5-463f-a71c-80ad80d1f0b2", "value": "deep.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16f5910-3fe4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777038796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038796, "uuid": "79ca898d-930e-43ed-bc93-c7b9d62556ed", "comment": "Malware payload (Mirai)", "value": "c43b0ee82be0ff1ca39a445363163088", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038796, "uuid": "87f24140-974f-4df8-a8ce-01b20bbf537c", "comment": "Malware payload (Mirai)", "value": "731bb915a23f7418429e9badab8a959c4bdaf849dac4e06328f3f323250ae9cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038796, "uuid": "fc4826d9-aa14-4957-8539-e5d791390492", "comment": "Malware payload (Mirai)", "value": "5c45403962337665c471efc586c424d0eefcaae9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038796, "uuid": "d2d0e4fe-3dc8-44fd-a857-8758d42e5073", "comment": "Malware payload (Mirai)", "value": "bfab27f48e6c3e79c5eb0caa4f8efcd0ad4d5ed4053549ab81ce10180ddb65c2c834b2f0289460dd25c3c6b19d04bf5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038796, "uuid": "4ee0016e-e8a9-49aa-b547-01c19c718505", "value": "T1EB144A02771C0947E2A32EF0263F27E1C3EFA6E120F4F648694E97858675D365586ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038796, "uuid": "c7f69b63-3aa4-48e1-8b5a-3b7aea8147f4", "value": "3072:/BxImoCB5UyPsZm4Mvq0hPTZ4x4bjnX4I/xsYNcZTU9FenNFnnxffO24FlyC8+4V:/qU92tnx3O/FAf+wGyKAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777038796, "uuid": "63acf3a2-658f-4e8d-ba1f-63a92514c56c", "value": 207708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777038796, "uuid": "dfadc3c0-ceb3-4ada-9192-943f323abd54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038796, "uuid": "8f4a183a-4aba-4929-bc40-3d5cf884b3bb", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da61925-4032-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777071914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071914, "uuid": "4d57e044-74bc-4e08-abd6-6728dda61853", "comment": "Malware payload", "value": "88164f144bbeaf8b0a25a2fa4325338f", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071914, "uuid": "a9f13416-c4c0-457c-86b8-b0e10ab8a0af", "comment": "Malware payload", "value": "73b813ebe603da04908f10a08a5411aa0293798116c3d880a48a3a12f8905424", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071914, "uuid": "1e3a51ef-4e20-4d9a-9d66-46aaa617939a", "comment": "Malware payload", "value": "b7da0f3e94e8e6f3d915172afc866fc8e9a02e24", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071914, "uuid": "91ed027d-9802-414b-9531-977b5c6f9939", "comment": "Malware payload", "value": "a135149c94fc7dfc7e0be2caf738bc3603bfe9a4c486170bf01ce8401fc447e5b8fb5db9ea12cc6992f1e5bb34c736d9", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071914, "uuid": "f8fc7549-3cd7-4096-a1aa-0c371ea933eb", "value": "T1961423C40327FE2789FCE22971DFC836FA654EA5407B14DA685C51622C2C71E8ADE93C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071914, "uuid": "4ec4d72f-8cba-4f02-bd3a-9fe358bd7584", "value": "6144:oO2x3drr6jWjmXeU6eIYncsFzJpYcZrtfMYg:o11Fr6jMAyeIYnxFzJaKrt0Yg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777071914, "uuid": "8d435cd4-d9b3-4cf3-837f-01c48c0cc429", "value": 202764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777071914, "uuid": "37fc87fe-eabf-4a91-a8bf-c585066cb667", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071914, "uuid": "46e21d0d-6c9f-447a-9248-383a33c04b36", "value": "Powder.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee176e53-3f85-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776997988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997988, "uuid": "c399db58-4a18-438e-8ae8-0597965fbfe9", "comment": "Malware payload (PhantomStealer)", "value": "5c8b3e699b72965ce4f7b4445602ceb2", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997988, "uuid": "276aea62-4464-4af8-b113-2751cf7f395d", "comment": "Malware payload (PhantomStealer)", "value": "743c07deb311553d2c40627242b0cf0fa0382f2018b353b24577d0749f3a7ca9", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997988, "uuid": "5f5776e9-2d1a-4d89-a9cd-d8df1e781e3f", "comment": "Malware payload (PhantomStealer)", "value": "bfa71684c5327bb658cff239826306277873d75d", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997988, "uuid": "9ada9f17-b324-42ec-a12b-0bf7df161425", "comment": "Malware payload (PhantomStealer)", "value": "4df84669b5f6b97f9f98837387511a6f72851ae7a5279058f9ea2697a855d8aa2b1b7504e2cf0c204c0870752ecd5e6a", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997988, "uuid": "35a89a19-7081-4a9e-a7c6-fa979fb03e7b", "value": "T1090523C3D8C47EED00D9AB79A07A7B1D61E2C398744EF84382C85C623856F578267DA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997988, "uuid": "a869ec80-c952-479d-963c-a0dfe269dca3", "value": "24576:mLc3FwvT9/61Lt/kR7YiLLNnQjmeVxB9gNbC2H:/F69/QLewub/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776997988, "uuid": "1f3bf727-7ab2-4f46-a495-f5185486cfb0", "value": 858571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776997988, "uuid": "e2e78540-6c91-4d27-add4-180641394c53", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997988, "uuid": "2e5f5a3a-60d2-424d-ae38-65f8cfee667e", "value": "String.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fffd8f9d-3f9d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777008326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008326, "uuid": "635f99fe-79ad-4974-ba67-535b2841412f", "comment": "Malware payload", "value": "879d9a764222a29a2ef22a3d192c1fff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008326, "uuid": "a5a68482-3a13-43fe-8260-d32e4a29e60f", "comment": "Malware payload", "value": "746b63d7d497335446f403be81473867218d84e3d115962b92f51a76a80a85f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008326, "uuid": "013d3c95-a973-49b0-93cb-e90031c7e915", "comment": "Malware payload", "value": "d1fae4337b98db48fd6677c59fba68ce5c5b3e5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008326, "uuid": "33d79f8a-c901-4f5a-90ed-b3b134bb540b", "comment": "Malware payload", "value": "3090233147b52b8c0abfdd74aa4a15f77287309dc10c2a529dfeec373eb838ab2a1d968cda8e90c110aad4e356aa4d36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008326, "uuid": "4027db40-23be-4e99-a71f-567269e16a48", "value": "T12F34BE73A4BCAAAFDDD82F379C4E880713B66FE5D890603E1C44710EFE1A5085E7A516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008326, "uuid": "d93f64c7-6506-4904-bede-d2aa4175ec57", "value": "899ad1596f9c6642245b3fb721bae585", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008326, "uuid": "b9c8e27f-c1dc-428a-a04c-fad4ad05a1e2", "value": "6144:2GxCfPf0s3KPHfBxR8jPs1F1yD9jvryfL9SqXVdOg:2G60BpL8jk1FGjDc8GVdOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777008326, "uuid": "97f30ea6-7151-455d-a9b3-d8374dec4268", "value": 246135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777008326, "uuid": "1cce2428-4c68-4285-8242-cc20f65db9fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008326, "uuid": "b936fd2e-f7dc-43b5-83c6-09e480a1aa0b", "value": "746b63d7d497335446f403be81473867218d84e3d115962b92f51a76a80a85f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496786b3-3fc9-11f1-a769-42010a9c0008", "comment": "Malware payload (VShell)", "timestamp": 1777026917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777026917, "uuid": "4411b6fc-ff81-4823-9c00-4fd3c5d52099", "comment": "Malware payload (VShell)", "value": "285c19addd1e4ac77ac91ebbdea8a8c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777026917, "uuid": "2bdf27b8-7f91-4ec4-adea-d1e0b254e13c", "comment": "Malware payload (VShell)", "value": "7512fc6f33eeed3cdca6d046cbdfcb4a072d43a3c421ecc031b58cd06849561e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777026917, "uuid": "32ea1b7f-d558-419f-b0cb-75ff965b812a", "comment": "Malware payload (VShell)", "value": "db40a3247fe2266334c84199003d4437d1a0ad09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777026917, "uuid": "ab56b4be-7114-41d4-bfe2-a938cd2b8956", "comment": "Malware payload (VShell)", "value": "52560df1b87c08a7512468dec13bd783351c12bef5cf090c686b02a371bc04bfb5f5973a2f536f832a5aecb8ff909e01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777026917, "uuid": "93dc6751-0f72-4677-bb54-5ef8bc986f5b", "value": "T153863917ECA545F8C0AED1348A729663BA717C884B3027D73B50F7282F76BD0AA79714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777026917, "uuid": "02c06d50-1591-4ff1-9a0c-d3e287e9e693", "value": "98304:8+YepTx+m+kT807z6QM7Zc1Emd7h4eCbY:5pTcmjT8o8AF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777026917, "uuid": "73374366-3a93-4f45-a441-184c68c519f3", "value": 8089600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777026917, "uuid": "66483e88-d597-46fc-addb-01c8c11e9da9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777026917, "uuid": "7ab72b65-e2f3-4d59-8890-4d19f41b9d04", "value": "memfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4fcf378-3ff6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777046425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777046425, "uuid": "ffd4ebe2-497e-482a-a9fb-30661db9c485", "comment": "Malware payload", "value": "97822cdc8f3dbed2c0cf6d848d0a9fe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777046425, "uuid": "dda57cc4-6d02-4a12-8df0-33687894a11b", "comment": "Malware payload", "value": "7705a9dc869e70ef5b9790b26c03558e79add5327de0b52e44308196fc312e24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777046425, "uuid": "ce14ffd7-0200-4f59-a764-c32e88a0f3ef", "comment": "Malware payload", "value": "b729bf0444dd2b205d4cd5ec79706bf9fe8d5760", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777046425, "uuid": "18a26203-9e8c-4aab-8528-7197c45f7600", "comment": "Malware payload", "value": "aeaf927184335b873727fbabac31b06a69954e20f92fc5ba5cc2ad7811504e92d3088a06f3cc4f70e6e6f7231812afd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777046425, "uuid": "5a1e3ed9-dcfe-4116-a7c2-ac4e872a72f5", "value": "T1C004B40222A10098F3564774A676E991C765BCB807A0E7DFD234BA391F722935E7732F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777046425, "uuid": "dc4c8809-cd1f-4342-bd22-69a87b5d9cad", "value": "095755983554d7d86ae8014c857865ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777046425, "uuid": "1a86651c-9cc6-4ecb-a956-89b91803a21e", "value": "3072:OoltDLHp+Gyn8OFUP8p+ZsHpO5b+ENbnADEEvdgXp6srt:Ool9Nztc+8NH85b7ivdgXpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777046425, "uuid": "e56a90a5-a6dc-4784-81bd-5232117f56fa", "value": 177728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777046425, "uuid": "1150ddf4-c1f3-44cd-af82-3a718cf2f3c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777046425, "uuid": "4f0648a6-f202-488e-b109-fe98796fd179", "value": "z59FedexShippingDocument_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440a9d3e-3ffd-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1777049242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777049242, "uuid": "c0f19e2f-47aa-4a43-bae2-2425f2f2a674", "comment": "Malware payload (RatonRAT)", "value": "cc8f831733f39631bee4f7646516c019", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777049242, "uuid": "55271e57-1790-4246-b687-5b8a1a6bd096", "comment": "Malware payload (RatonRAT)", "value": "782f3fe871b7ba7150232151b488ae8ee347b82d8b7d02efeb949cf86d3007ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777049242, "uuid": "13e5914d-1be7-4225-b4cf-9dd59e6e23ba", "comment": "Malware payload (RatonRAT)", "value": "35891186c6e22b022ffc742a5523d0ab192ad47a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777049242, "uuid": "679387a6-5c57-4f22-b0d2-a6bca173e6dc", "comment": "Malware payload (RatonRAT)", "value": "5a5f70186f9f0aaab543b00ddd76fa023f1ab2e98348fa7609b043859b4f59ecf399d10adf5de6de9cd097759bfaadf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777049242, "uuid": "897d18c3-aedc-42dd-b4bb-0f781de22f9b", "value": "T1D6D5121C33FACB18F2AF4BB4A87185664371FD179D62D76C589139AE04B6F48BA10B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777049242, "uuid": "d18f01e1-47ac-4157-bcd6-372d2ca8f3f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777049242, "uuid": "6d76a99f-6877-40ef-b513-41b958c94cce", "value": "49152:NgVUlsHjkmiGWU5FLGpMZ7iKPJ5W1tsclR0BxMzaRw4C6Wp:NgVUuHjkDGjzqpgmwQ1GuRxzew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777049242, "uuid": "57d5589a-1086-4e60-9647-945be306f383", "value": 2945536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777049242, "uuid": "11445b34-91b3-4d7f-b4d9-f447b77b63bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777049242, "uuid": "fdb96a7f-d3e3-4d25-969a-1db8510419c9", "value": "PotasiumInstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb89e12-400e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777056481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777056481, "uuid": "ca4bceb3-e111-4ed8-a9dc-208201a971bd", "comment": "Malware payload", "value": "d37cc44db90a65341263deb162024447", "object_relation": "md5", "Tag": [ { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777056481, "uuid": "37df7e20-8e2f-4107-bac3-dad696df3ce0", "comment": "Malware payload", "value": "79f7b67ce8b39070f3e1c2b90fce0ce84134782a7dedcccc1edac197ee9e089b", "object_relation": "sha256", "Tag": [ { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777056481, "uuid": "fed428f3-cfd9-4f5c-b1ef-920e30ef454d", "comment": "Malware payload", "value": "4537b37b65e9dc35640d750f3fa7f4944534f6b1", "object_relation": "sha1", "Tag": [ { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777056481, "uuid": "c04179dd-4c7f-47b2-b8d3-a10cc87a8b07", "comment": "Malware payload", "value": "8b031ab88e1f8794dfff79403f38376e341afc67848e75a55b13ef753788f27a168bb6bfd5ee3bc78375c7cc2476f1f6", "object_relation": "sha3-384", "Tag": [ { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777056481, "uuid": "673faef0-1d5e-4e6d-b6f7-d27011a931a8", "value": "T11F759C957301A027DD970C32AE57C7A81B2CFD94BAA4749763B0F70F2A389D35EA6305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777056481, "uuid": "4c71c801-73ad-4f02-b7e1-7d38dc812495", "value": "12288:Ac0qmT/guoTF4jgMkOERD3O6RRtM0D22/Fguq:Ac0qmT/poZ4jgMKd9RO4xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777056481, "uuid": "bc2a2237-b59d-4167-aa87-14a02dba09b9", "value": 1552384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777056481, "uuid": "685f6d83-0659-4563-9534-fc185353a9cc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777056481, "uuid": "b55140b2-33cf-47c0-9227-89d12a8d1860", "value": "inst24.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b517a2e-3f82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776996399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996399, "uuid": "9a776462-6e4f-49f4-9eff-bb4cf0678514", "comment": "Malware payload", "value": "a0eb510fc8e59804cf5929656a51612f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996399, "uuid": "a1f975c8-5829-4197-b780-a00ad6a67b11", "comment": "Malware payload", "value": "7b6bda86872fc43e4f31965f85ce34977eecfff3d30eeaf58c6427fd6ffb4357", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996399, "uuid": "87e59b6e-686c-46d1-a54e-a87358cec4eb", "comment": "Malware payload", "value": "c76982e4812cfcdeef944c9d7205374da98b9b6a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996399, "uuid": "b9df81eb-42c5-4be4-9f81-e21af155b23c", "comment": "Malware payload", "value": "4902c50c3cffbef8b23e6dec06280602f4cfc78c60df4c71a6f73c93d791bfaae20743ca03978bcf6deeeb7b02fbe329", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996399, "uuid": "176b6e4c-0c66-43c9-884a-20a3a130a4b7", "value": "T15AC08016917EC50EE567A4D30573550985A0EB4125389A318B40988C71515906306042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996399, "uuid": "c0daf0ce-5838-407c-a69d-2b8fb8587353", "value": "3:j+qAHmFEm8nhcDQBfBJpoNIkVViEaKC5SufyM1KvN+XsnHhXpv:j+q9NqhnfBboNBnaZ5SuH1mQXsnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776996399, "uuid": "bbb4971a-6ded-4891-a6eb-05c7df1d0dd4", "value": 159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776996399, "uuid": "2139df29-880b-4619-85be-1c3bf11cc315", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996399, "uuid": "03da28dd-3da9-4926-aa8d-c9542824d6d4", "value": "SOMEONE.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5dbd42-4027-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777067407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067407, "uuid": "e23aa2b6-35a6-4058-8a15-5b3fe2afcdec", "comment": "Malware payload", "value": "4d005095a0372cf7150730e7e9d3e3ee", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "joerass-icu", "colour": "#819707", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067407, "uuid": "c5f533b4-36d2-405a-9047-47faec934eed", "comment": "Malware payload", "value": "7b8d8fd3d647bad9c02f7552a5ce4069f2d352086e575e1768ddb8cafc868de0", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "joerass-icu", "colour": "#819707", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067407, "uuid": "e090b62a-5ea3-4c2c-9924-7f8f6a09ddd2", "comment": "Malware payload", "value": "f0202c52869294f0d11887813440cbad31e3b1c2", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "joerass-icu", "colour": "#819707", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067407, "uuid": "09c4a7d6-d49f-4f26-8945-58bea5dcbc13", "comment": "Malware payload", "value": "ab8089d3973270ba1be1ba5e9aecb08c77691d7999072f1a06caf6781b680f40d7be9201fae8f66f922e177d7e9ec400", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "joerass-icu", "colour": "#819707", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067407, "uuid": "b55b78aa-16b6-4182-b8f1-43a678271aa9", "value": "T1A7A6CF30F6862065E8F7117AD2AB9B3BC672BC009725DAC794C874D94E33BD306BA355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067407, "uuid": "31673e89-2d20-4992-93da-6ec20609d9de", "value": "c49f80bef2f8e5f01bd6fb4a77ecf582", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067407, "uuid": "db72e1f3-6b5d-4e69-848f-d5c2f1dac764", "value": "196608:OOghB0ncVGTZpew4yerzDPwSCmlQv7eCgs3y0:0hqco3wCgiy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777067407, "uuid": "b007ca15-9c15-40aa-9df3-5ab923a9f32e", "value": 10294272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777067407, "uuid": "09eb662a-6d90-4c6e-a0f9-37700c154c8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067407, "uuid": "fd8715ea-a840-492c-83f0-1955a4eb21bb", "value": "python35.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1d621d-3fc8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777026442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777026442, "uuid": "8b34a687-e63f-4b58-8ea3-4253294fb43a", "comment": "Malware payload (Mirai)", "value": "a83c4c9b72d30bbca9bbab2c3f4053e6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777026442, "uuid": "3318afee-4ffa-4e48-aa7f-d2ca743e770b", "comment": "Malware payload (Mirai)", "value": "7dc4c34e87602d457938b29fd7963e01023423e33fd1ac3aba1f7c839b900848", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777026442, "uuid": "2c42b05f-8a89-48ec-88cc-70fbb29b771b", "comment": "Malware payload (Mirai)", "value": "a285f72b56f4917606cf020c2c94f984da9a7e35", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777026442, "uuid": "e4796318-ab6a-4869-acb5-bf20eb1aa267", "comment": "Malware payload (Mirai)", "value": "be0607985559f9910756d72ac3c1be141718b8c53b45c23dfc398d9f3a425d7f701555f4730d9629d81cc2bc2048724e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777026442, "uuid": "89589b9d-cd52-4136-8d56-c8646ca640fe", "value": "T11D515EC461A11272A8BD996273E9824431FCB4D799EE3E48BDD8B8F482CFF04A051F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777026442, "uuid": "b875242b-b75d-4a5a-a02e-f6bf93c57a59", "value": "48:iphX3pz4E3pEqE3pQx3pcdc03pE53pKOF3pjnvP3pcB3p1x3pWR3poR3p053p/9R:ij9SaCeqG7B6twiu7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777026442, "uuid": "ccdaf72b-9544-4d85-9f99-ac5f6b73d57e", "value": 2884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777026442, "uuid": "827cf907-c5e6-4077-94e8-4656c8bbbf5c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777026442, "uuid": "4edf63e6-5132-4fcc-9b7a-a1c5ccb352f0", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360b21fb-3fe5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777038911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038911, "uuid": "194cf5a2-77df-4c3c-8bb1-f2c588912cd2", "comment": "Malware payload (Mirai)", "value": "a86f430d81e3271296c5c16536b704bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038911, "uuid": "6b6ca29d-7fcf-4cd6-adff-fb9eed953e31", "comment": "Malware payload (Mirai)", "value": "81196c4f41f2b44a7fbff72838a468b638489472ab53d87d7c64d2d286360663", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038911, "uuid": "e015272b-688b-40ae-9fd8-1e7ae6ae21da", "comment": "Malware payload (Mirai)", "value": "632584f026cb41b379d1aef596fb7764956ae1fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038911, "uuid": "3e299aa8-5aba-4ec3-9dcf-2ab30462aa1e", "comment": "Malware payload (Mirai)", "value": "1bb882f729f8df0d470dead1bfdf1613d8c35367bfe753f18c8b4e8d887dcfeaba12670040ac3ccdc4f72e6439770194", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038911, "uuid": "41ce4a7c-55b9-4891-a535-6bc51a945397", "value": "T169E35CC5F247D0F6E8160474213BFB364A72E536112EED83D7B8A972BC61A42C92779C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038911, "uuid": "dbb81082-bbc1-457d-a8d1-045295f2458f", "value": "3072:7bvW8fyeUzg8ySDVS+oChlzWcKhHzo8Kpns8WJD4GYh+OUnKMPa0szW:7bDfyDzgDMVxo0zWThHzo8KpsR4vpUKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777038911, "uuid": "55b57506-0d48-4865-bc3a-c424981b39a1", "value": 156008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777038911, "uuid": "ba8bbd37-2036-41bd-a7b2-68faca268962", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038911, "uuid": "b71e316d-80cf-4b20-8890-ce9d12c6ead8", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c380bd4c-4004-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777052462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052462, "uuid": "ad2eab6f-1b3a-416b-a11e-150b80df9e5a", "comment": "Malware payload", "value": "0434f5effa48827f55d8fd0a11f8809d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052462, "uuid": "8137429c-d113-40ed-a075-d99199e1e509", "comment": "Malware payload", "value": "83dc2b63e0b878a433f349f77d131c1e40f033a2a218df05c5c68bd3964fe636", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052462, "uuid": "1cbff148-ce49-43d4-9e26-fdd37f4a8383", "comment": "Malware payload", "value": "832391cbff25e1ffafb9a8baf54f6e07c031245b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052462, "uuid": "6ac07400-910a-4733-bfb8-9dc06fe634c2", "comment": "Malware payload", "value": "933e4f89ff611b9a93cd662c810ae927b1ec8fc375d4dd8b73d387080dd57762501e4cea600fa2a7341fde7de751670e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052462, "uuid": "3352b917-d59d-470c-9dfe-1e30d73086fe", "value": "T1AEA4137D8DE59D49FC233C3692989731C6D7D067DE93C723C83801A74287A9D9B8872A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052462, "uuid": "91773605-c3f2-4ab4-87e5-b730a07c75fb", "value": "12288:UEWY4z+/dyf2r0C9fZOAAZrA/U5bOGS6WW:UEWY++lyf25fAyU56G/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052462, "uuid": "18597a23-d358-4f5d-aa25-c7378ed7fb81", "value": 453615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052462, "uuid": "cd571bc3-b7ba-443a-90ec-024f7138f2ed", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052462, "uuid": "94c1d776-0327-4026-8dc3-b5dc90be0a28", "value": "RE_4359302492492.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca9481c-3fc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777024909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024909, "uuid": "814e755a-0499-4c45-a294-b3d50720f1e4", "comment": "Malware payload (Mirai)", "value": "a399b900de4dd06be514de800af86b5a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024909, "uuid": "6790d5a8-c56d-4758-8905-138415dbccef", "comment": "Malware payload (Mirai)", "value": "8458d642615c21e07b61b63a09000e34981eb634ea3f4359f717c5619154b3fd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024909, "uuid": "2637ead3-8cab-4f8e-9fd3-91c1e30c1938", "comment": "Malware payload (Mirai)", "value": "77d98e9bc80ead5002d92b65cce3a4627c962b7a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024909, "uuid": "76e72b9e-a3a5-4847-8236-0b4ed5a5ee58", "comment": "Malware payload (Mirai)", "value": "684f61a80921438ad6eff9aeef5070358c44e3f75782e59cb0a0b6c3572d4219f094f1027da167046f1b4111ec90b1e9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024909, "uuid": "d0dba064-97c5-4a50-903c-2462354de2ed", "value": "T169D32A06730C0A47D1632EB03A3F67E197AF9AC121E4FA40355FAB8A95B1E335586DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024909, "uuid": "df010c05-0e5d-4f70-a02c-8ee7ffccb929", "value": "1536:NroGHNTUZN5QIBUiCxfytWtew8zGXavwoo7lrkJvAhh3rp+puQfqwDn7tN:XmJUiCxdt67wp7l7hreJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024909, "uuid": "f63f0c34-4b42-4839-9a32-b861d56fbb86", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024909, "uuid": "2ecfc2d0-00ee-4211-adef-92a6f77333bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024909, "uuid": "2a29f48f-a8ea-416d-a9e4-4dc8eda63b06", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db47fbc1-3f91-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1777003110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777003110, "uuid": "2cc67609-a318-4c21-9e75-0c0a82aeba94", "comment": "Malware payload (GuLoader)", "value": "e57857f0495cd18f072eec32a0d8040c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777003110, "uuid": "08074e90-0efe-4d27-9a14-e2335f7eaabf", "comment": "Malware payload (GuLoader)", "value": "84e88a5a4e2da29b3870aac7cc9ad57c8de86c59564b63217a78989642422a67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777003110, "uuid": "40b18d3d-9803-477f-9a56-fdec445dd35d", "comment": "Malware payload (GuLoader)", "value": "91873580090293973a125299e5f92bf0a0aa1ceb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777003110, "uuid": "59da5589-8ae4-48fe-a423-5c98e97ecf27", "comment": "Malware payload (GuLoader)", "value": "2109f6d3aae4bc759f93912093ceaccb3263b1101d875c011e397592913ee740df67e69408dca9dec3991bf896989377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777003110, "uuid": "53829a96-0562-4a21-a261-4f0dd9f0e2a5", "value": "T14EF4D086B53C33E8D3A45E3F50826546CA1B3C775B05A5A29284B73A07715B3FB23E36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777003110, "uuid": "9b059ad2-e080-4220-b1c9-0375c903f419", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777003110, "uuid": "a5cfe757-9f7c-4045-8842-3f875d5e9063", "value": "12288:OTAwG5oepSXhv7UiJO1pjNFJ950Q/z+KypZDQjOCZn9Jji/viJ9OI8SlemFBLeDq:OTAwG5Sxy50w+vXDrqJ9FvemfLe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777003110, "uuid": "715069d1-01e4-4781-826d-a5d677337545", "value": 765498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777003110, "uuid": "c4a3b04c-0171-49b6-914a-613c1b421709", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777003110, "uuid": "3912e4b4-4c8f-4221-9f2f-db1d8b750af4", "value": "TranEuropeasia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9173b0bb-3f7e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776994826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994826, "uuid": "ef810e0b-a874-42c1-834b-98db30e47dcc", "comment": "Malware payload", "value": "f8a0e128ba932371edf8f85a993582a9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994826, "uuid": "656d81cf-1084-4ffe-8f5e-1cf5e3b76e33", "comment": "Malware payload", "value": "850f8d0c433c88e430417fb5ef8b4af2b0c8f9eabbcd0e7346fe960911d36a49", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994826, "uuid": "3011c3b8-0403-4234-9102-e27f7d495918", "comment": "Malware payload", "value": "07113a9cdb6632409335e13c3993bfc0e4a6f6b3", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994826, "uuid": "2c5c8852-ef32-4631-a1d3-f843d1e66b0c", "comment": "Malware payload", "value": "0685be5bcf74d0b54d9a79da71809ec4cf06f463d11cc5023b508b87dde87b3f76ff682163183d3aa8bf3591d95f25d0", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776994826, "uuid": "56c870af-d875-4b33-a230-bda158cddb3e", "value": "T150C08026917EC50EA567A0920572950845A0EB412538AA329F409C88B1515906246052", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776994826, "uuid": "4609b05b-709d-4c52-980b-02def8778c4c", "value": "3:j+qAHmFEm8nhcDQBfBJpoNIkVViEaKC5SufyM1KvN+tJK8HhXpv:j+q9NqhnfBboNBnaZ5SuH1mQ7K8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776994826, "uuid": "f2db0e38-59ea-40ee-a10e-54eba9a18195", "value": 161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776994826, "uuid": "ef2b40b2-b05f-4e3d-9823-51a2a85b8518", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776994826, "uuid": "27f5940e-9812-4168-ad61-1fe384ed73bc", "value": "star.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bdb7fd6-3fae-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777015244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015244, "uuid": "273782c7-7c10-4bc1-bc18-0a9c5ab5c7e9", "comment": "Malware payload (AgentTesla)", "value": "db1e3e5e1e847f9b9230a08f033fc2ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015244, "uuid": "e38ee7cd-b1a3-4ad6-bd71-92ff3481bddd", "comment": "Malware payload (AgentTesla)", "value": "8855b843d5fec43399864444d700f3d4d4ff0a69434463f4510a2e5da5709df4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015244, "uuid": "c5848788-24e1-4cac-9d3a-c85b860f9bb7", "comment": "Malware payload (AgentTesla)", "value": "484e5c6d25a6c3ba51d0565fa406778785d1a23e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015244, "uuid": "6b5a9a38-2416-40dd-a4ff-03eb742817bd", "comment": "Malware payload (AgentTesla)", "value": "c844efb40939a61e72d8e5d21181fcf1557898cbe49feef663d0038830471776e2ff38d3e6f9512a4c1b121698d263a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015244, "uuid": "8451658f-d96a-4d58-8417-3a3a129b6cec", "value": "T149B401A0E590CEA6D00E45B388ADD47254B66F1DC835442F6256FA1DFBB3383423EE5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015244, "uuid": "b9b6feb3-b63c-4bd3-9ee0-b574a1ebea0e", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015244, "uuid": "1a474f78-a1e4-4c24-b8a5-5c097bca241f", "value": "6144:nbfopymnbPxHXAf24w+csvyMxxd0YebSx7umTCqnYTM9R9BimU4dU3wedPz18yA+:nb4nb9Af24wWPxj0iveGhU42gedPGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777015244, "uuid": "01d6d9fb-3d3b-4d37-9c23-cfd7efdf3112", "value": 501363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777015244, "uuid": "f6c98a11-23b9-4aea-907d-abf662818a67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015244, "uuid": "29474926-d432-444a-b3f2-1686229e2706", "value": "order9596979797997.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d0455c-401a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777061692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061692, "uuid": "c81f9af3-0178-45ff-abde-d160ec78de5f", "comment": "Malware payload", "value": "333f269d081596ddbd44bc0e0a97df8c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061692, "uuid": "d60f50c5-a6b4-4cdc-93c3-01e5bbac2498", "comment": "Malware payload", "value": "886373754c3cc3bc232e994116c8e0efebc3d67ee5c98feca36bb5df71a5c1da", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061692, "uuid": "a3202e23-44ad-4288-82a0-fa143f99bc40", "comment": "Malware payload", "value": "a3de9532ca4e853dd158dd3e505301b7fd6a8a71", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061692, "uuid": "56945e72-ef8c-450e-a533-974175ce0ca0", "comment": "Malware payload", "value": "91c1155d1f10126b83652717ca5ebf86f4aeceac0c7c5f06c414e94151f9d349d91a3b1c35cc39ad7eebcfa865abfe54", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061692, "uuid": "4222543b-84c1-4547-b9ff-7c6b8b9375e6", "value": "T12834C34D5CF722215263B2B98B2FA40A3175E5032A0EDE147F5C93916F8863C96F6BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061692, "uuid": "0eaabb18-aa43-42aa-9cf5-a5b8e522ba62", "value": "6144:RE63mQZJwE4bkCo+vtrHLqrPRghQiKWoN:RE6+vtrHLqrPRghtKWoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777061692, "uuid": "19ac8f39-846d-49fa-84fc-f5de1413b190", "value": 249523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777061692, "uuid": "4f6ddcaa-b3bd-40b8-ad33-6c655758c1d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061692, "uuid": "0bdcfb1a-ed6d-477a-9411-65135fef17ca", "value": "153_bjv_win32.dec.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84de8c13-3fc5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777025299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025299, "uuid": "6be996d7-4f73-4f6a-b3a5-2befc6b896c8", "comment": "Malware payload (Mirai)", "value": "1014baee9a9e790f732c3a95f36700eb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025299, "uuid": "2dba4ebb-0d02-430b-a371-e56af5a16f6b", "comment": "Malware payload (Mirai)", "value": "89486e00bd1a44ff5e38255105b907a0c3e698fb4b10deea9ecb9b23c28f0512", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025299, "uuid": "7dbabcd0-a82e-4c48-a92b-5b9a5851a51f", "comment": "Malware payload (Mirai)", "value": "b4cef33303f60a09dd685289b0f9bb4e4e559596", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025299, "uuid": "eda2193e-a40b-458c-8499-c8a4a3a49714", "comment": "Malware payload (Mirai)", "value": "00336a8d4c43ab6cda104eb978d5b9daaef5c6fedc66de9d05fb7522ef52dbb439f83487ae3fce4500661d0192393a22", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025299, "uuid": "f848b991-4318-4211-98d9-d19425ba0c78", "value": "T137E34A55B8828A22C9D513BEF92D018E331327A8E2DF7213DD205F2577C7A6B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025299, "uuid": "67a79b5e-e052-462b-bd1a-2f867e228934", "value": "3072:ENUkePbhroLLyLbPDADuOu1sya89LjPEKe2+IOkp:weRoLLynPD2u6yawpe2Akp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777025299, "uuid": "470d5460-af0b-44c2-9516-76cf41e76902", "value": 145544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777025299, "uuid": "3e6177ad-1d96-4171-befe-7846b1377282", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025299, "uuid": "d0e8cad0-d64e-450f-95a5-a1a572574260", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c92b40fa-3fdd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777035722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035722, "uuid": "e4c24189-836f-4959-bcec-7050a711a934", "comment": "Malware payload", "value": "9b10e27607032524565d66d1050385b5", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035722, "uuid": "4c326da8-54e3-48e7-ae28-a59ecae0079f", "comment": "Malware payload", "value": "894e0c11f59eef69877f17ec6b36cd603313b353cf38bb15f8abb77a5f5f7f08", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035722, "uuid": "2b5d2e09-f6e8-4a24-8c4b-3bdea154be68", "comment": "Malware payload", "value": "6a064cd3f2dcb0a4c0180fa9c237bae1ac9cd6e2", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035722, "uuid": "c70973e9-b89a-434c-bb60-a566aa4c9e4a", "comment": "Malware payload", "value": "a201c09c995a37abda116e8354fdf0577e7efd5e42500ed680d6cb5337dfdbd39de7dca84e6dd7675eb7a10e4eb98ce8", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777035722, "uuid": "e618dfc8-5548-40ae-ab4d-ed451f5b0f14", "value": "T1CD92C7166AB300226953C0BC67A79746333180079645CE6A3FAC5294DFCAEE5ADF37DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777035722, "uuid": "f31c0863-e4c4-470b-9408-d7d27f1648a6", "value": "384:X4FTAsXe7FUFh/+4MAaksb7RMsa7bWkkg1k4iPiliri/iIk4i7aiyKi8iJiyILnL:Xe8sXe7FUFY3msafWkkg1kVKUO6IkV7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777035722, "uuid": "76906887-f7f8-4fa6-9de2-af2f5685a173", "value": 20092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777035722, "uuid": "c53e1701-66db-4ec0-8a5a-2a45ef64ece8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777035722, "uuid": "b5fc3e13-aba9-4873-bbc6-f25aea1e87fe", "value": "894e0c11f59eef69877f17ec6b36cd603313b353cf38bb15f8abb77a5f5f7f08.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54aba975-4035-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1777073322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073322, "uuid": "3bfab2ce-383f-4bf4-95db-1bd533b61351", "comment": "Malware payload (Gh0stRAT)", "value": "0f4c66d87453c4d418980653f33285ee", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "gcsoon-com", "colour": "#335CBD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073322, "uuid": "77dc784c-655c-47ff-ac83-e49db94a3df6", "comment": "Malware payload (Gh0stRAT)", "value": "8a5a34baefe07e19269ee67303b9518afb80f1b3595479deeeee7e542c3edb26", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "gcsoon-com", "colour": "#335CBD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073322, "uuid": "54301b0f-2f97-47e8-8a52-97ea0894291c", "comment": "Malware payload (Gh0stRAT)", "value": "7c792ab27fe0d68a03c26652b9d9be0e471905f5", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "gcsoon-com", "colour": "#335CBD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073322, "uuid": "38c88578-39bd-46c0-8182-5e193e8d8187", "comment": "Malware payload (Gh0stRAT)", "value": "01e1095158e02fb14fd83cfd2e67c1e657cace6ad509b216e9e68c2a035458f41371ae89c22481b323e869d3c0d566b9", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "gcsoon-com", "colour": "#335CBD", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073322, "uuid": "b1c14817-8346-4f61-9041-5ab828e0f30e", "value": "T13D472320759EC236F66F01B19A29DA2AE57D7DE20B7004EB93E4F9596B300C25335F93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073322, "uuid": "bb1959f8-3e0e-496c-b2f9-3836b4e5da47", "value": "393216:88yd2t9zrtt8dEQQ5SfNkwmoRNZekROSqTb7XPdXjIwSFzyVaIDjoYneYBbYzDnB:8xsBSdEQGWNZmuN5RQH7Xt0wSFzpIDjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777073322, "uuid": "4a7cb226-12a5-47d5-a363-4741d161a0dc", "value": 24663040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777073322, "uuid": "cb80a744-d55c-4735-a753-b38290029ac5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073322, "uuid": "925ceee3-fee2-4b22-a10b-795bb8632131", "value": "MSTseg-Teuier-x6.3.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68db051-4031-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777071849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071849, "uuid": "9c275f81-f9d0-4f6b-8cec-fb2f306ebd32", "comment": "Malware payload", "value": "3b75383b639e825410b8b8fdc51161e7", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071849, "uuid": "d4c7f25a-b271-484e-8426-ae1803c6f10d", "comment": "Malware payload", "value": "8a999c3ff175f5de85b7af07af8f9c799a90a55c283d4b47f17d1bd1bba28a87", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071849, "uuid": "ff33c9a8-57ff-422c-9592-f1092f3c6aa7", "comment": "Malware payload", "value": "96a10079dc09ef8efc3dd32b3d26f69d09f4cafa", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071849, "uuid": "6858a108-b169-46c4-b7e0-a6e36069a6a3", "comment": "Malware payload", "value": "240fc3591bd7cae1a58f9dc9d4ed28a856124b76dbd9ac57d900f892406a69094aead732b13325e03c47ac1e73e7fceb", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071849, "uuid": "a02c9a11-6fed-434f-a9a1-d038b3113587", "value": "T12B2523204FEFBFEE04785368A47F6F1C44108E78405A9DDE6EB2BAD7552CE9804374A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071849, "uuid": "4ff06fdd-70d4-4ed2-b74d-522817b11240", "value": "24576:VBlK6gaVPN6T16qy2Xej3HiwwhFkHR43b7BOrMeIyOSrg3stPq:VTHgaOBDXejMeEMMp8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777071849, "uuid": "47b15701-d25d-4251-af0c-f4f1622d1fcd", "value": 1047559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777071849, "uuid": "7c52d511-3c72-436a-94a4-44d63f09f47d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071849, "uuid": "6de00cee-4eb0-48af-be63-d8ecdd0399d0", "value": "clinical.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d6095e3-3fe5-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777038896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038896, "uuid": "e3ddb1cc-73eb-49c9-9ff8-4dd2c857509b", "comment": "Malware payload (Gafgyt)", "value": "612f11cf0cd98304796c297475cc9cda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038896, "uuid": "7b586642-052c-4a64-ae5a-42656fc506f0", "comment": "Malware payload (Gafgyt)", "value": "8abe890515771106ce49134035f2ac2ec498fc222527962a218752611ad34af1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038896, "uuid": "81c1ad52-4016-4487-b805-9a4e1cb5d4c5", "comment": "Malware payload (Gafgyt)", "value": "8e5f96b18c0aa3632a45b25f28590dc81930dd74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038896, "uuid": "20edd67e-e41a-485b-a79b-bb90e1bd39db", "comment": "Malware payload (Gafgyt)", "value": "492129a66ef0d725fe252b3aa33689680bf6ab7556bd3f459e0872093f4159fbf15442eb36b89a36e0f2a94ea5a30a7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038896, "uuid": "e895dbc9-794e-4a29-9caf-d0995a3ca7d9", "value": "T1E6345C42EA418A13C4D617B9B6AF42453333A7B4D3DB730699286FB43B8675F0E73A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038896, "uuid": "485aeebf-5abb-4a98-a662-cd1b5993abb9", "value": "6144:BP7ymmeCaApgsxCFPRa/8AsGZKCEkAiCVTYeWxM/90t/:BPGmmCApgsxCFPRa/8AsGNXiTa2/aJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777038896, "uuid": "b4ff4cd2-e958-4b12-9e9c-70128d68176f", "value": 234804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777038896, "uuid": "c190aabf-dfe8-4924-ba55-1024e389c303", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038896, "uuid": "9532adfc-e035-43f9-b892-ab708dca7a94", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a565efb1-4009-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777054559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777054559, "uuid": "564ea86d-3f4d-4984-9b20-37089b4f5d14", "comment": "Malware payload", "value": "755c355d23e993810c46c981ad083e3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777054559, "uuid": "b00bafe3-0b17-45e1-865e-0c0c8de76fff", "comment": "Malware payload", "value": "8b7aa59c7c4ed14a66eed96f10716fcab9c7c1f733e196a1793ac5fe0b02b304", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777054559, "uuid": "67d19bb8-4a65-423b-a1f7-03e4613b038d", "comment": "Malware payload", "value": "7ef34fd93898d18ed6cdaa3a35d1b2d2e6b687db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777054559, "uuid": "9a3e1c21-3bb9-419a-b5e1-328145161bdd", "comment": "Malware payload", "value": "162cdbe86150bbdecec17a3f15de62947e15250245b0660cb3959161b32863a91978fa1d8a2b57ccf912816c88ca5c2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777054559, "uuid": "39a492ab-49f2-4653-b867-b09c586743d8", "value": "T15175E0A173855663DEA48B7106E28370A7F5392252F3464EE312272C0F725AE6D1FDEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777054559, "uuid": "afff15b1-d6e9-4766-b7e2-ca92c8b96cd5", "value": "24576:TD1HGqhZd4FILjPYubEn206uIO/d0hrRpfl09VewdWC4F7UbWE89boEqmcxG:PZYILjP/Eh6Wd0dRp5u4H9bGtxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777054559, "uuid": "3f377514-e437-4a50-929e-4c61a2f23dd0", "value": 1640817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777054559, "uuid": "b2079f6d-da88-4fae-bf71-9ff93ba1d661", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777054559, "uuid": "ab19241d-213d-4909-937f-a013bb0a0e0f", "value": "bot.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df0e1585-3f73-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776990232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776990232, "uuid": "7bbd2609-8951-4e44-8b02-4b280593b04a", "comment": "Malware payload (Mirai)", "value": "b5742208ee8ac22a6fb1f452529fe9ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776990232, "uuid": "f23d6dc2-78e3-42c2-b90b-68824381e215", "comment": "Malware payload (Mirai)", "value": "8c2d8eccaf611576cadeaffa9759a46dd586d3ab7bffa10e7fc6918785dee130", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776990232, "uuid": "0d9c0985-8d13-43ba-9227-f68cfe72fc11", "comment": "Malware payload (Mirai)", "value": "efa208e7c9461412fd8268b00429f5769e759906", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776990232, "uuid": "06716445-724a-472a-bac7-7feeac2a47e8", "comment": "Malware payload (Mirai)", "value": "ce9090d475c3c886fb13ac2ca0f4d88feab9b895de92d0e7cc0a5acc8b60ccbfcc9635956b0cce0f840c30c12ccbde88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776990232, "uuid": "4205a282-8834-44c4-a9d3-4f9952a43d99", "value": "T187549D077B8A4DEAC62DC3B20EEBA3108B13F0350712E79F37646A647F4A79C6C58559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776990232, "uuid": "e8eb1c04-abf7-4f13-af62-3109c5fd6da7", "value": "6144:HOd3iYi3XmEiIrlG+/QbMk59QlknPDM+k6ZxPOaP0rbyjbpblTE3TqjjicmmkZaf:aEK+/8Mk59QlknPDM+k6ZxPOaP0rbyjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776990232, "uuid": "1c61f37e-988b-491f-8018-fbe587afc73d", "value": 300498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776990232, "uuid": "600dd0e3-6666-4a1b-8e38-4f2c86a243e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776990232, "uuid": "efe2ca4a-293e-4bc8-88de-d9a388b687f6", "value": "zyre.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3837dbf-4037-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777074420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074420, "uuid": "fa1a0d97-d20a-4624-a5d7-91a114dc6e28", "comment": "Malware payload", "value": "684795fa8adb5f5c9ffa9f66e0a416a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074420, "uuid": "28d08e92-042b-49fd-8d68-03a24b0bfd86", "comment": "Malware payload", "value": "8ccbedd12d20e91fe2c17173ec8d483079f41d82500eebaef2d44cfa4641029c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074420, "uuid": "b876182c-cc96-44a7-ba50-a821fb2a8a14", "comment": "Malware payload", "value": "d5418cd3991af0d27a270078f30d75cfdbd22667", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074420, "uuid": "e126a78d-7d94-4252-89c2-055119cba46a", "comment": "Malware payload", "value": "2c06d25da62652e7c1bbe448efa798b50dea3c5d265877af57b45771ea7cb469728652679430dc3620ade26b49e43665", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074420, "uuid": "87c883f4-f792-4a2d-82e9-3723535e87a6", "value": "T1C2350156FA256F2BC8924276C18BC2386377E4818782B303A548E53D7D4376DCF2E759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074420, "uuid": "66d12341-8ab1-479e-b013-34ba40f60cc4", "value": "24576:l0tqcI4qN/1sfElJokJ56nrGn+lANlklGPp4DjOR/FUTylGkAeJ4uGCMI:aiN9kiUyn+3GxvIyiuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777074420, "uuid": "5098206f-caaf-4589-bb23-c386b4dff2d0", "value": 1126662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777074420, "uuid": "408726c0-ced3-465c-a2ef-2ad061f3b57b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074420, "uuid": "e4e5b645-b2b2-4e9c-bb3a-0145e8115c42", "value": "bot.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5648c2-402c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777069421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777069421, "uuid": "e940e1ca-9ea6-436e-951c-0441a9126330", "comment": "Malware payload", "value": "69775e197b3f9c628335751350cee2ce", "object_relation": "md5", "Tag": [ { "name": "canvahow-com", "colour": "#24CB59", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777069421, "uuid": "d9793d2f-99ee-4706-9a56-0dc269876d91", "comment": "Malware payload", "value": "8ce7347d09e9672aab2a17a51d5d799888c21cc27da2de2bd74fd832f23b605f", "object_relation": "sha256", "Tag": [ { "name": "canvahow-com", "colour": "#24CB59", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777069421, "uuid": "c65d9e43-79d5-45a4-9599-e3bcd03e2a5f", "comment": "Malware payload", "value": "59566b63cb84fd2aaa7d301408aaef2507023479", "object_relation": "sha1", "Tag": [ { "name": "canvahow-com", "colour": "#24CB59", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777069421, "uuid": "21dacf52-cbde-4c63-a38a-261d0c3b4527", "comment": "Malware payload", "value": "89c5cb73458e5a9accaf3bae55b1f8ee6b8438fc0dc4398ac0e8035c0166d80601c2f831efb8a8f7e407c5f56248751f", "object_relation": "sha3-384", "Tag": [ { "name": "canvahow-com", "colour": "#24CB59", "exportable": true, "hide_tag": false }, { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777069421, "uuid": "7960f230-86fb-4439-8b50-523bf1aa9fc9", "value": "T1BF133BE7179C0AEEAB9099D6814D390754FBC17B2C1E128CF5E25647F13E920B626F70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777069421, "uuid": "3634223d-6256-4f7b-9f33-f83d79f57a21", "value": "384:MNa/K6DIel8o9Qx/VyH5iRFx2YxGfn2lAMETEGOsRf3qWekxWk0XJQ3gH7HIPWWB:M1lqQ/RFsCG/2/Kz3JMJQ3gkFSkkbwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777069421, "uuid": "9cfd5517-bde7-4c0d-98ba-128f2a82b64f", "value": 41575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777069421, "uuid": "8f92a357-4738-4cb1-a444-f22226a2e601", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777069421, "uuid": "4599948a-3513-4a0a-ba05-b6790665cfd9", "value": "index.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e49aa2-4021-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777064600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777064600, "uuid": "d62e9dfd-df00-4c02-a2b5-0964362adf11", "comment": "Malware payload", "value": "56491b8319d8d74f73f831b9923076d8", "object_relation": "md5", "Tag": [ { "name": "pw-9931", "colour": "#ED5674", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777064600, "uuid": "286f3a3d-4d63-4ee7-8cc5-e5302b046141", "comment": "Malware payload", "value": "8dac796ff8f25868f01a0cdfaecfcadfda4ee41f44b71b1fd2a30c414928b428", "object_relation": "sha256", "Tag": [ { "name": "pw-9931", "colour": "#ED5674", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777064600, "uuid": "26c68c91-8d0d-44af-9695-7b406ccf6bb0", "comment": "Malware payload", "value": "4d4599d139a885b65da0764db2a31631e6c9b95c", "object_relation": "sha1", "Tag": [ { "name": "pw-9931", "colour": "#ED5674", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777064600, "uuid": "feb3d60e-046e-47ce-8ea9-2bd7ae6bef86", "comment": "Malware payload", "value": "0e93a03899eecd2d7962e23370990d88071dad386266a832180ffcabe98d1b036d4955ea7128390558a6f9523ed50b01", "object_relation": "sha3-384", "Tag": [ { "name": "pw-9931", "colour": "#ED5674", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777064600, "uuid": "35ba786c-94a8-4538-ba5b-35b44a15fdb1", "value": "T1CCE633FE9577FDC2697062BC30A098C8B1B59E6016836C1E6491FBC69FD12CCE90BD85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777064600, "uuid": "a3514f9f-63a6-4580-863c-d246aa130b41", "value": "393216:/WU38bCSBTzGFbAMQYudPzcssygqoV7IC7Vru5WyeJ5aNWZLF:uU3sCSBuAJpbcuglV7xlu5WyW0NWtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777064600, "uuid": "4947dccf-3e7d-4640-a550-794a66dd99c6", "value": 14941102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777064600, "uuid": "d49d293f-ad2b-4645-8749-e3a79d9a3fa8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777064600, "uuid": "6a5b1443-c1c0-441b-ab4b-4fd8f76dc0ff", "value": "7DaysToDiePD-1.4.0-win64.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f437cde6-3fc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777026345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777026345, "uuid": "882df838-06db-4492-adf6-3eb65f2be8aa", "comment": "Malware payload (Mirai)", "value": "d535d5acf261d9b6218e9f1819e63270", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777026345, "uuid": "00b025a7-098d-4274-a18b-374f16e752b4", "comment": "Malware payload (Mirai)", "value": "8e6be9f1e53f5161be1664170f3d268c493dea598e0cc0c1c24a89988b24f486", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777026345, "uuid": "4c6d7f16-2bd3-411e-a41e-f195a1d1a12e", "comment": "Malware payload (Mirai)", "value": "c2d40a31b3a06560ae25c6f8030c3b1d0b651560", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777026345, "uuid": "0ad24c7f-07ca-439e-b41a-59dcc53c7b22", "comment": "Malware payload (Mirai)", "value": "9e8296225c3272d68dea4b34ee793f73bf5d4127375b65609880882083cfa95b238f89015cb2e453d0d7cf0817024799", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777026345, "uuid": "d27dc52b-a565-47c4-871a-0f17f99a897e", "value": "T112634A8AF783D5F0CC4305B0105AFF3AAA35AAA11224DE6FDFE0F973A8726135455B58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777026345, "uuid": "720c8356-4717-4a8a-9ee7-d1bbd1c7362b", "value": "1536:eGfvXC7fh1FtV6t9vvSkK2Dh70lcdUe31gOVmUUr:eePCDh/K91BfKOV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777026345, "uuid": "3544cc6b-2e9d-4fed-aa9e-225d7c60bfd7", "value": 70340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777026345, "uuid": "fa619579-b812-4f1d-bd8a-3100593c8b70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777026345, "uuid": "7b201acb-4184-4c40-8142-258822f7b15d", "value": "vision.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d72a7f4d-4003-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777052066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052066, "uuid": "ea46afb1-8c03-4b45-8e20-7bd454cae669", "comment": "Malware payload (Mirai)", "value": "e19a254fe2836776f957299e7831f090", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052066, "uuid": "0f3df14c-42d2-4d83-82a2-2f06a7f11bc5", "comment": "Malware payload (Mirai)", "value": "8e8b3702eac6143deb8e2641c5731bb8ad6b1eef1985433b1172c7abf55b9393", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052066, "uuid": "02cefa45-10bc-48d3-af7d-4206fcc108f4", "comment": "Malware payload (Mirai)", "value": "6c625bf3b6da34d5f975493418069ad6f5b1e3ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052066, "uuid": "be4e5010-7e95-4b88-867b-a28b242dc75c", "comment": "Malware payload (Mirai)", "value": "575d0f4d22a68b1c3dcc984b2b0090b1ab83f7419f672f14a490acc883a697e02ec0c7a4c32210582e7a9f2820f3ae2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052066, "uuid": "77829753-a217-4883-8123-abbbe52d1531", "value": "T10AA2D029D3456EF4DFAF9D9093C2C2C276E547C6278AC8E240FEAF012616056BB89C59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052066, "uuid": "a7bd338b-ca49-42ef-8cc4-3102ea3430ae", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5bRMLM4uVcqgw05VxJc:mRxsSVsMD6xiJJE5zRWNlS44uVcqgw08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052066, "uuid": "51ff9f1b-8663-474d-98ef-cc9faa0922ff", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052066, "uuid": "b2c4ff81-4461-45ae-a153-b5f582e20582", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052066, "uuid": "98bb89ea-06fe-4311-aa92-84370dc3c764", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e84fb5-4015-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777059506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777059506, "uuid": "6922ac48-505d-45ce-82fa-9a41c64813f1", "comment": "Malware payload", "value": "1c5ed0558e6f168924cd15cb9b03cda4", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777059506, "uuid": "c04fbdea-808e-4922-ac5c-9ce58ca7fdf4", "comment": "Malware payload", "value": "8f0da210c208c56bd11bad404752f2a5cb1ad79ea42e34f83f5b605b65d60c1f", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777059506, "uuid": "7ff45d26-d6c9-4414-8062-9d2409a6c274", "comment": "Malware payload", "value": "d77ef1232533f66e9a159418f0bf34b453e8b54b", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777059506, "uuid": "5fdab2b9-3179-46e2-ac89-3b1048ea6247", "comment": "Malware payload", "value": "49eec63e454db48c8932083d990b3d0955af197f478707a724e095cb364f2a9ff507ef5a7c0ba25ba7db15c996e8f77f", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777059506, "uuid": "91d40652-a665-4bc0-88ac-425cead5464e", "value": "T1AAB423A597A81E1E4EFC57B63AAB1D4A91F90BA4C74CCA14E3E1D4F3511F20C84C937A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777059506, "uuid": "3ad3d997-89ea-4a96-b918-7b441c30c766", "value": "12288:zxKjK+IEMYZ/GOZ5PN5tgHxkwgwjFHoaCW5VGp2V7BWepee:NKe+IELZtZpN5tgHxlj2aCWOM7c3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777059506, "uuid": "2097b553-2ae9-462b-b535-d23e45f6838e", "value": 520553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777059506, "uuid": "caf6dbb7-303c-4c1c-972b-16fc53f8d903", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777059506, "uuid": "22adf1a5-9a3c-468a-a086-8db173014cf8", "value": "STRIP.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5519ecd-3fc5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777025407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025407, "uuid": "bfb4eb5f-4270-4a2a-ada4-59f407ae05c5", "comment": "Malware payload (Mirai)", "value": "def8217d8b37e6ed0af3eb93c1556c29", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025407, "uuid": "e1b14118-d83d-44dd-b72d-6f820b0df601", "comment": "Malware payload (Mirai)", "value": "8f8173b6f784c599fbce0a0ca3c8bf45b7531dfc0b9db21a311e482e29ec7915", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025407, "uuid": "d95d3514-fa35-4d25-9e8d-38f67f4d0603", "comment": "Malware payload (Mirai)", "value": "bd50f69ac8a61fc373edaa60262a37541d08f9b1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025407, "uuid": "ff457083-3a45-4e7c-9c73-920dec7b2268", "comment": "Malware payload (Mirai)", "value": "3d010338eba7c6db57d8520797efcacc176aac5787039aa5833743e7f4604a72ff55b54d05b7a51b1e23a71abbdaab5c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025407, "uuid": "0e01a20c-9ced-4c4e-a896-212a7d03923f", "value": "T160D34A2275391E2BC4D0A87E22F74361F1F167DA25A8C90E7EB20D4FFF252206547AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025407, "uuid": "0863f25a-2aef-433d-beda-ce1966c771b8", "value": "3072:lCldeCsOs9kzj2vV4XcZgqniE230IO1BlsT3jFA:APeCK9kzivVYQitymTTFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777025407, "uuid": "25aadba7-fe4e-45fe-ac93-3c964cc6a6c5", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777025407, "uuid": "d21e8fb2-d3ed-4d51-8b46-182536ac8ec3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025407, "uuid": "eba13ff1-5f1f-4ffe-a2e6-7427249db398", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25625cd5-402a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777068518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777068518, "uuid": "4549fa97-ffbf-4e65-ad38-d5d48c0ac0b4", "comment": "Malware payload", "value": "410eddfc19de44249897986ecc8ac449", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fast16", "colour": "#A43AE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777068518, "uuid": "c2a5b0ea-30e7-49c2-9ec6-bc1e5090b769", "comment": "Malware payload", "value": "8fcb4d3d4df61719ee3da98241393779290e0efcd88a49e363e2a2dfbc04dae9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fast16", "colour": "#A43AE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777068518, "uuid": "7ebd9c20-e404-4443-9e80-df6c9021ee29", "comment": "Malware payload", "value": "675cb83cec5f25ebbe8d9f90dea3d836fcb1c234", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fast16", "colour": "#A43AE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777068518, "uuid": "5b3302bc-7f98-402f-8c4d-f007b5c0e1b5", "comment": "Malware payload", "value": "3ed5f0dda7ab185d61f593a1d6e111028d2b3fce5821021e09be0eb4ed31d240b8fc5f100de86d31734a47ecd4a23bbe", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fast16", "colour": "#A43AE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777068518, "uuid": "f82fb4f7-b3ca-4923-b36a-b952cb3e378b", "value": "T176136D61389645F7D38E433545F5AB376EBE39202AE444439F695ACA2D322F1E13B307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777068518, "uuid": "615e7f47-1cc2-42ef-aaee-5b940fca8601", "value": "3e85412d487566e386cd4482ea7b9e08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777068518, "uuid": "eaab464c-7557-4799-9f57-89e569719091", "value": "384:vLstUHEooNdEA9LdHzedBcTGhssu7mpypzg5xACktZLEBuoHJiXScmoPp8X3:sUHEllxydiTUBuyphxACALEBtJSEo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777068518, "uuid": "9fd42cab-a099-46d5-a2d1-f93f47f07d2d", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777068518, "uuid": "23ac7bf2-3224-4550-be50-2fa2ffb097ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777068518, "uuid": "8c992860-51ef-4ac9-a1ed-f1925564183a", "value": "8fcb4d3d4df61719ee3da98241393779290e0efcd88a49e363e2a2dfbc04dae9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2d7cfb-4033-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1777072527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072527, "uuid": "d6963985-d4bc-411e-b9e7-2f62c760ad3f", "comment": "Malware payload (DCRat)", "value": "8f4c853abcfd2a9b50b2ae71d4b992d9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072527, "uuid": "b1725104-fccc-4a48-a492-8f8cc64d0090", "comment": "Malware payload (DCRat)", "value": "91101f9726a0539d7084d2cc4bd6fd9087f38e41edb3cf3db74551658650dc18", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072527, "uuid": "b19702a7-4b4a-4f3f-be03-47ac91b15de8", "comment": "Malware payload (DCRat)", "value": "8ccbff373594eae2c72d239f1f1eef78b3d451eb", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072527, "uuid": "8905208b-81de-45aa-abde-fd8c325b6223", "comment": "Malware payload (DCRat)", "value": "8450135354e05754ef143fc44b8dae4e99eebcda03b3f8bbc7c38e28889feea21ce30a0bbadf0637c5eecd4308153fe7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072527, "uuid": "dd72fe1c-8aa9-471b-9caf-58d5bddb9925", "value": "T1B23549027E44CA11F0191673C2EF490847B4EC116BA6E72B7EBA77AD5512393BD1CACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072527, "uuid": "4b4269df-da3d-4da2-9fb7-f9b093ae70bd", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072527, "uuid": "b05ff764-64f9-4221-a317-61e759b6b3d9", "value": "24576:U2G/nvxW3Ww0tb9z+pmkFUaDfMASgdRXrTgZQF0z/:UbA30QmCMa36L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777072527, "uuid": "c8f45a93-abda-4c72-aac3-14082524ce99", "value": 1163938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777072527, "uuid": "77e4c112-61b3-4a6b-83e4-d69e639f6b02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072527, "uuid": "cefa8027-d6b8-4c5e-8f34-0b0ae7b96099", "value": "DCRatBuild.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dcd97a7-4039-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777074975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074975, "uuid": "b9164d16-48dd-4731-a5b0-11cb8f81352e", "comment": "Malware payload (Mirai)", "value": "55c0419e1745de8fac66cb2c3fc7bebd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074975, "uuid": "9f83c7ac-a6e2-4075-bd1d-67abeae3f4a0", "comment": "Malware payload (Mirai)", "value": "91316361fd9542e59daf8fb0825dd41f40793342d8ed8deede65bd761d280edb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074975, "uuid": "ed3e3736-9a91-4ecf-8e6f-e441401316e2", "comment": "Malware payload (Mirai)", "value": "4337f89da6e65464bf7ddf63d6de2c0e6c2bd960", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074975, "uuid": "f119f1ad-18cf-4c83-906c-3b384cc323e6", "comment": "Malware payload (Mirai)", "value": "c2ebf61267b31044de95805d4d091d5c260c57721cb8cb388c20a3c5cdf3564bc51536d25c01beaba6c08ed7f9c86f05", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074975, "uuid": "d3da562e-8853-4263-b6a8-3485051c8b4b", "value": "T162312591F425F437F0569B75DB4BB320687234070558EB64F5CEA2A0BF9906C62B4B74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074975, "uuid": "2cca3db7-4c50-4ebb-bc58-76694fe0711c", "value": "48:XoMr9x17KR71R4R1Rq1eZ1FO1AU1AI10U1jv17w1wV171KDGuBYDaS8k6Ju1RE76:XL9x17W7jG1s1814171/1n1L181W17tP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777074975, "uuid": "d1cce422-35a9-46f7-b5f2-d4850f7c43e0", "value": 1662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777074975, "uuid": "21420ee1-b502-430c-9285-bcd23c4dab5a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074975, "uuid": "e3c55fa8-e4c4-42aa-9c14-8b5fbaf56cdc", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582ba9e4-3fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777012339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012339, "uuid": "5af78112-c0b4-490e-9d5c-329b4914ae7c", "comment": "Malware payload (ConnectWise)", "value": "bd6bb3c5ad7547d57cbaed4ad004c7c4", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012339, "uuid": "8c9f3a9f-197f-43b2-91ca-d9418a2770b5", "comment": "Malware payload (ConnectWise)", "value": "91fef94dbf74512b294628c8585a0dabf6b5558ddf3def57fa7dd60e573a9052", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012339, "uuid": "ee4e6df3-35fe-40d6-a31c-88370e3b1fbd", "comment": "Malware payload (ConnectWise)", "value": "ffe4696dff83d14ddc444106dabff5a305d7ae09", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012339, "uuid": "0dd25ad3-3698-4bbd-bc0e-5eea4dd53330", "comment": "Malware payload (ConnectWise)", "value": "dfc3faaccaab3d36dba63b7405fbb8bf78f5df19e430bb53f24f8b9d65f3ccab520c3e82f9a86ad2c0af41ac4f5a715b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012339, "uuid": "08c52478-95fb-4758-8378-eed1e0997aaa", "value": "T1BB836C43B5D18876E9720E3118B1D9B45A3F7E110E648EAF7398422E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012339, "uuid": "86c3c63a-bd29-40a8-8778-4429a4cfe450", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012339, "uuid": "d1937aba-a2c6-4a7b-bb39-0d2c734d4e25", "value": "1536:6xoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYT77JrA2:IenkyfPAwiMq0RqRfbaWZJYYTxrA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777012339, "uuid": "355c26c5-8879-44c9-8997-3336f951f319", "value": 83184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777012339, "uuid": "7c594b51-83fe-4913-9fd1-5a468f936e46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012339, "uuid": "5413731e-2e08-401b-9764-381f81c5d040", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226a3ede-3fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777012249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012249, "uuid": "8e3a6721-e230-40fd-8f7f-5ad0b12390ed", "comment": "Malware payload (ConnectWise)", "value": "0e5e472baea41b9000e83f3ed934cc37", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012249, "uuid": "20c832e7-85e9-4bd5-8587-7b522e5b982d", "comment": "Malware payload (ConnectWise)", "value": "925608479018b576b75f215913436626d812dda3c2acca4f8aa0d09426637a37", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012249, "uuid": "d5618dd3-8771-4385-a455-5a9899031e2b", "comment": "Malware payload (ConnectWise)", "value": "9b597454edd7de400ada03e2b480c211c9e468c1", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012249, "uuid": "8f957077-0bd9-4170-885f-e13557d94d28", "comment": "Malware payload (ConnectWise)", "value": "a136223dfce4f9c01126bbed973f6c26b39675fc8bfae5b607d7bf895a725d5ff281d21572880505ccbb50f432a13dc6", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012249, "uuid": "16a284e9-387e-4351-9b81-3caea4f4ee2a", "value": "T131646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012249, "uuid": "bf1b8178-20b1-4e03-b153-c8adaa5a4610", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012249, "uuid": "0769686d-d266-4e6b-a878-a28fd5cdf6af", "value": "6144:9mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFvi9oPJ:41iw7gryNkSV1hy1Z1u2JLa9oPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777012249, "uuid": "ed311077-9e8c-42a7-a3e9-78b875704e3f", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777012249, "uuid": "bf7abadc-ebe4-4715-b3d7-61a7d16f3ce1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012249, "uuid": "90283e96-8811-46e3-b61f-a22c646e3aa9", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f43a63b-4035-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1777073366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073366, "uuid": "9080cf94-fe71-4bbe-aed2-1423faa8d8ca", "comment": "Malware payload (Gh0stRAT)", "value": "5ca0b94f86781d820ba721a3ebf271ef", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcsoon-com", "colour": "#335CBD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073366, "uuid": "1b3a2808-6515-48b6-a751-816f79945bdd", "comment": "Malware payload (Gh0stRAT)", "value": "9333da19e474e99fcf6d75230c8bc90b07ab2cbc13165b6d94ace9ae754edcff", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcsoon-com", "colour": "#335CBD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073366, "uuid": "84235ea0-7377-4ddb-ae5a-d7c63ba6a5bf", "comment": "Malware payload (Gh0stRAT)", "value": "5e8376b39a3f83115bafa4893ceb23e6f431e007", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcsoon-com", "colour": "#335CBD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073366, "uuid": "bb6dc682-30a9-4f12-816c-cfa1ad20f15c", "comment": "Malware payload (Gh0stRAT)", "value": "f9d595c1a7546a522297de45e675be93a34a2ccd974380174153ce13c7df90e599c462f735d60ca12c5219de705f749d", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcsoon-com", "colour": "#335CBD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073366, "uuid": "c5ac7a15-eb89-4999-aa86-02d2bf222e58", "value": "T10D173362B6CFE43DF05A4B374572E24484FB7B656633AD2286E884ACDF691542D3E303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073366, "uuid": "974f57d4-2e75-469d-a163-ff6498431174", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073366, "uuid": "3c31c560-1367-42ce-816c-2ad857e5d901", "value": "393216:F+ZKdzNMLpVDkUS2iqZ4LQ9YclY+jXbOq4DD8ADgsQDYBbMwlV:oINNMp1k6iv09YJgXbOqM8ADgHDqIwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777073366, "uuid": "bb8acd34-81de-4701-9054-e31b5e45a48d", "value": 19212325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777073366, "uuid": "e67ce6ca-cdd7-4c9a-85e5-5f61fbb325f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073366, "uuid": "8185a060-235b-4308-bf49-8f6b5ac7c366", "value": "II-3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba6fa81-4005-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777052879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052879, "uuid": "f9d7fe76-6e2e-4713-9750-ab6f1b59466e", "comment": "Malware payload (Mirai)", "value": "405c3d28d96c1dc732e110f042aa58ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052879, "uuid": "26967d4a-89ec-47c7-b3d6-11ac289e9be6", "comment": "Malware payload (Mirai)", "value": "9422e79e4cf03dc30ef73fb78c6500c6806ae9a6cf0b36d495e66a4f95dfea85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052879, "uuid": "3fa2b84b-9500-4e41-baa6-7dc5ef1cdf98", "comment": "Malware payload (Mirai)", "value": "3845a5fe72145c836cb5a1b5c3f458ba36519232", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052879, "uuid": "26532e53-29e6-4516-8864-0afeecf43d02", "comment": "Malware payload (Mirai)", "value": "0c960abc3a5f3b0157991b01a02badc29df30517d35b8ebc685eba3ce426ae2ec9b6bc30e0f56e4d5359933d9c20b6aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052879, "uuid": "431cb44a-c45b-447a-83a1-8dfcfff00701", "value": "T14FD44A16F8809F62C5D12576F65F8268731347B9C3EBB2069A189B343BD792F0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052879, "uuid": "7b8dd747-8bf5-42dd-8979-a0b2ca51c4f0", "value": "12288:olJlFtV7MK8wVsPBtRWu5vKGQLm73LQ4t0GWmoe028pRPNcW+Ht1trow0k7:SlFt+wyPDRWu5CGsmbLQ4tuNi1tEw0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052879, "uuid": "fea43c44-4658-4a49-96fe-d27db120ca56", "value": 654036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052879, "uuid": "bd58c405-bf76-459d-bb4a-fb137d383d08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052879, "uuid": "aaae731d-2fc0-4912-9223-9fef35497e01", "value": "l_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2bca46c-4004-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777052407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052407, "uuid": "0100c5d0-6346-4312-b213-f75a9fd2fca0", "comment": "Malware payload", "value": "b9500f72e9ad39d9efc0b5152e2807e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052407, "uuid": "7c349473-4e11-468c-9f52-c1cc2d51bc6b", "comment": "Malware payload", "value": "95f0297e9e3b9401cf2b803daae9e6e934779d5b7cebdcdf2d07f1884893096b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052407, "uuid": "33b94515-540e-4b75-acba-6431f5115e9f", "comment": "Malware payload", "value": "caa8e68e2cf9e7d23b371074cacf65f1a3a342c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052407, "uuid": "4cd10b8c-99b3-4d19-b594-ac62531e174f", "comment": "Malware payload", "value": "fb05ef6a32e8ada3c477fa58e8788995be941919b679a3d547555710bf39d3b564ff9566d55f249691c2d6b5aad77db0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052407, "uuid": "da7d6887-3f2d-4f8f-87f6-adffa6bb5ce3", "value": "T157B63347DE3BCEF4CB63463C89831A57124F598D8C47E4C9E0482A3589E399ADE38F59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052407, "uuid": "f73d7c95-631f-4f9e-a1c9-00b9bb456908", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052407, "uuid": "67fb3a37-18f5-4d43-9aec-06a826edd9d5", "value": "196608:byaZk+wRbLGmnYZJukGkxGB8rM2VPFOsti7A95vM9sFp29XaIT030HyyG+zzDY:MndnkGkx08rtE7AnMGp29qIT0Wz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052407, "uuid": "71f60a24-aaa2-46db-8b7d-c84d7ebf30e5", "value": 11055520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052407, "uuid": "67ad7769-101a-4d3b-b5f1-3786ba8b9c5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052407, "uuid": "8f3b611f-7940-4464-b262-34d32734a12c", "value": "ToledoSighCoInc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d176cb11-3f85-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776997940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997940, "uuid": "6591a849-47bb-4abd-bd00-afe7d8f5ef5a", "comment": "Malware payload (PhantomStealer)", "value": "fe5b1786ddec73cd93aa5f7de5c52ec9", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997940, "uuid": "bb4b4787-ca4a-473e-a36e-0359be8c8411", "comment": "Malware payload (PhantomStealer)", "value": "9646ea44768dde6596045da2aa2414e043c027a7b647da5c8999083c78b32313", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997940, "uuid": "86a7163d-8a7f-466a-9965-86a92ff111fb", "comment": "Malware payload (PhantomStealer)", "value": "742e8eb95f002a008d3948c8a7890b5a63ca3a9c", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997940, "uuid": "6d02d0f7-8791-47dd-ad6a-853cceb95471", "comment": "Malware payload (PhantomStealer)", "value": "bf75b607b8cfd5e0247ca805e1b095840631dc1055ccdf93f877505c8e123635226e5bc20fadffe935c9e5652a0a5aa3", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997940, "uuid": "53c9be69-0884-4ba7-a649-15725da80663", "value": "T10D0523084DD8254D1DBC12FE32BFAF5990F04BD1745EA8CE8596C8825FC691BE327CA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997940, "uuid": "638f75bf-a3e5-4252-b530-78208746bd42", "value": "12288:g8EcKKdn+ImRsOWxPHBApYEOfRnxJAo0r15uKyTF8UOmmoAF/FDpG8U8GvWcj92:g8RpnssZxfBAudfBDy5OOh3ogpb2OcR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776997940, "uuid": "8dd3fa71-810d-41fc-b0b2-e145368b01ed", "value": 858656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776997940, "uuid": "804387f5-72e8-48f5-90d7-b8979f892356", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997940, "uuid": "533855c3-22b0-4ea5-9f32-ce44c11a3956", "value": "INCREDIBLE.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f70ff272-4014-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777059421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777059421, "uuid": "8d99d82a-0679-48b5-9640-a2963a1c6739", "comment": "Malware payload", "value": "e7c04ed6579c01639078d317d6753709", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777059421, "uuid": "beae99e4-8cad-4e12-ac29-8a1dda2eb773", "comment": "Malware payload", "value": "9651a2a7d5f71a4e0d55f0079f20398778a6b50ceafa82e7e3227652392a75e7", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777059421, "uuid": "8da7d5a3-6ff0-4c59-b75f-365475a3cd84", "comment": "Malware payload", "value": "1bdd21e2b6dc95be8a4fcbb1d20013f9fe7278f5", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777059421, "uuid": "3fb83b66-b6a5-460f-9f31-b8e9c2cbc631", "comment": "Malware payload", "value": "ec956f066f0cdbc429f46c7b2236cb62144cf6728881244d741d8adfde5cb32babb169852d9ec5378b54f59ab61252df", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777059421, "uuid": "617d0941-351d-4dac-bec8-63da007541fc", "value": "T1F89423681D68FDF848AEE21E551B5D37B7D10FFD509B49C092744ACC63B2EE4CA13A0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777059421, "uuid": "e7f69aeb-33ec-410a-b396-12e966ba3d5f", "value": "12288:OHoKn7dR8d6ut4IgV9awWT1k4Rv7vndqAii0sh/:OIi7dSwHVYfPqAida", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777059421, "uuid": "e8408fdb-6c66-4686-87b7-681e35fc57bb", "value": 414834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777059421, "uuid": "420e5d5d-308f-4275-a04c-029c4b7f1d21", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777059421, "uuid": "6605ce11-e9e9-4518-87a6-9f257bf9271b", "value": "Drug.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb92d59b-4037-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777074353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074353, "uuid": "09c377a7-6138-4b5d-b0bc-e6f4a9abcc0c", "comment": "Malware payload", "value": "85b106015f742f354acd77140afded39", "object_relation": "md5", "Tag": [ { "name": "5-8-248-245", "colour": "#8543B2", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074353, "uuid": "0e4ee85d-f4ed-44c7-8467-c8a64daf9115", "comment": "Malware payload", "value": "974bc83396e79a3250542c9cb8fe2994d6168c3a53e4b911cbb90bdfdb7de524", "object_relation": "sha256", "Tag": [ { "name": "5-8-248-245", "colour": "#8543B2", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074353, "uuid": "79e0ee2a-6f17-448e-9b6f-ec48d9c77392", "comment": "Malware payload", "value": "371b51e225285bfabca20924c32690947984a081", "object_relation": "sha1", "Tag": [ { "name": "5-8-248-245", "colour": "#8543B2", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074353, "uuid": "453a976d-390e-414c-acc3-b12f86e40751", "comment": "Malware payload", "value": "bd9d702c1c605f3d06a0a4689dba22453efe19db8a358b8a98e49f74f217d43007dce3075d51b9cdfce3dfd1ff0baf51", "object_relation": "sha3-384", "Tag": [ { "name": "5-8-248-245", "colour": "#8543B2", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074353, "uuid": "eb8f24ac-8786-412a-a962-59587ec6a1f8", "value": "T1C1B79E0BE29341A9D57B90B086ABA733E670781C4320ABDF1695D6343E63FD05A3BF54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074353, "uuid": "337ff29d-8945-4ea0-807b-9305cab819b5", "value": "393216:xtVGsPN5/u9J23s7LV3zgU2144vHeJmVy2roiCiYfl6IETMREo/s790:RGX3lj4mJP2rubfl6XMU72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777074353, "uuid": "55f56ab4-38c7-462d-9b19-c9b1fa23165d", "value": 51311047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777074353, "uuid": "f2de17f5-3424-487a-84a9-e0a28b6dae3d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074353, "uuid": "d1c6e560-bf9a-4c89-8c36-772692ed1b58", "value": "euro.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c8faf7-401c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777062642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777062642, "uuid": "99c57c58-8f60-430c-a7d0-cc74f14d0d64", "comment": "Malware payload", "value": "b6da18e7d0356baf69768975a83f3e02", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777062642, "uuid": "0980de2d-8edf-4032-85b6-a3609855d55b", "comment": "Malware payload", "value": "97f4ae3cf36765f1aca15ba26434f3600fbfa3b1d5ada5efd5773fa7ed284bcc", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777062642, "uuid": "4158461e-99a7-4f65-b168-9e4137ac4055", "comment": "Malware payload", "value": "b3c37ab798d42d31c3cdb5069dfdcc056fc7904b", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777062642, "uuid": "bd102fe5-8c91-431f-864c-5420b44e2b04", "comment": "Malware payload", "value": "e826d586d5971f448ab6b36bb7b4283b1a4f7717703fb705c953a0d575f248f72818c0f09c48d6d79b0552c320334617", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777062642, "uuid": "a5ffe3cf-2331-4d19-a576-00a4b460e3b0", "value": "T192B0922DA189CACB2D0751A30B72840C89A5A9802544EBABCF0186DD10B8948FAA6003", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777062642, "uuid": "ec5b8f99-6052-4713-a0bf-7d2ac71826e5", "value": "3:FER/8ClVRK+pn2HoIkVViEaKC5sTrH73AYHhn:FERblVR/p2IBnaZ5IHjRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777062642, "uuid": "82940d53-7414-4484-8481-74b835b82cd5", "value": 124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777062642, "uuid": "68df41ff-62ed-486f-8c88-79ffa6dba018", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777062642, "uuid": "0539f9cd-b529-4522-a026-196f557490aa", "value": "$phantom-startup_str_963.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5c3467-3fc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777024860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024860, "uuid": "270264b6-c481-4a24-829d-281c2574cfa4", "comment": "Malware payload (Mirai)", "value": "b6ce603583efb6a6bff52703cd1d7822", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024860, "uuid": "881c2b59-f2f3-4309-a624-106e7bb304fb", "comment": "Malware payload (Mirai)", "value": "98472a2a4427ed6da817b62f9aa1c63e3b4be228a3a28b468d177002c2f34eb5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024860, "uuid": "a18c8f26-e15f-434b-88cf-b1a93bb2d63a", "comment": "Malware payload (Mirai)", "value": "22d58ecff63f63d515272de4896c5c7a9502ed6d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024860, "uuid": "8aeb66fc-4889-4cb5-8905-b92bef49de45", "comment": "Malware payload (Mirai)", "value": "5bf94b5e0dcda1af3276da86a08721aaa31c389c23f7f82470b5515a65c13015faacb75eadc41eecb70997fabca8f09b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024860, "uuid": "1bd250ca-61d1-4031-b6b1-7b263cb085d4", "value": "T153042945EA404B13C0D627B9F6DF42453333AB9497EB73069528AFB43F8679E4F22A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024860, "uuid": "6a5e8edb-2b87-4234-9a4d-55e92438889e", "value": "3072:O7eKvx3cg9/epneFaceTORefjHYlYLaU38YhTfYo+M/Rz4G5CLn:ueKvxT9/ueFaceTOReLLLaU38+x+M/RQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024860, "uuid": "9977b610-4ab6-4a74-94ec-1c90e6e68510", "value": 181490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024860, "uuid": "37d766bf-d4cc-4ee5-872f-ebf1d7ae471b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024860, "uuid": "306ca62b-7dde-436d-a348-a58da646a5fe", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92394e3f-4004-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777052380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052380, "uuid": "8af6474c-4acb-44ab-b571-9a7d100c8f9f", "comment": "Malware payload", "value": "8bc0e94ff43a8dbe7a028a8ec8590ae6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052380, "uuid": "6336c3a3-ad4f-4a54-ae5f-bf162fb2be2b", "comment": "Malware payload", "value": "986630bf704331d94be9d3d2933515bbe2ce331ca722127034d672f0aa92d237", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052380, "uuid": "3a0fc142-5b3e-4445-8011-c11103fd8c08", "comment": "Malware payload", "value": "fe4bc4851e6a0b6c2a4e038ab8d8eb2139e6695e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052380, "uuid": "e6f007ec-a7f3-49e5-80d7-a03771c3e9a4", "comment": "Malware payload", "value": "3051d20c2aac740d227970aee01c08144fccf17065c4c1a23ffa193822cbad9e605fe279273892d67a4b356593181b16", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052380, "uuid": "5bfcebd5-7f0b-4994-8bf7-ffac479d69ed", "value": "T1AB31604F964EE6BA74B1C12746BFED7CEB80126A826484A93C64E441231A63C9E5C0D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052380, "uuid": "4d6a7576-a84e-4a31-851b-cf4b41cff0a6", "value": "48:tu/DmPKvt+SymOgC93XADSX493+0A3A1tC:hl3XgZA3atC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052380, "uuid": "ac8f8a4a-a15b-432d-b822-199f7cebd4a8", "value": 1726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052380, "uuid": "741b1025-48e9-4116-9084-ffdcd8b9d537", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052380, "uuid": "98a441dd-169a-45ee-bd89-c34c200c2d42", "value": "invite_card.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18272f90-402a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777068496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777068496, "uuid": "4e7c1ece-b1b8-43ac-a1c5-46d3647fc61a", "comment": "Malware payload", "value": "dbe51eabebf9d4ef9581ef99844a2944", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fast16", "colour": "#A43AE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777068496, "uuid": "8a722725-75d3-416e-8365-98a2b851ca4f", "comment": "Malware payload", "value": "9a10e1faa86a5d39417cae44da5adf38824dfb9a16432e34df766aa1dc9e3525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fast16", "colour": "#A43AE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777068496, "uuid": "af4da1fb-5aa7-465d-93a3-249e46b6a002", "comment": "Malware payload", "value": "de584703c78a60a56028f9834086facd1401b355", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fast16", "colour": "#A43AE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777068496, "uuid": "74afa87a-650e-4fec-a87a-5a8b399083e3", "comment": "Malware payload", "value": "378685b0632c5a1f66bdfc563024cb8bf489a2b212790e2f3e52f531c533c6a280d3bd7a439fdfd6c24a36d83adb9fd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fast16", "colour": "#A43AE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777068496, "uuid": "66c8f449-64d8-48b0-9f52-967f5776f8ed", "value": "T18E64BF63AAC1C0B2D88205B25CE55B7BDF3DBA5A1232CA43E7E0D5506D217E0F52B74E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777068496, "uuid": "edc71019-3dc9-449d-ae5b-1043cb01aae2", "value": "e0b827c3bf15cb3fd0b9fe4c745b48ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777068496, "uuid": "cf276c08-7f68-4340-b1ec-9df50b2bf019", "value": "6144:m3OWeNij2x1aykBB6MIGg+OkI+pEqX5N3:Ry2fHkKM7g+Okxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777068496, "uuid": "210a9825-32d9-440f-9d7c-d81f6164e668", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777068496, "uuid": "a032bc08-702c-4d0f-96ac-f7e445bd3942", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777068496, "uuid": "df469016-6634-4e7e-bffe-c4624011812a", "value": "9a10e1faa86a5d39417cae44da5adf38824dfb9a16432e34df766aa1dc9e3525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51daf976-3fc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777024354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024354, "uuid": "9bdc0b29-909a-4ddd-9c93-dc16aca4b78b", "comment": "Malware payload (Gafgyt)", "value": "9fdbfacb6ccccf61a2943eae3b46af07", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024354, "uuid": "c931cd9e-c4c3-4082-a467-d1228aa0ef09", "comment": "Malware payload (Gafgyt)", "value": "9ad3b2928edfa615d0d19220dfc52c0a176f8d2f55ba3fe129879325840da4d4", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024354, "uuid": "0015d78e-e5fa-4745-af4a-507c5b3773b0", "comment": "Malware payload (Gafgyt)", "value": "18ee1b94f32a6cbe58056e05550efd5fef6975e5", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024354, "uuid": "9466fdbe-75ed-44b9-8886-4ebf2589b3b2", "comment": "Malware payload (Gafgyt)", "value": "18428bf457f06e808338a3b2eb241448384c59c3a539d09884493b0aef8e1c97221e22ba24f1ee1bb600a18a6bf9a884", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024354, "uuid": "8e6f0957-fcf5-491a-836d-62347e9e2d2c", "value": "T14583F884FD059B2BC7D371FBFB99028D362A1FA8D7EA311699317EA023F66D11539120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024354, "uuid": "24a346d5-f5e8-4c6e-9e7d-0d838322238a", "value": "1536:ObuGXwMu21tya+MY7/BlhTOf132HHR9Hf/ZX7vWoWL:9M/Ea+MQlrR9/hrDWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024354, "uuid": "c1704521-b4dc-417d-9527-06578dd47281", "value": 84192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024354, "uuid": "5e79cfac-c2da-4021-865a-97022eac46ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024354, "uuid": "2dbec3bc-0518-4277-9149-21e02da41295", "value": "ARMV4L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6120b290-3fc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777024380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024380, "uuid": "44e0657b-14ec-4a90-8e04-cc4e2822fbd3", "comment": "Malware payload (Mirai)", "value": "076bbd5265ebfa221605c3c7456994e1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024380, "uuid": "fa6fc376-a7f2-43f3-8235-e39fd98d8fe0", "comment": "Malware payload (Mirai)", "value": "9bfe534e6df528c366b30b62cfffc2b13fe9ceb6a7e49418d58585b4463ca6da", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024380, "uuid": "8f9ecfdf-d2d1-4ac6-9617-39dd6f05f074", "comment": "Malware payload (Mirai)", "value": "4f9c5eed2618ec0686befbe51478d627ea15428c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024380, "uuid": "716fdd3d-a833-4158-8ca8-a8acc388950d", "comment": "Malware payload (Mirai)", "value": "1bad02671137d80e0b3d0d32ee7b68410593ef15ae37af3c500626c1a7981e72aba57291d1d8e2ef6fb5145246f98a8f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024380, "uuid": "21d0484b-b96e-4b10-8db0-05cd26d96a6f", "value": "T1B793F693FD01EF77F40BA37A449308157230BFA60E921AB2B21779AADD361D41467F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024380, "uuid": "35e6f42c-66ca-41cb-b3df-807146ddd627", "value": "1536:JS1+fYWid0E8FQvQGiEyuEyEvUuPIcmvUT7w9p2b5YnsXBgZ:JS1rWid0UQfEyuEyEzI1c3dYsXuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024380, "uuid": "cd3d5f17-3d88-4973-8f50-dd5003eea1f6", "value": 89648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024380, "uuid": "11803fd0-c9d0-436f-aaf0-0fa0687ef719", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024380, "uuid": "891e936e-060b-42cd-a84d-ba6e15024858", "value": "M68K", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9950bb47-3fd8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777033494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777033494, "uuid": "cbdb0c9f-b7bf-43a7-ab99-6c716dd1a5fe", "comment": "Malware payload", "value": "937a9f400a18970a833a0c97b8350e4b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777033494, "uuid": "1ee4ca1d-c699-410d-9e49-e4dd0deefb29", "comment": "Malware payload", "value": "9bff7d03c9c147d5f7662e14dea1ae8dc59be7bdbe3e0ddbbb0efecff64421c5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777033494, "uuid": "40636d81-742c-40e8-aacd-3409d44cd594", "comment": "Malware payload", "value": "56e94861dd7afa51b30234c6ab422fb7919eddae", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777033494, "uuid": "b8c1ea5b-0f7e-4b00-a6ea-5acab8638313", "comment": "Malware payload", "value": "e071c3f5078dba0b10bc35d32014382d4905123fdd4431b38ded0d5bb889e7517105dcdf7c738d8c3b491ca2aedcd543", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777033494, "uuid": "e7582d1b-1ef4-40b9-9962-4da8b2c0e042", "value": "T1D3D023012246C65E050008071CD2B78CF0D5085F1F0DFF714514985C03C7C8C759B387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777033494, "uuid": "efc760ca-9c4b-4606-8b0c-3ce51e541582", "value": "6:hC47bxrBeLuVFOOr+DE1Bn23fXmSKOZG1Bn23fIXH:d5r+uVEOCDEf2OJ2AX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777033494, "uuid": "a1f780f9-13e5-4050-8565-921f4ae134c1", "value": 207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777033494, "uuid": "97a32ef2-b8ed-4d22-96c4-65b4dd9a08c1", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777033494, "uuid": "11869f04-0ab4-4225-a65c-5b196bf1a5f3", "value": "6111x6rswcFD.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a8f115-3fae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777015212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015212, "uuid": "ab84aba2-3f4f-47c7-92a6-d3c3e42a1269", "comment": "Malware payload", "value": "349776bbe99073e4e31f22e6d9c5f865", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015212, "uuid": "237f68e8-264c-4a48-aa94-251f4e2ceb0d", "comment": "Malware payload", "value": "9ce3bf784670e4f6090b51b58a0921512b9130c2a5f79db7f5e3635e7502e584", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015212, "uuid": "68d5b903-9dbf-4e19-8092-ab8645966f6f", "comment": "Malware payload", "value": "9d05e51319f4ebde2db1da876bff2c147fe68d2e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015212, "uuid": "685c826c-7f57-4283-9c5a-1c46c5579d47", "comment": "Malware payload", "value": "137390367640b8a660a806f6a20c6f022606ec6bb23855ee59f3486e1c712ce78412da366bc8f1421df5e6f3c26c1f81", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015212, "uuid": "3f616ad7-7349-402c-a715-4d6074c79e0f", "value": "T194643F38AEFA4019B1B3EF54AEE47483E96FBB63370E985C10D1034A4623945EDD563E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015212, "uuid": "38348493-9426-49dd-ba45-582627554dbb", "value": "6144:EJLTE81PsycsIwj/IwZJ8PkBg3I3nT98biISi12VBJlZL9RB4aw4c/2v3MiZqK:ElEsPsychwj/IwZJ8PkBg3GT98biISim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777015212, "uuid": "84a5696f-80ca-4da8-8528-dbdd54b4112d", "value": 316536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777015212, "uuid": "b6bb23fa-f038-4bab-bcc0-cad8cdeadd34", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015212, "uuid": "7de476b7-6ee0-47fa-a570-874599381757", "value": "SCANDOC234.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18008700-4032-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777071932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071932, "uuid": "8337ac58-2e71-4948-8fa8-8ff0ac239bb0", "comment": "Malware payload", "value": "aa04423e93265aedc48fa41d8758b885", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071932, "uuid": "f18eee0e-5d79-4e64-89dc-323859070708", "comment": "Malware payload", "value": "9d49ed07f55c68f2aaa92799afe867420d4d828f2891e4498385a1eb0d90b0e3", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071932, "uuid": "207413e8-951c-490a-8eb3-465e23ed55fa", "comment": "Malware payload", "value": "52846595d65609809097852b4e52376d69eb670d", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071932, "uuid": "7aee8ea7-8353-41f9-8c63-b12e2a904eba", "comment": "Malware payload", "value": "cbd8a71bfcb72506efc504fbc11049f39910376afb9f61af876b64426829d2910b27e67e1d667261ab8e9f487323c7d5", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071932, "uuid": "fc4806d8-0356-4e3d-bfc3-8cb774cbc804", "value": "T117052302DF387CEFEBA4F21C20DBB67C7111B580C51895EAABD6346A11658170D678FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071932, "uuid": "aea28716-e454-4c98-b3ab-ce12b131f95a", "value": "12288:sKusf75S6dJUS960wSnOpt2CF0RTZZH6FDW799Mpr0jM5mDEk7ap9bbuG:zTB+X4CsL6Fi99Mpr0Q5yEz9bbuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777071932, "uuid": "4b06cd68-b8e3-477f-8e19-a9b693386e0b", "value": 857754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777071932, "uuid": "7fdbe9d9-eaae-482c-825c-1776c4628b95", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071932, "uuid": "02e113f1-8360-4553-abb7-58cffe83ab11", "value": "SEAT.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c0409a-4014-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777059145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777059145, "uuid": "f531ba60-9b73-4dca-9caa-2bda0131b5e8", "comment": "Malware payload", "value": "64eb7ad3aaf9b6639ccc5c0b30b6e59f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777059145, "uuid": "978652d4-d8a1-46f8-b917-b4d41a181028", "comment": "Malware payload", "value": "9df11356c5ac61d2aa7b5425e6322fc016b0ed5790dacb201396500b3eee03f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777059145, "uuid": "16cb32c0-bed1-419f-b391-3dcd429dc0e0", "comment": "Malware payload", "value": "1eb377e01e1e649b3290efb0160f25cb5d13bd21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777059145, "uuid": "23a5e929-7343-4eac-83ce-d7218407ca24", "comment": "Malware payload", "value": "ffa30d9b4a92588087d66b2e03b8acc52aedd0faab74c9607100182acaaa97afefa31c5f021e90df51ef83e02d71dcdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777059145, "uuid": "05a46681-bcfb-4b98-9a5d-29154fe0fa82", "value": "T1D7F23B49BB58C12ADBAF0E7D75621A50167197521203CFD53ECC65EEFF937008612B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777059145, "uuid": "987f1ea5-1a87-4ceb-997b-cfd719398219", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777059145, "uuid": "34db7a01-914d-447f-8cb4-2629710518cd", "value": "768:dmQZqx1lYcTYbFyf8qsIVeljnbaoXbYC10kof:d0lYisIVeljRbPof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777059145, "uuid": "bc6ea687-3712-4bfe-bd99-b44c0ba8d46e", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777059145, "uuid": "34634dad-8950-4c6f-85b3-84b2bc024fc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777059145, "uuid": "613b353b-77f1-4ccc-bef9-8b56f30ff0d7", "value": "Silentum_Spoofer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0215553b-3fcf-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1777029375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029375, "uuid": "b2aebde0-110e-4d12-a6d0-5dcd162842dc", "comment": "Malware payload (CobaltStrike)", "value": "39e1091865c811de41e96f38609100e6", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029375, "uuid": "f33af958-fcec-4f1a-bddf-3f126a6a143b", "comment": "Malware payload (CobaltStrike)", "value": "9f238ad7ee69f9a519a3a82b9f90afb5cccc8db46b7b9501d7fe67df90afc9e6", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029375, "uuid": "1e38be9b-4527-40f7-9ab8-b751b0c6a146", "comment": "Malware payload (CobaltStrike)", "value": "98677ae959a73c9526ce62af679b0cf9270f7ae6", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029375, "uuid": "b402534b-a899-4b06-885f-2fa320c8d7e2", "comment": "Malware payload (CobaltStrike)", "value": "cb23b5d7759641aee3671ec7507a8d18eac7670ca0cce46c5e647efe4dd45bb25b665321dcd57cead1c614ff633140a6", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029375, "uuid": "bca26132-7232-48d8-b102-2387937f3c0f", "value": "T16894E01AB395BD52E923553EA9634B202FF6FCA60B28E36719D8321E5C733944CE0F51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029375, "uuid": "4ec44644-9d25-4f40-a636-6e91f42798e2", "value": "6144:X6yMzAJsd1M676mdi9Ijv2YEHU5tRHVLFwoymbdnNEE4otr8z6lj/:XAgsdPeDHU5jsSdnB4oWz4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777029375, "uuid": "e056306c-6bc0-425e-968b-88a7f70a7800", "value": 416463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777029375, "uuid": "f2bec53a-9dfd-421c-a4d2-ce64239141ab", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029375, "uuid": "8d8bd1d6-0024-4b81-9423-09395b72acc8", "value": "Internal Communications_230_malicious.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27dff70-3f85-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1776997915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997915, "uuid": "f57c772c-2bfe-4ba3-82cd-bb74e41e308f", "comment": "Malware payload (MassLogger)", "value": "d53873b8649c96b403f4281c4b232d67", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997915, "uuid": "93144b2e-bc6b-4862-97a0-eef7323ad103", "comment": "Malware payload (MassLogger)", "value": "9f74dcfaeb3a4e9047de4e28cc3515616e8a4c23fcb84a2dadc46f4bace80090", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997915, "uuid": "cbefd560-b5d0-4bf8-8230-4ef78e164de4", "comment": "Malware payload (MassLogger)", "value": "a71818c92228f99a4f65ab71fb357e96fb2c518c", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997915, "uuid": "a4d83466-f03b-4bc0-9c26-e32bbe091420", "comment": "Malware payload (MassLogger)", "value": "bafb73fb8ee3dea12012784fbddc392ed8b029442d4f766e82836c3da92c77b7dfa428bd2991e621fff42ae84e3f6cfd", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997915, "uuid": "d5ef143f-99f5-4147-b98f-b588fc9cc068", "value": "T10504125D29A5EA23A84B0533FBE388F699C11E91C4502887319CA9F97DE5FF1449FC4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997915, "uuid": "2244e629-cd3f-43da-acb7-c1b21ac1e8c2", "value": "3072:JeBBVbfLwNPJoFI82fsC7RAY5SGZPu41U9SYAzTcRq1VI0+2aewH1qeFrpOlJsjb:JevQPJom82fsC7RAY5ST4ncR0VIn2ad7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776997915, "uuid": "99b0c8e7-d6c5-40f2-8644-a8ab1291f2d3", "value": 174675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776997915, "uuid": "3df3c5e0-752a-4d4d-8fef-36f63a998dd2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997915, "uuid": "acfec0d5-fda6-4b76-9425-7079de50b033", "value": "Explore.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2019636c-3f79-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776992488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776992488, "uuid": "9a5bba07-6987-4c13-b9a2-ed206ba72668", "comment": "Malware payload", "value": "876576b16ec3b5c2c30a6743662336e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776992488, "uuid": "5912f09b-99d5-4f82-a9aa-db061f2c8b4f", "comment": "Malware payload", "value": "9fe657989e986244fc46793052ab80b4aff674d981f18ce2ed8b0ee2ab16e300", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776992488, "uuid": "349e0ba7-5509-44e2-81f7-d9719b887757", "comment": "Malware payload", "value": "c68d7af3f62165c36224fa96354c0d2ec80cbfc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776992488, "uuid": "2c227905-9374-4518-b493-f93afba5dc70", "comment": "Malware payload", "value": "d31a95313e913d48a805a2b3e30484b819d358072efb754b7e1578b4bcaa48b16fba0a2053088353878f0eb800d9ed9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776992488, "uuid": "45864215-852f-4f6c-9112-4eacb2a47c69", "value": "T1D2D68C77914238E9E5A98CB4D11025426DBC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776992488, "uuid": "e0a4bd05-7f3f-44eb-b441-2d25fe907933", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQa:cqYUQuVDt0TZEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776992488, "uuid": "b8e5d1f3-fd26-46d4-a76c-9c572bbf53a0", "value": 12943360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776992488, "uuid": "ac2618d6-91ce-43e5-86a0-0875043c2694", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776992488, "uuid": "743a1403-d0b3-4a75-9e29-0696129d1914", "value": "9fe657989e986244fc46793052ab80b4aff674d981f18ce2ed8b0ee2ab16e300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be42212a-4007-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777053742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777053742, "uuid": "74ecfdab-f83a-40f1-9867-a36b1ec06392", "comment": "Malware payload (Mirai)", "value": "d738e317e9b4bc123de0a089269caa6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777053742, "uuid": "3ee92af3-236c-4330-92fe-185cba8645b0", "comment": "Malware payload (Mirai)", "value": "9ffc423254fa44e267ac4afe81733e0b08c54aac022a2ffe90f9ad353f117897", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777053742, "uuid": "5b2b1817-4cf5-4791-8abe-ba09d5de08e0", "comment": "Malware payload (Mirai)", "value": "26df344e273cf4deb5a37206b852277dcf631b20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777053742, "uuid": "67dced56-efcb-4735-951e-00a43d7f37da", "comment": "Malware payload (Mirai)", "value": "dc5224002ae6c73b721870b0599803cfeebeed896e44c99cb2dc82330c38f22992087f4e69155eef4ffc82722244937f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777053742, "uuid": "8f206180-79fc-4a8f-913c-259262f6500d", "value": "T16A73A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777053742, "uuid": "71d5aca9-45b3-41d6-998c-8542d97760be", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStM:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777053742, "uuid": "a4a99fcf-9a13-4210-a58a-1c377b748624", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777053742, "uuid": "e98c0897-0d32-475c-89ee-8a81bddf2e44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777053742, "uuid": "d4e2b824-715e-4082-b1fb-e4d9b05fc340", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517c4353-3fb1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777016623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777016623, "uuid": "2859ecf9-bf53-4a81-9d74-5952733e4971", "comment": "Malware payload", "value": "3f9f0aa680c3c9d35ecc7d6baae0e145", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777016623, "uuid": "ca8ab910-6efd-4c50-980f-8ea8f671233f", "comment": "Malware payload", "value": "a045c35ff3c2323f4388e08b374e20d781d29bc6dcb873880cdfe12df05903df", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777016623, "uuid": "ac8f63ea-7cfd-4ced-acd2-e4e6f0d99d8a", "comment": "Malware payload", "value": "aef66685564b611c8d5019722c2bb64866181eec", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777016623, "uuid": "c2105418-5ca0-43ea-a023-3f08ae96ff41", "comment": "Malware payload", "value": "2051b9bbb716ac7d5c7b9a75566918a5aacd54f398d66aeb0a2ef52dafda2872af78af5a4c8e3bb9bd924217f76dc9a1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777016623, "uuid": "de3a6494-fc11-4132-8b96-afe113703a50", "value": "T197540B243AFE5019F2B3AF95AFF874968D6FBA733A06946D1050034E4623E41DDE173A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777016623, "uuid": "1da12987-cf17-47e3-a5d2-cab31affd3fa", "value": "6144:a0ZT+j7CyOKbXr74olyUWaDKi60ltTzuu16:LT+j7CObXr748yUWaDKi60Tb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777016623, "uuid": "7682ded4-4a25-499c-a1ba-82508fa58f4f", "value": 282572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777016623, "uuid": "fb210490-e295-43fa-ad5d-06976bd6f033", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777016623, "uuid": "7e95d73d-e1b4-4a73-a52b-37f032051946", "value": "PRE ALERT FINAL DOCS HBL & MBL.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7606bb9e-4004-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777052332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052332, "uuid": "0b3b0e78-2b55-4791-9276-642a60602bc3", "comment": "Malware payload (ConnectWise)", "value": "abcc6480f8db73c0429991944f8c42a3", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052332, "uuid": "78d1c170-9caa-45c4-a132-f27b4315d790", "comment": "Malware payload (ConnectWise)", "value": "a1e14b4f0d460ec7f281bf2e4d307055cc018d3761a72c55f6703dc996ef198f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052332, "uuid": "6f8ec5eb-6386-462f-b16d-c8b50a0a1ca5", "comment": "Malware payload (ConnectWise)", "value": "6c78aecdeb74e1445159596072d404a89efb7422", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052332, "uuid": "e7e1baf9-26ff-4b5c-a8af-5da74d96ac42", "comment": "Malware payload (ConnectWise)", "value": "c62587ba3414f95489d42cd364a7698caeff51f2a75c974b1570935d232689eed891003135cbe9f1e587754f7eeb8c2a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052332, "uuid": "c5a9f007-d91f-40d2-bf1d-d5e765a90373", "value": "T17DA623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052332, "uuid": "af524866-9df0-44b3-bc17-d10bdb58050a", "value": "196608:/nCtVYqI5MvbWEpKkq1IJqKDnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqWnCtO:vCXvI5MvHxdJVCXvI5MvHx6CXvI5MvHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052332, "uuid": "324f8c7b-0081-40d9-9747-e4b8b8f5fd5d", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052332, "uuid": "42a5ee11-aae8-455b-bf5b-2917d305d872", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052332, "uuid": "dadca346-6e56-4df1-9a63-2851f265c57e", "value": "ScreenConnect.ClientSetup5.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de072ab0-4037-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777074411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074411, "uuid": "7a51f84b-aa55-40dd-b161-1ca5c528d36a", "comment": "Malware payload", "value": "9d3f05cc81fb7c0b6d9ab1acd7d50013", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074411, "uuid": "83324867-6286-45d2-9e8e-30130137afe5", "comment": "Malware payload", "value": "a23c893440466a6476a43c5d33bceb21054b1e0ae1e277c8ea6680a517a963ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074411, "uuid": "87f1e029-7705-4390-bb76-4cff7d181045", "comment": "Malware payload", "value": "2be938603936bd4fde5e0a3c71741073f2b5d714", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074411, "uuid": "b45855fa-aa26-4a5c-b4cb-b2b9e8eae36a", "comment": "Malware payload", "value": "28b1320068705d48c99c6124c97bfd97dc29bd0068c9924ba7dbdd07cfd7421fd6630a73909dfe7891377f3f3a561e2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074411, "uuid": "60f504da-6f73-414d-b560-ecdf0c12a2a7", "value": "T130E47C627711DFA5D314C67005F3C7614AF521A20BE2508AB278C7287A61A2D6E6FFFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074411, "uuid": "45204271-958e-4a47-85a8-8ddee0d1811f", "value": "12288:B44zvRbSnqPn0M6EIAqFIgvaM7nwsU4Udo68p0oXOyT9a9oxZP:S4zvRbSns0MVIAqF6M7wsdUdq+gcoxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777074411, "uuid": "db89e68a-cfbf-491d-ae0f-7e7d8898e3de", "value": 683232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777074411, "uuid": "18990328-da4b-41eb-b3d8-bc33a3629066", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074411, "uuid": "f09cf4b5-e73e-433e-95e2-d5e37a07997a", "value": "l_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31cc719a-4039-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777074981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074981, "uuid": "b8620314-d625-4542-8e5a-404e797ddd62", "comment": "Malware payload (Mirai)", "value": "56893cc3830d2ee8b7b6da9e89a3953b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074981, "uuid": "dc4a3f0f-646b-4a10-bafa-d9c4c618177f", "comment": "Malware payload (Mirai)", "value": "a265578d5e332580872c3ad94edc3668d68b0ce4b090227d8146955ddefcee95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074981, "uuid": "a689c7fe-d89d-46d9-9607-d33b156dfbf7", "comment": "Malware payload (Mirai)", "value": "c0da2350f6bd0e1e19ec47f88d29d454097213c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777074981, "uuid": "15d06a4f-03dd-45e3-b5f0-806f8b58f859", "comment": "Malware payload (Mirai)", "value": "d22196ea4756fbfb73e76623dc76f596187195bf6400bd83d3ab6c69af347b191ebd32462211918f0bf16caf074b7226", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074981, "uuid": "1863adff-cdcc-4bc0-a046-83ed4d29029e", "value": "T1A6D4E74B6E328F5DF674C6318AB70925E76833D723E18685D1ACE5205E2068F941FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074981, "uuid": "5fb39fa7-8c50-40df-aa99-79bb156e9980", "value": "12288:oyM/O/zvepc/YEdhJy7YfYjuBDOkwqn2x:oyXOQYEdhJy7vut5w+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777074981, "uuid": "4903b276-4315-492e-8429-db2eeaf30b9c", "value": 615436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777074981, "uuid": "38c31701-7d5c-425a-a072-43c94cb9a46d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777074981, "uuid": "847fc100-d3c9-4460-8b2d-1ec483badd11", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7dca7e9-3fd3-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1777031371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031371, "uuid": "3b80c735-c855-47e7-b489-ed2bad953802", "comment": "Malware payload (VIPKeylogger)", "value": "517d9860efd2f0ab0c870fac863499e5", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031371, "uuid": "41d9ff61-b805-4234-ac21-bbf75eb38e1f", "comment": "Malware payload (VIPKeylogger)", "value": "a272e8fd1df7ab3326de9dd8a81cc9b6d82f8c14cd2e112e820e944f4dc0561b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031371, "uuid": "b69b434d-cebf-43c3-aa72-fb359c6cd4da", "comment": "Malware payload (VIPKeylogger)", "value": "4b47af7bcdff8d42229c9cf56217c51609a6faac", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031371, "uuid": "c2deca9a-4b3e-474a-9b9a-c80d95c5efcd", "comment": "Malware payload (VIPKeylogger)", "value": "c7601c5836efa39b7e1aede64c27fa283966d1ef7f09b87d0641128dc68d3e00b8497f3b4314f77f39bba125195d81fe", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031371, "uuid": "25696311-b042-42ee-9d2c-d363e6dd1f80", "value": "T13EC4F21245CD5F7D4EAC691C80FE261EA3A14BCF941B698EEB237D46AFFB900420B1D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031371, "uuid": "7bfd3f1a-5aca-455f-a7dc-3618a24c881f", "value": "12288:j35GytNcstYxJKxVFRZvdsIoaJ/qBLvo5ZNBhPMYUB/FS/:jp5PcGOKxRduIDJyBLA1MtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777031371, "uuid": "0d32dafe-a7a5-4275-9918-3d601c17bde8", "value": 563906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777031371, "uuid": "9ca4207a-9ced-4ee5-b9e9-9c9189e07d07", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031371, "uuid": "df87c22f-fc70-444b-b02c-6207bffe492a", "value": "MUSCLE.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8424c6-3fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777029931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029931, "uuid": "8ee40ff6-173c-426b-9a2d-d7b62375ac5d", "comment": "Malware payload (Mirai)", "value": "c8580912238680d6ea886952666d7eb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029931, "uuid": "ea961581-2141-48e6-9323-30d11623a0cd", "comment": "Malware payload (Mirai)", "value": "a31d3ad4fdad619b214002ffced938880d5c9f9a9bc13a3adcbbb41955a941b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029931, "uuid": "3b6be43c-b50c-4351-873c-441b2758fc12", "comment": "Malware payload (Mirai)", "value": "6f22f155d33419a46004533d14536a32960793e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029931, "uuid": "4e3abaf4-7a27-4b99-82e8-26c39ab4fd1c", "comment": "Malware payload (Mirai)", "value": "f796eff9ef009734a484e3f737723f559d1bd623334f0f5dec192ec07b94248fba47f72815dcd34438dd13d3a57a0777", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029931, "uuid": "f29afe40-33ce-4ded-ab42-835c24ad2673", "value": "T18D838C26B5669F76C10306B465E68C350F52FDC54A632DF2F6A08EE940479E8F018BF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029931, "uuid": "04b698fe-5dcf-416b-bd26-c4bfeba2d813", "value": "1536:QakjZNHpYFtOwtzC7sHuu1DCfs3S4ok/qGI+GLL8RnACZ7NE:QLRpYzOvgYf+SL8G38RnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777029931, "uuid": "99b5124a-eafa-463d-b30b-a092c92c8143", "value": 84932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777029931, "uuid": "866f2087-90c8-4499-9c1e-591bf74774c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029931, "uuid": "c190158c-b5d1-4cd1-9492-8ea107831478", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3d9ea3-3fe5-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777038869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038869, "uuid": "8e0c91ee-4e91-4504-8ee6-ad7b5674d579", "comment": "Malware payload (Gafgyt)", "value": "2717940b78a599e32ab7909c9188a4ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038869, "uuid": "6f3e9108-6bcd-4fb5-b2aa-6c57957131be", "comment": "Malware payload (Gafgyt)", "value": "a39ce586add5eaac9cf5088326377d267c7d1f149ffbdc9f57de687c27a5009f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038869, "uuid": "774a86ca-2bd2-49e3-bdbd-ea2f8af64475", "comment": "Malware payload (Gafgyt)", "value": "0d768cfb3e9c80d18e719c40fa91e815449620b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038869, "uuid": "a562e6d8-f550-44ff-b187-3912f1f43a26", "comment": "Malware payload (Gafgyt)", "value": "28346d479e323c1789092851ed64db9702d3b54a7f20269f9a6180a7fe28733d351afa4e2584ad01cae50332e6dc20b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038869, "uuid": "1018bc4e-27f1-4d0c-bd75-3d0913cb2742", "value": "T148245C03B58190FEC4DAC1344BEFB636DC75B45D1238B29B27D4AF222E5DE215B2DA84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038869, "uuid": "ab059bc1-74f1-494a-add0-b9dddc11e610", "value": "6144:RnOklXE2oag1vHG7L5C6xVqtgN7TFM5Ur16:RnllCY5FGaNY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777038869, "uuid": "e28493ee-f615-4ac3-830c-af2dd8a3b929", "value": 210696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777038869, "uuid": "6eda0589-2d24-44da-9402-6d89780b5267", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038869, "uuid": "5741b6ab-9e2b-4e6b-97f0-030ce8876cd3", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d5f741-3fdd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777035788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035788, "uuid": "c441206b-8652-4715-b9ae-7d07ad23ffc1", "comment": "Malware payload", "value": "265234619544a0b29497165021a666f1", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035788, "uuid": "468b00ff-5937-4649-8218-fe145d08a4af", "comment": "Malware payload", "value": "a3d7fa6218c0c143ee080bb208588200129420a8749b38b7c733f15dae578367", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035788, "uuid": "4fb844dc-7a78-455b-9e11-b37d83d96186", "comment": "Malware payload", "value": "7d2edbeb9e8444c4ef2ddd8756f8b0a869277397", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035788, "uuid": "1297f7e6-e589-469f-a758-f9e0e729a32b", "comment": "Malware payload", "value": "6e39ae309722fbef2503345165bcf0cadccc8ea23d5aad873e3f9258063db25b610c3cf19d94a110f24c48608920ff0e", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777035788, "uuid": "9f013b5e-0d71-4812-87ea-35d6788dda2b", "value": "T1B133B6EEB56BCFD69E3B8F9097367D931DB2F091447048AF508A78CA9319D4AC04E172", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777035788, "uuid": "1c55c034-8e86-4f75-abf5-688ee200381d", "value": "768:LQYRwdr49hqNPSlysBGeb8tr9Kbz9yGh2pfO6GuBi/skxOjZR9JgD/vtK:LQYRwdM0NSRYPr9e9VoxmukkpvOtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777035788, "uuid": "d1b3a00a-139e-4033-b202-3f82218d9313", "value": 53009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777035788, "uuid": "4e277d4b-9d15-4346-9958-fa830b2ee175", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777035788, "uuid": "0c2742ea-6bad-41c0-92c0-306c59ff7352", "value": "lzstonefair.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8744f3f-3fe4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777038781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038781, "uuid": "7714ea87-8a97-4baf-b62f-2150d6a9045c", "comment": "Malware payload (Mirai)", "value": "363cae33612a6e683c67e84a27e3ea79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038781, "uuid": "7527b88e-9f31-4693-ba92-ee005a59e8c5", "comment": "Malware payload (Mirai)", "value": "a43333cd49455d6c65f8bd3ccb910120a345078dc29bc140c7e994bfe2dfbd39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038781, "uuid": "a10d6ecb-bf6b-4152-a25e-f8d19933d456", "comment": "Malware payload (Mirai)", "value": "c0635d1a6bcb2cf9761021d456f2936f61da3ca0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038781, "uuid": "2afcfff3-d15c-48cd-ba2d-668db0a250d1", "comment": "Malware payload (Mirai)", "value": "fe4799c6be5754ec14eb95d89a97ee224c69073b3737ff82ae56b5ca9b2ee8ae635f446884c68cacf7f57342af6381c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038781, "uuid": "4d314d1c-bba4-43f9-b9d3-c309a8dfe0c1", "value": "T1B8245CC7F801DDBDF90BE73644570A05B530B7A210934B37626BB867FD3A19A0927E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038781, "uuid": "7fb09b0a-bbb6-4505-92fc-d8b74a610f33", "value": "3072:efwidoWBCUCIRzTOWiQIK+mLKUSQrtKuiA+TySNEW8uzvxDkni/6uipkVVjbi/LA:hidZBCUCGlzW8uzZDnHip5LBByZncbCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777038781, "uuid": "85bc1119-4eb2-4ada-a66a-41781d8b5190", "value": 219200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777038781, "uuid": "d128281d-04d0-4ac6-b34b-f1207f01d008", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038781, "uuid": "6f4fc03f-73ff-4260-810c-25fccdc6611f", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dfcfbd6-3fa8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777012698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012698, "uuid": "6c3854bd-7cb1-4548-9465-df6b25f0558e", "comment": "Malware payload", "value": "3b76bd4e74cd7295610ec162cdfeaaf5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012698, "uuid": "dc0cb43d-8c94-4b31-b76e-1e1ee4d567b2", "comment": "Malware payload", "value": "a43d47cdd979a2d22a5ca513cd28b376802afcf96bea135b745788ddbecaa4a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012698, "uuid": "b851890c-561a-4d90-9d49-ac525ee6176f", "comment": "Malware payload", "value": "4b337d1af0906febd4c0ac9b5013ec36e7ceed27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012698, "uuid": "ea816c44-50e3-4d83-a838-72716942980e", "comment": "Malware payload", "value": "3a3259ab26aa81702ad70b556e41d51b5d7fa03ac26d747a78e25e8b5e1aece24297812c3973899185766751232b7d53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012698, "uuid": "7ba26020-c690-450c-a547-aec4cda63e7d", "value": "T1AC243CA3FC01DEBBF81FE3B285534C19B230FB6128531A3661A3BE9759350D56923E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012698, "uuid": "e802cbba-7bd4-4841-8d6a-3df17326a249", "value": "3072:vr+HwlBbqqKz2lF6jIpRkrPyRyy9Q2pERGFT2l3vlTxpV/VIjbigLer2gA2p4:hCqSIFN4y9JpESTShxpGLerx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777012698, "uuid": "6f061629-2736-4faa-94e7-c8643ce0face", "value": 219764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777012698, "uuid": "20dfe479-089e-4374-9f44-64c8f085c897", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012698, "uuid": "23832ffb-08ab-41e9-813f-a60bbea6007b", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b4dd33-4033-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777072599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072599, "uuid": "051dca72-ba01-4252-9822-b5a4a3370b75", "comment": "Malware payload", "value": "6840c09288e023a6615bc55bfff8aafd", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072599, "uuid": "d69fb380-90cb-431e-99fb-1f4c78671348", "comment": "Malware payload", "value": "a4f2703b48433d36a948aecb78f243f8b1f0c7c9ac2c88061a1b91872d082212", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072599, "uuid": "604dac8b-f69c-4418-a375-dd4458d85f77", "comment": "Malware payload", "value": "ccec4eabc8591b6ac520b703ec6baa3428262061", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072599, "uuid": "e44450a6-efb2-4452-91cd-d771b814fc19", "comment": "Malware payload", "value": "0521247f9416ca1abea1d6127ea92a1088f01de9c67642ef367eb8c84d2dd013c1212a66c7e79e323dc186cebbb1f721", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072599, "uuid": "a044e130-96e2-4212-9a4e-7ef2c8a6de05", "value": "T196665A21BA4A99ADC05AC074834686725A353CCA0B35BAFF45C4B6793F79AF41F3C358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072599, "uuid": "57c97705-afe5-4918-a587-d07939693857", "value": "5c6a5f1bde84770b87a3e447130728dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072599, "uuid": "aaf8f6a8-99be-4e16-92fb-9cd669619071", "value": "98304:lOHbQdxVTKd+mshq4pzPhz4i8CJV+oFTZF:lpPKd+jtrhz4oj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777072599, "uuid": "12939270-48dc-4bbc-b82d-525da4ee3521", "value": 6797824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777072599, "uuid": "94e5a4e4-cea4-4fa6-acdf-4e55867c8d9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072599, "uuid": "aaa1f4be-e837-43ee-ab67-16ee112d7c5f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61cdec38-3fa0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777009349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009349, "uuid": "4ca03291-c07a-4049-ac45-cab50d15d929", "comment": "Malware payload (Mirai)", "value": "686be8f9723ec43b7c8b51cca52fc5f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009349, "uuid": "089ab15b-0146-4598-b050-1c055b39944b", "comment": "Malware payload (Mirai)", "value": "a530187d666f996d308daea3f08eeeb6d67252bf2f491babd3815b882c265246", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009349, "uuid": "efc961af-3091-4556-bd34-14ec61ae1729", "comment": "Malware payload (Mirai)", "value": "610949777fbd4e136880c99df41d7e6e8bcbef8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009349, "uuid": "3078a55b-6a43-46d7-abf9-2402d5f74c45", "comment": "Malware payload (Mirai)", "value": "011090c472c0c693ceaa43607d8d08d72fc2930262993abb054c5a67ba2924c0182300119fcadd553c3b452d870538cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009349, "uuid": "938d50dc-6795-4f36-943b-e984fb6be163", "value": "T1A9830236E02FD97DD739DD7068460B12FAB2FD659571084D1A903BCD4FB22542D2CE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009349, "uuid": "e9806ceb-6ecb-40cf-a6c4-d606f4a726d7", "value": "1536:5BB4acZUgIg9Lqpxk8vwgDHb9VAA1/dft9FoGDUNif6zKGlexNVEyfvNUjMz:VNcZAg9GpxDvFrZVAcV7oif6HXkUQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777009349, "uuid": "7659b7f1-240e-498f-8d4e-0c7868c27ff5", "value": 87800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777009349, "uuid": "06bd72e6-c32b-4e6e-92ec-e6dfa4701682", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009349, "uuid": "38c47d79-2961-4353-a921-613904ec5d84", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58026a20-3fe1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777037250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777037250, "uuid": "19b0b4ec-32db-4d31-b87b-70ad10df0c56", "comment": "Malware payload", "value": "9a1d26c1eeecbbda78dd99024cf40da6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777037250, "uuid": "8bfbd846-7e6b-4bfd-9606-cfa7bfab2941", "comment": "Malware payload", "value": "a65c9a25515bf85ae6be27ff07de391721cb095c7556baf9020d6f132ea00c6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777037250, "uuid": "57b457d3-f520-48a3-aaa7-cdb10680040f", "comment": "Malware payload", "value": "217b659be0a634249d7cc6dd88a0175e8831ef9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777037250, "uuid": "5c3092ab-5320-4051-8382-2ce44e82bc51", "comment": "Malware payload", "value": "348b417aa9875174810e2c08c28bd616214fc2c7a93a22058503f899becd8aab011dde3c513b8ccf3b7248e778e75db2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777037250, "uuid": "6f929f77-07d0-4d20-a26c-2dd93d0f5f24", "value": "T1DBC3124AEF369C0ECB402DB226DB5F8E9C6D7A5B41CBF4A879C1C18F17A01CD7952225", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777037250, "uuid": "f7d353df-7ad5-4bac-8858-c998731525e6", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ1y:p3lOYoaja8xzx/0wsxzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777037250, "uuid": "a6b80587-2e74-4148-af7a-14d6df86c3da", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777037250, "uuid": "7656b86a-1a69-4ff2-aa98-c83f4bb9857e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777037250, "uuid": "78b82af2-3090-4c04-8607-dcc63896dc74", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6978a6-3fe5-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777038947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038947, "uuid": "9980cf1e-a1d8-4ca4-9f63-dbc6343ee6d0", "comment": "Malware payload (AsyncRAT)", "value": "8f2c542644a575901be16b4af72046b3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038947, "uuid": "23a6a985-83f6-4e06-a3e0-9515816da2bf", "comment": "Malware payload (AsyncRAT)", "value": "a6eefc0acd6b5e512514a8933ec9f6059af268c364301e1fe8e11c3fb3888a5b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038947, "uuid": "4de34c9a-8222-4bc7-864f-554282bb373c", "comment": "Malware payload (AsyncRAT)", "value": "849eae30f4e9dd9a81bf9c56285e3e6ee36d309e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038947, "uuid": "7c592cf5-5cbb-415d-a2e2-deb9d91ed2a1", "comment": "Malware payload (AsyncRAT)", "value": "7c866247da566897cb72392383bdf5ef93a233c2d5ebafb43dc07e2247f9bb17684ffec2513281ac6e6b026f0759858d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038947, "uuid": "caeeb12f-8859-4e76-80c3-2aa0ceedfb39", "value": "T150057D06A3E416B4D63BC238CBAA4233E6B674450771AEDF0755D6192F33AD06B3B325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038947, "uuid": "cfc36a52-7f2a-4e89-bf96-3dd1eb501bea", "value": "f85d177290927e88420ed0e6e8e78e0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038947, "uuid": "679161aa-9a3a-4c9d-ba03-080c2579ec57", "value": "24576:xCHsU1fWO7xvVC2FtJu+DYFNex26xMoGM:xC71uORLu+DYFGleM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777038947, "uuid": "fb7bf385-c798-429c-b7f5-7e957bfe0cfc", "value": 800996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777038947, "uuid": "08ae226a-c49d-42e1-bedb-49285597f214", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038947, "uuid": "8fe3a0da-2389-47f8-82cc-4dd08b048426", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a6ead6-4026-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777067116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067116, "uuid": "f6029bf1-f6e4-42fc-83c3-a0c5c99fb613", "comment": "Malware payload", "value": "ec8afe50a7d0bbf2a3dec7f89c682a0f", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-cv", "colour": "#603258", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067116, "uuid": "43b9c339-5c6c-4080-b0d9-29f01a42cdf2", "comment": "Malware payload", "value": "a7148992783e92579b859694d3ade3b059df53cf666cc6d0e52786fdd120672f", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-cv", "colour": "#603258", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067116, "uuid": "14daa32c-915f-4372-b207-f685de886b25", "comment": "Malware payload", "value": "7fbe2e41ac9031e9bf414ed2096716599f4ebef3", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-cv", "colour": "#603258", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067116, "uuid": "c8e5bfbd-851c-443d-8621-1ab24a9af513", "comment": "Malware payload", "value": "1ac28a5d2eee6c4731091631e14b77ae77c8576d5e76d2d3c3dbe4daa0b0e8e4311bce6dc980b25007adefb85bc81449", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-cv", "colour": "#603258", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067116, "uuid": "b200e4e3-e1c3-4430-a81a-7fa85d276eed", "value": "T1F60733C79936C8E0C9EA1D7545E682792127B6387DF1B3EA344DCA6BCE864724C33319", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067116, "uuid": "25833da3-9ce5-4503-b666-f1f946ef71aa", "value": "393216:rmBuoTBpnNFeCSMRHrFSVml+A+fnciEbII8gyYH7zJQs+l:riuWnK5MRUMInciE38ghH7NQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777067116, "uuid": "255486ae-7a76-4964-b298-c8d584dd00c7", "value": 17291264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777067116, "uuid": "d965c77e-9d61-4c97-8e64-58187069518c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067116, "uuid": "8c180c29-86a9-4828-8a8b-674d2c94f5b8", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b89316e5-4005-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777052874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052874, "uuid": "a5352cff-7315-40e3-aaee-e8ecfececef1", "comment": "Malware payload", "value": "f17cc0ddbb2eba56a4c80cdf340f1c81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052874, "uuid": "3f8b353f-b75c-4124-9151-5db3af8b0757", "comment": "Malware payload", "value": "a7be087ddde1764ff1c77ab0129d7f265bec7ff73c842b33b690b9b8a6b6941b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052874, "uuid": "3ee4fb05-ab78-4773-8a07-f9d09feec48e", "comment": "Malware payload", "value": "d8164d77f02e77ada900f87318714050b5dffc10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052874, "uuid": "e7d99c5a-7932-48d8-9d16-9b2d2c645a94", "comment": "Malware payload", "value": "cf11e8ac7a38be5b1adf1099043f635838abf5d068e0c583ee1123b398bd3d6f4b068663e2e49157c940360871da6116", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052874, "uuid": "5c4d73c7-42cd-40e7-9710-62188a1d37e9", "value": "T1A385E18AF793D4E2F29341F6024FC7E20574A5166053FAF2EB449E767872B922F1621C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052874, "uuid": "f70d3344-38be-407f-8d9c-111a73b2e8b7", "value": "24576:UaZSKQphYuhMEZ10ObJPFEnPV/wyQBWPBnMwTTe4EXiWHz0Xlxi8I+tnAAxg5zQ:FZSKQphYuhMEC9m05rioXlA8IQnX+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052874, "uuid": "2646ee51-7c36-49ad-81ec-950f0db9583a", "value": 1717880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052874, "uuid": "449dcd06-ebd1-41fd-bf0d-72cf7c44c745", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052874, "uuid": "eefc98ef-264c-4eb1-8b98-0ff5cb0f48bb", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e665584-3fb0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777016081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777016081, "uuid": "b01cc8b3-ea31-4b2f-9db6-3fae61818aa8", "comment": "Malware payload", "value": "673e50ce46b6726599638055f6ca65a1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777016081, "uuid": "c66b83dd-b96f-4516-a766-47163ada26ae", "comment": "Malware payload", "value": "a92fa2829498349661641378a4bb8d85a46fab5bd96af87c26e490f32cae63cd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777016081, "uuid": "4a5953e9-089e-46b2-89db-32d50aeffcc1", "comment": "Malware payload", "value": "b71c001c23142fb86079927a18c5e1a095d1953f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777016081, "uuid": "74bd3307-eb45-4c94-a50b-891cc76520f2", "comment": "Malware payload", "value": "63a091c66f93bd5129c7631af8e86c5eb2904052ae29c6a29c3b401529c1fcec54287f5ea3c5668b7e98591f8b643027", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777016081, "uuid": "7a301db1-fc57-486b-bc3c-74fc11fcdd7e", "value": "T1E3F0B4C802B920390AC79A0B53228984F798C054F82359BC8FDCE895A894C60382CBFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777016081, "uuid": "d33eeaa3-2ddd-4ea2-ac7a-de03f68ff20c", "value": "6:lOnFflE0Fr4KtHiMxJ4KtHiMBviMuiMTf4yxocbnMAMQrAgD4e86PcbZusmQ4vD3:v0FrtJIrBTNnrrI2iED5N7Q5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777016081, "uuid": "9233a58f-758d-4a01-8e28-06c3eb4524cd", "value": 533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777016081, "uuid": "d38442a6-5b68-456a-82be-116bd4269cfd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777016081, "uuid": "30859791-d80d-4efc-994e-4c536e5e8d90", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443b731d-4027-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777067281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067281, "uuid": "a7c2026b-d365-4a5a-9f51-b457ac1358d5", "comment": "Malware payload", "value": "2cb83908a07e16a37649b726409c5a31", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-7839", "colour": "#7DD427", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067281, "uuid": "e7be2ae5-7136-4afe-8cba-11d189f3e46a", "comment": "Malware payload", "value": "a9ceb15b30ce7959a03f9893214c8bdbbaed1976d89336aaf46d6f55ec05fed0", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-7839", "colour": "#7DD427", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067281, "uuid": "a587192a-d1b0-444b-a084-bad057ac8079", "comment": "Malware payload", "value": "bf14c0d8630128a5f6ec35be95a812bc20180eca", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-7839", "colour": "#7DD427", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067281, "uuid": "918aa470-fc30-431b-8ccd-c65a601564b0", "comment": "Malware payload", "value": "21167b72f21afc08896ea2144c96aed730de76797136389049a00a44cdd3cd2ae3bd098c46f3bb36e0d4355a436095cf", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-7839", "colour": "#7DD427", "exportable": true, "hide_tag": false }, { "name": "snconor-vg", "colour": "#ED4130", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067281, "uuid": "74a3a7e0-429b-4428-aff9-3652db844237", "value": "T1B2073377F8DF41B4DD0B6754882BBD64A2E580703712F1E68804AF99CAC3D1C99A5FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067281, "uuid": "f200dc00-45bc-4c50-88b1-570694ef7a71", "value": "393216:3mW1RFSlEhJPyNaVhfry9Nu/F4r3EmPo5qoNcIu80:3h1R4lSKQV9yDrUceTuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777067281, "uuid": "b85dfbc9-cffc-4c42-ab18-3eb3e82681c0", "value": 17213011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777067281, "uuid": "39e7ec5e-7c4f-46f8-9e12-156710320393", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067281, "uuid": "37906d27-5bd3-4dc0-a6af-79733fed48c2", "value": "cx-programmer 9.1 free download full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4facef-3f85-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1776997931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997931, "uuid": "73c961d4-b60b-4c31-bd28-21ca45454893", "comment": "Malware payload (MassLogger)", "value": "dccee8109c0971134e64dbbe6edfc790", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997931, "uuid": "48810541-577d-4410-9aab-46b17d67bd37", "comment": "Malware payload (MassLogger)", "value": "a9e0ce00e3740763c8a250cbb82df814569b92446950ebb3756e2eac31ff82b2", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997931, "uuid": "f59b410e-4b39-4cdb-9613-e85403c1da70", "comment": "Malware payload (MassLogger)", "value": "42117ded7fe6b0eedcd0d39bc4791487570c61c4", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997931, "uuid": "bf5c74b4-0562-4893-8796-ee37c6c10109", "comment": "Malware payload (MassLogger)", "value": "b32a22085990b9c5fd385d9bdd8ebeaf0cecbc692d5329191bda3fee627bf09b53f259275cea09a881812abd35c1ab0b", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997931, "uuid": "00bdb2ae-6b98-41a1-8a47-7929cf9eecce", "value": "T1AF83122A9F7E96C1311368B31CFE0A79C96139BF160B7720F99D4E600D3298A172F135", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997931, "uuid": "d8fd1bdf-464a-445c-91de-3198dfaed8a2", "value": "1536:QPf+ieomRFgc0bQ0Mdw3HlwBIvr8LMuv2G01CJFtyT7WtClDnLWCk+x2ynG:Qf0RFxZ0Mdw3HCBg4gK2G+YF8Gt8nLMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776997931, "uuid": "b9887c6b-0668-4798-ba9a-662050bdf128", "value": 88116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776997931, "uuid": "1621028b-9f39-4938-bfe2-432d9659837d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997931, "uuid": "c4870852-c8d0-460b-8dfa-79cc8e4f5443", "value": "HOME.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6195cd3d-3fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777029964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029964, "uuid": "b37190cb-2643-4c75-8f61-b5c23c9af040", "comment": "Malware payload (Mirai)", "value": "7cf57ac0b11fe45db6f5496d83691e86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029964, "uuid": "95288979-658c-4897-908c-9f19c2d4cf09", "comment": "Malware payload (Mirai)", "value": "a9fba86df96a672d1dbe32833b8ec81eeec35153d1990427f43b02417ed8d8d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029964, "uuid": "7d35ff88-e072-4240-9e93-7d6367f728fc", "comment": "Malware payload (Mirai)", "value": "bee9db15f1cec471f640d8fb498c13e4c9bee6cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029964, "uuid": "b26efbd7-b85f-4e52-a626-0858f1be73dd", "comment": "Malware payload (Mirai)", "value": "5f90e6bb08517cd47a303af3109eeef64343ecdc0d883e5905de07ff8eda97d031b2698f93a68dda7d36513eb33447e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029964, "uuid": "08eec104-82ab-481d-af7f-b1e4909115df", "value": "T11A732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029964, "uuid": "211dfc52-cda3-49cc-8408-8f11966b2715", "value": "1536:9D/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9Wa:B27jqCt8v3GI/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777029964, "uuid": "2b286045-06f7-4a8d-9dbc-4633119a6986", "value": 74848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777029964, "uuid": "acc9d355-21a5-4771-a063-6090671041f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029964, "uuid": "05c9d601-fda2-4b56-b579-2e6e379dac81", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a773c6f-3fed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777042274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777042274, "uuid": "7e10151e-acab-475e-8861-2159b6f26a3e", "comment": "Malware payload", "value": "4550764fa8eac6faffc829398ac8a5a7", "object_relation": "md5", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777042274, "uuid": "eaeb2572-6d01-4dcd-a09d-020b2de3162f", "comment": "Malware payload", "value": "aa3ca3fd64cee897dd198d9d67c46e1ff183338c27bb17ad746dafdcde6d9598", "object_relation": "sha256", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777042274, "uuid": "18b5d55b-f51b-4c5e-a073-93320c6c4906", "comment": "Malware payload", "value": "a7046427a84fee2c8376bdcfa80a01f8eeee9982", "object_relation": "sha1", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777042274, "uuid": "79770002-58c0-4986-be1b-3e380db33e40", "comment": "Malware payload", "value": "5730f69efcbd57306e72c28b1ffdd7c9c3bba4c8354a61b89b169088faebadab23b6912ecc68b9965902f4f9998b1f59", "object_relation": "sha3-384", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777042274, "uuid": "095aef88-cdcd-4275-a1b8-291d3e828fb2", "value": "T1929733B1C471019FEC7FB736D4B4590887B6619E2EB5CE2BB61106A809E37F186FD806", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777042274, "uuid": "56c81c35-fc1a-405d-a7a5-9ca94e617daf", "value": "786432:XH3E9BB6zEktoXyAnkU+LZSjgoef22qR31xQ+6NpUGyxEjEhaoO2xxXXuRC:XH3k0oXPnkjNoefo3/2cGyxESO23nuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777042274, "uuid": "dbea74f1-0cef-4301-a9df-623a729d2221", "value": 41715070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777042274, "uuid": "1cabce26-c0f2-4a7f-9f23-7d81a2a37fbc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777042274, "uuid": "a5ed632b-7c5b-4a30-8529-bd2ced60dd69", "value": "SpectraMenu.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4dae174-400b-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1777055552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055552, "uuid": "05c2d7a6-9283-4b09-aabe-e102c562e7ea", "comment": "Malware payload (WeedHack)", "value": "6253a2228b070336f5b03c43d719e2db", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055552, "uuid": "981c166e-1eca-4f61-9cd8-253dfb9252f1", "comment": "Malware payload (WeedHack)", "value": "aa4644de6e2561218db53220fbbaefd98bec0e1701eb0a036eef69d45d5a275d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055552, "uuid": "8ff30725-bd53-4064-939a-97fb16677e77", "comment": "Malware payload (WeedHack)", "value": "31dda55775fe1e89bfdc09ef7378f448ca017793", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055552, "uuid": "2782ccfa-dcc3-43fd-8046-c000332a37ee", "comment": "Malware payload (WeedHack)", "value": "66ba120c852aa24a78a624155b521bee9b56a73a800d4addb0f6a41c90ad50a95182044969b751a8c64ebef86ffb9cf3", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055552, "uuid": "f7409345-5f3f-4eff-a400-41f301e72121", "value": "T171660218AEDD4035E413E7324041E0A27CBAEE99514BE3673EB9094D6C34F458F7AE9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055552, "uuid": "3e4d32ad-4192-47ad-9570-68e23f5b55ad", "value": "98304:sol2SKr9i1lGuGs+9r1wpfaBbUnvI4O71dMQeCOSJXTNc8eKCGsEkl6oLj2xuX:rl2O1lG0mJwYINO7/MChhcFKH5kl6YjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777055552, "uuid": "02bc1a22-af2b-46f0-ab35-c17ee1869010", "value": 6867488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777055552, "uuid": "81e20b60-ac28-41b6-8cb7-a5cd39513be4", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055552, "uuid": "5e025cac-7c84-4768-9e9a-ac673fd2a7da", "value": "Meteor_Client-1.21.4-42.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f462e2-3fad-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777015045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015045, "uuid": "6336fb54-884b-4421-9430-ebef6b0a997a", "comment": "Malware payload (AgentTesla)", "value": "a721fb60dfd9a2e759660ad79e4e2885", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015045, "uuid": "ad3ca89b-b263-4d39-8204-3f8d70621025", "comment": "Malware payload (AgentTesla)", "value": "ab0faf35caf2874405189ce2103ded07dba53736f374b95072cbbdc41f5914e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015045, "uuid": "5f078901-de8a-475b-8d4d-0fa69f6ca040", "comment": "Malware payload (AgentTesla)", "value": "227759830d7457ce8a522b0e40d3b2e216c646d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015045, "uuid": "6a46315c-332a-4e7a-9ff0-ab62389ec0a8", "comment": "Malware payload (AgentTesla)", "value": "070884713abc168d7f45d16403a2079308021f0db5eec11a7a0fff238d03d1c780fa55e9c04e95a1bf00ac5aea668c7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015045, "uuid": "2f1ccb51-5e10-4d68-8e92-79e30bad26b7", "value": "T19084CE38AAFA0019B1B3DF54AEF47496DC6FBF633A0E985C1091034E4632945EDA573E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015045, "uuid": "84ced724-b2a9-444c-9348-6697ea42ef0e", "value": "6144:HffdKk8ow3lwcuoqBpbpFMGvxVZYEwiRECKUoWL51esW8XEisttAjrh4tp76lE2o:HtKXoswVBpbbtvjZYjiOtUoWL58sVsJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777015045, "uuid": "28180ab2-dff0-4bdc-83c0-973bcfb3662e", "value": 377964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777015045, "uuid": "96c9c165-e041-4102-a0de-3b27c3a685b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015045, "uuid": "9ecf668b-62c4-4e37-be2b-117baefd2df6", "value": "payment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa7fc98-3f9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777008191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008191, "uuid": "0b7ee233-7521-48ef-a22f-9796c97c5e83", "comment": "Malware payload (Mirai)", "value": "7ea8d2fc0f1e0d627cd1e56197926259", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008191, "uuid": "795f7f6d-1e00-4de1-8657-0c80564ec2b7", "comment": "Malware payload (Mirai)", "value": "ac48eac307da45bfbb2fbbd9238ae75cf83367e27ef89f61db0d75366714fbe7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008191, "uuid": "e590566c-2e16-434e-9f85-84ee17e3e332", "comment": "Malware payload (Mirai)", "value": "1c5270a877a5c9661c8f5afd73a4375d8454313e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008191, "uuid": "37df0230-7934-4f61-9311-efc7b42dd2aa", "comment": "Malware payload (Mirai)", "value": "a69d72eb5c16aa05841463806da05ce274dd710b1d76c7d8a7e848ca966363fc92734c4bbd2cb6d0a781cb2c23a5c7a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008191, "uuid": "5f2e290e-0394-4c03-a9b7-bff242b328bf", "value": "T13D4301CEDC568DC7C46FA0B62BCADCDB617D964DA66801C0DE58273B83D3948136E788", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008191, "uuid": "1643abcb-bbfd-4a0e-845e-ce3c88718995", "value": "1536:Q6uvGGbYdFOJwNiEAPjMVdRarfjaQlJ4Ef/nouy8S:QnuGbEFiwoEAPjQnefjb9fvoutS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777008191, "uuid": "15d1c286-f67a-49e7-988f-ee319adbdc60", "value": 57616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777008191, "uuid": "b1dd7527-e492-4b50-95dc-a435ce2b4a17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008191, "uuid": "8585257e-b63a-45dc-8cf8-bb30b06e8e03", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4a1c46-3fc1-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777023758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023758, "uuid": "b48a0a63-f506-4a68-83bf-baf2622e5c57", "comment": "Malware payload (Smoke Loader)", "value": "37452fdd3867a68ba608cda74d1341df", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023758, "uuid": "690c35f2-9fe0-459f-a9c8-b34a2b06167b", "comment": "Malware payload (Smoke Loader)", "value": "ac6b5f68ac303ce5cecec20ba357640ba6131bca34ba99061f0b67a84d4fe514", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023758, "uuid": "2d6fcd04-4ca2-43f7-859f-f677d928f1c9", "comment": "Malware payload (Smoke Loader)", "value": "3cf88980a6c44627636062f93b9faffc06962ff3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023758, "uuid": "ea4e9a87-7ad9-4237-96ee-f91f46686def", "comment": "Malware payload (Smoke Loader)", "value": "d10c4f4833e27ba08323236a8a07ebc36520a8b6ce8d616d40c80b9a7db6a7beff89d2ebe61fef5f7665d479fedc033a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023758, "uuid": "3325fc0b-3e2d-4016-bea8-c82273ea4779", "value": "T18A954B0278A105EDC099B73249F23681BB35B8580B3637D32E956B783E37BE11D7A746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023758, "uuid": "09e5975b-a755-4163-a171-41b70319c2eb", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023758, "uuid": "61d804fe-e746-431f-8cfc-ed4d7ffb7984", "value": "49152:FmiXknEAnbV1ADvA+F39yhXdnNQ7sFdYd0:FQfryD7cyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777023758, "uuid": "f815081f-b0db-41aa-9edf-c662305d4221", "value": 2046128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777023758, "uuid": "d1807da5-6284-460d-84c6-bf40b04d3036", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023758, "uuid": "1032eca3-215c-45df-a7c1-94215e849b53", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03852ad0-4032-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777071897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071897, "uuid": "0bbde42f-c37d-4ac0-9fec-1c471a74272e", "comment": "Malware payload", "value": "3aec9916fe97233399af90d3d62dc3c4", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071897, "uuid": "42bf74f5-3c75-4a91-ae6e-04faebea8eb5", "comment": "Malware payload", "value": "ad5ade444bb7022dbb9ef78250e22a3991293531062f44b665cf410b128d0850", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071897, "uuid": "3f36861a-d1f4-482b-8402-af90fdf5610f", "comment": "Malware payload", "value": "09aff17a73f75741ebbd7557da2a430c20946d6a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071897, "uuid": "0bc3dcb3-f1a0-49c4-b299-7992a83af5ee", "comment": "Malware payload", "value": "ab915887170e654d39a7b171e3df8bdf8675f90a66e8a0b412ed0bf0c9acb46db27ea252256df4ab0929a9f28a53d69d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071897, "uuid": "47d162f7-c9f6-4907-8ab4-37a1bbfc9925", "value": "T120053321EF7C2CCE065DE360B01E75AAB1A29FD48418F553D36ADCE518BDF1601A782E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071897, "uuid": "0000baf6-5a75-46b8-b58b-8f9b70952c95", "value": "24576:cQXAL0cXTUvO4Aee+7qnIsYPVc6EmwfO/89G:kQ2JwMCcOw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777071897, "uuid": "c939058e-bbef-41c9-893a-ba7f43f15384", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777071897, "uuid": "65788d52-c657-4b27-b7be-27e2b274dcb9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071897, "uuid": "5a8aa360-187d-45e9-af8f-5c7a5f53d2a5", "value": "pfWlmzJI3x63gO.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59be684d-3fc0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777023079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023079, "uuid": "07dfe35d-d0cb-41cd-99d6-e304a9d808d9", "comment": "Malware payload", "value": "54ffec42c6685b422192311373d38854", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023079, "uuid": "afe3e177-e867-498b-a9fc-ac1dad42b148", "comment": "Malware payload", "value": "ad62210247b2db0afdb832dcb618a391d769627fe79a5ff9cc87b614636de77b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023079, "uuid": "9f4aad12-ff12-4acf-893e-38d891ca20d0", "comment": "Malware payload", "value": "475f899b5c9a8551223f67f90ffb0ed6f1ca1a49", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023079, "uuid": "e45a8b5f-bd6b-4bcb-93fc-8cf7c24ccc9d", "comment": "Malware payload", "value": "19fe6ec1c658883608eeba56f005b9c62b21772a9a5099c3207e28923b6b9ef35030944996e8c47f6f05c468ea214b26", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023079, "uuid": "e2375c42-84d5-4e71-b77d-7a784add74d1", "value": "T1DF65C002FF405FABC4AFCD30492EC25B11EDD98256D1A62A71FC4B9CBA5C35A0BD7588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023079, "uuid": "f9e638e0-eb99-4a26-adaf-7ef3c98f7c29", "value": "24576:ZYnr5PrLsOf860KhwVfLeyxHivTtcUrIXVs4L167xXTtQYIvG5M79JDDhULh:ZIrLyrVTdivmPU7xDudLO9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777023079, "uuid": "ec3a3ee6-47cf-4d13-b8c2-5b94edbeaf36", "value": 1427779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777023079, "uuid": "1b938bb5-66b7-4a65-b2ea-faa643fa4d61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023079, "uuid": "92076070-15d3-45a0-b380-0c461340da53", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975d1703-3fd1-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1777030484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777030484, "uuid": "ac29c26f-69ac-429a-bc08-85fa4da059fb", "comment": "Malware payload (ValleyRAT)", "value": "229771b3dc1b777a34b930281fbabf68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777030484, "uuid": "79f6c1eb-4825-4789-a9cd-01adc7a611de", "comment": "Malware payload (ValleyRAT)", "value": "ad9963279ec07037872a198a2f2e81e685d1165d6fd5e880c772fb0d1cabdb41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777030484, "uuid": "618f719c-454b-4f7c-972c-5312f280ab5f", "comment": "Malware payload (ValleyRAT)", "value": "356cff9e182fc33a524ae91269b5dae2e2a073e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777030484, "uuid": "380ff870-f714-4e76-91af-f7b9aa896f6a", "comment": "Malware payload (ValleyRAT)", "value": "1b00ecd0e2474bc5e050ad9ee3da049365387d3cb111a14abf6a6f1c6e42b57946de99e65654a88f5496bc15f709a520", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777030484, "uuid": "95175969-0273-4e04-bc68-d00aec9a2e2e", "value": "T19AD57C0BBCE11CEAC46A56358DB261623B35FC990F3263C72EA0B3392E766E05D35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777030484, "uuid": "2edb1f32-897e-47a1-81e3-0d8ea4b5a59c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777030484, "uuid": "60544b4d-316a-4ee1-a2d6-d5326ef01c65", "value": "49152:TplAhjvxWPaIg8g4EIDVTRhNMfdx1lKBcrBFixppG:TpubIVDVljydxHtQ/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777030484, "uuid": "7b0c7a18-82af-4872-9898-a333cbde5241", "value": 2863616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777030484, "uuid": "aa4a9b8e-833a-4b64-bdf8-e9530abdd3f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777030484, "uuid": "b056a7fc-615d-44b3-a2e5-3556305e747f", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16587201-4004-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777052172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052172, "uuid": "9cf1e908-d1fa-49cc-9414-d9153056c420", "comment": "Malware payload (Mirai)", "value": "a7509edb479b9a68f2fdac8ddde08be4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052172, "uuid": "6d0fc993-ad1a-4979-ac2f-a72e59b056d6", "comment": "Malware payload (Mirai)", "value": "addbe8b8664af629f713e36cb72f3ba6b198c3ce3ee8c80eb8ddfb4c09347362", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052172, "uuid": "7d47a881-af4a-4ca5-8eaa-169bdadc0238", "comment": "Malware payload (Mirai)", "value": "fb87730866ab78e4523cd4cd225732061f0945a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052172, "uuid": "34b70f0f-0fe5-4fbc-af48-9f25f213bdd2", "comment": "Malware payload (Mirai)", "value": "ada7074e537a0a868a82492c940350003cca9c84b68ceab46cf479fc86a3dde4f2ed8a9201876038e9ff933313c57965", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052172, "uuid": "a6e086ee-870a-4759-95bf-80519f29dbf5", "value": "T15033F707F84285FDC556C13417BABA3AE83671EE533CB6A777E4BB222842E614D0DD48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052172, "uuid": "ab9f24e0-9ed4-4035-a395-d60fedd83bb5", "value": "1536:gfHlPDdJaEcLAeF9TUDWog1HHJYC0QkiuVn4P:yHlPZMEcTFZ2A1HHJp0hVn4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052172, "uuid": "7ccf4226-1996-4a59-b9b9-42c2207dc842", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052172, "uuid": "14edd41e-d9d0-4743-ad5b-bbcdfcc79f6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052172, "uuid": "6b2451f5-88de-4bc2-98f8-769582f8822e", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13076afe-4032-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777071923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071923, "uuid": "5aca1ad6-e9ea-42a3-a510-eb67f9c75dda", "comment": "Malware payload", "value": "67e54c98794f96ffb3a374d9ee7a0d23", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071923, "uuid": "a7d7da54-dfea-46b0-8078-bff70890bb5b", "comment": "Malware payload", "value": "ae7ba52112fa966df1b3c42592f870f9106edcb3f0f3cf36f1377b6a8e41bb19", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071923, "uuid": "a9690d7c-ab9b-4d33-aabd-43cdf47e1605", "comment": "Malware payload", "value": "e433e27ed15716de206b3cc4e5e0ab5f3adec4d6", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071923, "uuid": "a1824a4f-f880-4db8-98c9-7c538ca73dd9", "comment": "Malware payload", "value": "5eee6b340bc492025e3b04de2f5412b2205bf7c9131114dcccc34704ef485f3dc7a7dea2babeded6ea26eb73b1095542", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071923, "uuid": "b96175fa-90a2-4fe5-9f5a-4e9d740638f3", "value": "T189B302602F883E362FD5C66E644D93F4B8B22BA4C0949D61E0DD51A772C720A86B7B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071923, "uuid": "28683443-7b54-4915-9a50-58c9e97c1052", "value": "3072:GYHrxCitusHG6raNSNqg3zg5+hiKruHO0tmuJgReL/J:TQ0usHG66S4g3z1hnCmui4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777071923, "uuid": "61a76c5f-89e5-4b0b-9f98-851ef999e7ca", "value": 107964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777071923, "uuid": "9c6a3fb2-a7cf-4bfe-9154-53422e15fcce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071923, "uuid": "edbdfdfe-f159-49eb-9692-b99efcda1169", "value": "repeatedly.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d5e570-3ffe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777049802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777049802, "uuid": "cf41dac1-4e91-4777-a011-9f93d01c6277", "comment": "Malware payload", "value": "5475da15269c0a946a128128d7ea99d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777049802, "uuid": "f2061785-b5f3-4055-91bb-73cb0266f8c1", "comment": "Malware payload", "value": "aeab239bc59b41c3d8a1b726c680f3086996ab00bc714668f6350f737ca4e5b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777049802, "uuid": "8bcc9c71-caaa-4f82-8390-37e1d20f7c4a", "comment": "Malware payload", "value": "d0abaa9db1af978a60aa95801aabcddf4f2439ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777049802, "uuid": "6754248a-293c-4305-b23e-f528a4a4bb98", "comment": "Malware payload", "value": "c24af1cb867abf0905a4ddd26a5868e86eeb098aef57eccc3c677d9d9ec5cc7b8fb4db2132bf7555e77493dc12a56869", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777049802, "uuid": "974e708b-82ac-4043-988c-2cfd08de7511", "value": "T113766B73905624D8E1ADC974D5152213BEA8384B573863CBBBC076F51BBABE49E78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777049802, "uuid": "43b90bdd-ebe7-48a7-8192-ffbd26ba7fa9", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQU:cqYUQuVDt0TZEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777049802, "uuid": "09a600f2-a644-4426-8711-ea7fe700a09d", "value": 7438336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777049802, "uuid": "608511ff-8ceb-41fa-be30-b396d7607a47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777049802, "uuid": "18976647-5671-4dc0-bf40-ac355bdd3de3", "value": "aeab239bc59b41c3d8a1b726c680f3086996ab00bc714668f6350f737ca4e5b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b066c4-3fe4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777038809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038809, "uuid": "8bbfdf99-9f12-4758-8823-3c832f403ecd", "comment": "Malware payload (Mirai)", "value": "c1f77f3a7578c5f02b831abb70792cbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038809, "uuid": "11396130-1ee7-4800-b6e2-717085daf7d1", "comment": "Malware payload (Mirai)", "value": "affb9974be6064a8ffeb439affdc2e5d565d2aa438120e679de6300b9b618e57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038809, "uuid": "a3f30438-64a1-471e-8fe9-bc663d4b1581", "comment": "Malware payload (Mirai)", "value": "6c6e23a51dc32499aa255f3a60c4190c90babecd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038809, "uuid": "02206ee4-ac37-4ff3-aa7a-7b11d167411c", "comment": "Malware payload (Mirai)", "value": "e61d513410f9b07702ac4803d9e32d64d7e14c538fed9796dc2b15f977707c0582f74f0e36c886a68eae2373f8a078b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038809, "uuid": "2a3623b6-9adf-49a0-89a1-822841e2ee6d", "value": "T1D644A71E6E228F3DF768877447B74E25975C23D626E1D981E1ACD2101F2428E642FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038809, "uuid": "a0956d34-b5f5-4dad-96de-c44872797184", "value": "6144:qzkfjgjRczSQw1c8JGgaNnm3DUU4oqUr7ZX/ER+VLu3FWnCf6eOtGMyBS:qLPwquE2ZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777038809, "uuid": "bea5400b-d3fd-4a51-8085-fbeeb30b5abe", "value": 266944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777038809, "uuid": "f6e3a658-6f69-48be-9341-e20ceb40fc62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038809, "uuid": "defa4b6d-c29a-43e5-879f-709e837250d7", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7010afc3-4036-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777073797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073797, "uuid": "e3afba99-b6d0-4845-82a5-5754a6ff5077", "comment": "Malware payload", "value": "b808e94b02af43ef54373490dc9695f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073797, "uuid": "1af52717-b5b5-4613-85c5-8fff3b4d9913", "comment": "Malware payload", "value": "b15a7ae852eb4ee9dfc00af1be468187bc6ad075149aef31b066dcda00cffeea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073797, "uuid": "4587ab8e-355c-4abb-933b-b1e9a6821c72", "comment": "Malware payload", "value": "23df94258aada451a37526412cbbb04ab92053ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073797, "uuid": "d0f332f7-68d8-4ccb-8def-5605fc31040e", "comment": "Malware payload", "value": "859773d8ac664f237b8800a555dd146afdc6ccb3a73ecdcab67c6664fc0c70a879fc8febe6cdad3dd4e8c99055ba1810", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073797, "uuid": "4abc8ff5-d881-4543-b6fd-4922b731a8af", "value": "T1C185E043FB184423C9530EF019BF43D5F7617A5341F5A22A270E97672632E3AAAC735A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073797, "uuid": "543a7944-f061-4b7c-a0f6-e3acd861ef62", "value": "49152:xHUcf3MuHMwpsdZXpAY87vEQW2RG1bKx1RLnvI8Io:xHUcf3MuswptY8pnRG12zR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777073797, "uuid": "73795629-288c-4f5e-b1c0-68d1312cd85b", "value": 1708681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777073797, "uuid": "611b5a9e-b15c-4d68-928a-5ef0d83fbaf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073797, "uuid": "a164dce5-ff18-4c15-988e-2501579ec55f", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4e05fc-3fd6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777032477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777032477, "uuid": "73034029-3550-42fc-9adf-3d6b6b658ffe", "comment": "Malware payload", "value": "bbf28d38fd10b514a1224694c2a0c32d", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777032477, "uuid": "d14c44ba-3682-4bd8-a4bd-4fa4f10b70f5", "comment": "Malware payload", "value": "b1bd40b1c902133da8463920200b2a2a90992f128f9fe1a6ddac819c261225be", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777032477, "uuid": "80aa30d2-a5ad-4f73-961c-de1044ea61d6", "comment": "Malware payload", "value": "6c35ce22a34267dbd44cbd5efcd9880106d7939c", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777032477, "uuid": "89ce16e4-e78c-42e5-b8bf-bf24d3f4d723", "comment": "Malware payload", "value": "a1989ab94441bd7171bd6948958ea32ca7255ad9fe92dd000700f01d3c60355a66ae1170bcd31e04105429a9250b0208", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777032477, "uuid": "a11a7792-2d28-461a-b7f4-a546508ae200", "value": "T136E3AA9A01DACED65703E8AE051A104DDABC3723AA4EDDD0B90DA7A03F1BDE807F54D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777032477, "uuid": "097aad5a-81e0-4a71-965b-60af2a147613", "value": "1536:T4wV4cpS35akuExePjLOgntndE7L570Ll0YUW04VYLmnXpv7GTmngo7:w35akuExePjLOdLhgi4VG6Xpv7GT6go7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777032477, "uuid": "1b9bddf9-94b0-4547-82ac-a740eb583802", "value": 145679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777032477, "uuid": "e4934f29-115d-4ec2-be9b-c3ed82d8e080", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777032477, "uuid": "241b34d2-56ab-4cdf-85bf-db959fc3827a", "value": "Document_Primary_v2.3.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05fe574-3fe2-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1777037908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777037908, "uuid": "ce18645d-3929-45d1-a255-6bd9d94aaf38", "comment": "Malware payload (a310Logger)", "value": "0bfe21691a79ee85eb0c805a41437dc4", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "mail-mokasco-com", "colour": "#ADDA3E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777037908, "uuid": "7f8918de-b0e0-4b04-8fe7-699ba07ca5ea", "comment": "Malware payload (a310Logger)", "value": "b23d0c02cb699e2657efd01f39dd663ec5a8d164a243808b6ecefae4db1c6b96", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "mail-mokasco-com", "colour": "#ADDA3E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777037908, "uuid": "0e62e791-2c59-43b6-918e-ba3c254cb3e8", "comment": "Malware payload (a310Logger)", "value": "1a4938c465a8c2ce85ab7a7c2c3b47d0a85b2876", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "mail-mokasco-com", "colour": "#ADDA3E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777037908, "uuid": "27fddf7c-534a-4389-a4f8-198a350d13e5", "comment": "Malware payload (a310Logger)", "value": "ad52795f43ba69586e928fc5a784db8d5466b7e169c16ed6fd2b9d4d503557ddf1cc6add896cfe3539bf0f46bc52bb1f", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "mail-mokasco-com", "colour": "#ADDA3E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777037908, "uuid": "c2b24876-99bd-40b9-adab-1526b84aa25b", "value": "T1A23422ED9DEDC05E0528A439F08FB68DC5796662CACF3E4DB023C1610F3AC16B8959B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777037908, "uuid": "69fbbafd-9b4a-4461-83c5-273a1a709a96", "value": "6144:lp+50fRZEI0RxkMvVyw8H+LNIeQSJ98V8BwKoHesB8:lpo0fRZtE97NIeQc9q8uve28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777037908, "uuid": "b046d91b-c70c-4a6f-9858-7a7420bcf20c", "value": 245463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777037908, "uuid": "56f05b86-5fe8-4254-80c2-3286248ceba8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777037908, "uuid": "0dfbeff5-a7b4-4a5f-bf92-0d036d10e17a", "value": "1a4938c465a8c2ce85ab7a7c2c3b47d0a85b2876.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b2a08b0-4033-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777072340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072340, "uuid": "c4ecbb15-051e-4e51-965a-700da5ded4be", "comment": "Malware payload (Mirai)", "value": "dcfac0ecc77b98e7be0a249fba17f122", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072340, "uuid": "39a37fc8-0fb5-44c9-b338-98e0ffcdd3ac", "comment": "Malware payload (Mirai)", "value": "b27f09c93491b15058ead68419f04511396d306843946d54e79db308e2c86695", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072340, "uuid": "58863a17-d044-4e5b-96a6-b4fca30c0485", "comment": "Malware payload (Mirai)", "value": "900125689d14665f95df8f7f700cd1f8595551a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072340, "uuid": "ab63e0d2-8169-48a0-85f9-2975873b12d4", "comment": "Malware payload (Mirai)", "value": "a97cf8a7e8c32d1f070808516ef1de296de7bb1731d617b4e31d42c182d00c560f315f7285bbc5afaabd78f07116d626", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072340, "uuid": "739efbf6-10ab-4399-b3c8-4beb529c67a7", "value": "T1087329CDB8024E3CF94BE5B950560E09F924678897930F2BB7ABFD936D721687D02D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072340, "uuid": "ab82a9fd-c696-469f-872c-e13773e68050", "value": "1536:P3GEv64qhRpGPO/IP8WhHky+kLI1Sr0GqpfZv:P2ES4mRpQOAPV033", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777072340, "uuid": "676d9fbb-7683-4558-8361-747102d4e9d2", "value": 76424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777072340, "uuid": "8907628b-ae37-4449-b2ae-a72fd3b23b9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072340, "uuid": "f7f616cd-c823-479f-bcb7-318357904a6a", "value": "jade.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6cece90-3fdd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777035798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035798, "uuid": "c0c1bd69-186d-4310-a0e6-a3c72bf5d446", "comment": "Malware payload", "value": "a22a303ffe908ea50ce29105fa1f90a6", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035798, "uuid": "650558a0-fa30-46a6-8006-bf80d8b4e9e7", "comment": "Malware payload", "value": "b2bdb1a9a57565f0de580235d8ae0bc70dfebb5b6d4cc047e96fea3e89f715a6", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035798, "uuid": "f9157ff7-3e20-4d9d-a230-0c263ad28efd", "comment": "Malware payload", "value": "73a6237db158856dd5e6fde6de9f61f2f7998b21", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777035798, "uuid": "9ed07a9b-7af6-49c9-b5a5-4c196538c51c", "comment": "Malware payload", "value": "5b8e3854e38b19f20462643cdb79dbf9f05994e51c540fd0c2f8cddc6aafa9d06b2a6e742f48da0194c01df35a77b03a", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "halfmillion-iq-com", "colour": "#14045C", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777035798, "uuid": "3318ff79-d5ba-4d31-a09d-39952359eb78", "value": "T175663333F56C09C6E437E5BEE0E21690C7E2130ED803D43BD6A16AD471E778A45CE69A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777035798, "uuid": "ed31fb4f-c92c-43f8-a78f-cbc81a503905", "value": "196608:+Zftmuv3UHLTvWmP60uU+HB/OGUElH6XU8YYlbHXUD:+BooW+mP6rU+h/PUEl0U8YYlbED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777035798, "uuid": "fbc102db-2634-499d-8ca5-ea8552c32080", "value": 6609841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777035798, "uuid": "136c672e-f608-47f5-bc0a-7446e8c74316", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777035798, "uuid": "fa1d58a6-67ed-437c-a9eb-264d971cc756", "value": "halfmillion-iq(1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "802aca38-4011-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777057933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777057933, "uuid": "c3c42c32-be14-44c7-9831-3b7c473abc24", "comment": "Malware payload", "value": "c9843ce195d277eae6ffe0fce81797d1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777057933, "uuid": "fb35fd5a-f09d-4ee3-a43f-eb911ef48f5a", "comment": "Malware payload", "value": "b2df0e4e8db63cb067bf6725749f8707a37cd2dc6d9ee63f33fe8ba95aa9b0e1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777057933, "uuid": "c819d283-cd63-47d0-98ce-a5e0a37aca89", "comment": "Malware payload", "value": "9470df2ee1610e2c6521c743af9b89bde599d1fb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777057933, "uuid": "88d17703-afce-43cc-97da-1ad6008804ee", "comment": "Malware payload", "value": "cd66d62dae18e169f435375afd08ac548d7700fb8b95c2f65b3d4a768edcfd98c0485bf54bd91abfd3cabae39501e0ed", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777057933, "uuid": "6e030747-f830-4a25-a41b-f506229f886c", "value": "T1E5618D8661188776DE9DEC5A7A658D0D70CC528028A2BF2CDDF761E3D98EF483403EA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777057933, "uuid": "cfa34a79-a006-43cd-a1f9-0d81fb3c0852", "value": "24:5jv6rbXIU6rbXKXF6rbXo0Xo8r6rbv36rbgRlZ6rbe0eNILXkU6rbOJ6rbvJvGyR:6U7Ea7oCo3UulGBXsZzBGPnD7LQx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777057933, "uuid": "f11b885c-a4f7-4116-b510-ef5edf153046", "value": 3356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777057933, "uuid": "d862df58-9d98-4872-9557-66773d17f3c9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777057933, "uuid": "34cd7596-0bd0-4c4c-8492-866cf5868a5e", "value": "lol.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d45cd918-4031-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777071818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071818, "uuid": "48684d41-b76a-4b9d-916f-18bfc9ba080a", "comment": "Malware payload", "value": "d77f942813b3031148f581d04941b509", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071818, "uuid": "b2e580ce-9a17-41a6-95be-b96415ba181f", "comment": "Malware payload", "value": "b2dfbbaffddcd260ba921f322d6bc709da19b3585a66de01c1d01f8be5e7efdc", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071818, "uuid": "683d5729-4370-4bb4-b8b5-c7a24e9c0900", "comment": "Malware payload", "value": "c8c20b95a1473f962141d7af16b32d16264af9a7", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071818, "uuid": "4ff6b4dd-cc9b-44a9-aafd-1a27ae5faad9", "comment": "Malware payload", "value": "02613c9fbdc4a22bc1cb6c85642ae7f2ccd96ecd32285bf0b76fe97d2b14a1cb37711350dd9e112a9682049e2e8e5c06", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071818, "uuid": "4d448cad-fc19-45ae-936c-6378cd6e5ec9", "value": "T182B0920A75610E9069639484B4DF22E9628EB0EB584AE8E5E19A0062898267C9856ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071818, "uuid": "4c651c31-df6e-4acd-9a15-bd8460be77d6", "value": "3:mKDDVNGvTzL2jrcoTAzBKcKZGVP/ouFcVkwUFvQJFXnc+dMR:hCvL2Mo8zCZG5/ouFkLwunc+OR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777071818, "uuid": "f2b2766c-7a11-4ce2-95df-fc37abf4c1b0", "value": 128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777071818, "uuid": "ad5fd81a-ae75-4a69-b9cc-af0928c8d402", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071818, "uuid": "5e525e76-9208-448c-ba11-9fd4b6fcc521", "value": "RWVne9yBcg4L.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a7f2dde-402a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777068527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777068527, "uuid": "f4e05537-9652-42cd-9af9-a4680aa8e3a6", "comment": "Malware payload", "value": "cd333de0a879c14647425c3af91ff26a", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "motivate-starkmond-cfd", "colour": "#22C6B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777068527, "uuid": "49c7d553-b3bf-436c-bea0-8f28a393adb5", "comment": "Malware payload", "value": "b3810ca5f17d8f617252b5460eafbed27e85722e794e394b2fbcb760ecf3d2a3", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "motivate-starkmond-cfd", "colour": "#22C6B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777068527, "uuid": "76d97720-95ff-4f5b-8d39-6e2d3cc93790", "comment": "Malware payload", "value": "670e724ab0e1b075c448a8dbdd9f23e12dbf3157", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "motivate-starkmond-cfd", "colour": "#22C6B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777068527, "uuid": "bcac7968-58fb-4879-b97e-91d8f2c9b883", "comment": "Malware payload", "value": "efefcd133c339570a73a4a83dcffc8e94dc2ed1b006f27a8734db1129694eff66974b1464bff71c8d4bd112ff75b2b00", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "motivate-starkmond-cfd", "colour": "#22C6B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777068527, "uuid": "095722b8-1446-4cf8-a428-6c14deb29c45", "value": "T1BDF5CF21FB828162D9EE017821AA9B7A4E3DAD748738C1C3DBD13DAD88305D2773E755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777068527, "uuid": "b1f13013-8d5f-45a6-bf28-6c0c9fcbffb9", "value": "949702a4ec364bbd58c950ed402fca0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777068527, "uuid": "71558bee-7bc0-4463-b107-3f8681e4ae02", "value": "49152:MNRKzVtSdZhe7i5PXGzHqTVMkF1pbPh86h2CNWsdKzkmDayfP5mDzw4EZCUNjWc:oyVtyZh6i5ezLk9a+2rsQxmgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777068527, "uuid": "b5339a23-732f-4c35-8c55-ecc77bcb5c9d", "value": 3423016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777068527, "uuid": "ac181856-c312-4630-a2fe-c490c00af02d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777068527, "uuid": "1449fafb-f91a-403e-a107-9cc04df81e36", "value": "crepectl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a444836d-3fd8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777033512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777033512, "uuid": "70a5c115-ecb8-469f-8278-6b1d1f807569", "comment": "Malware payload", "value": "c4c141013a8b70a8f61ed481090f8029", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777033512, "uuid": "6e011615-d988-48fb-bcff-da755d387b1c", "comment": "Malware payload", "value": "b418af66e4b77114beccc18e51a3e6543163970b430cf8f9a7d4826ad343b3e1", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777033512, "uuid": "67aa7e4a-d48c-4fe0-8a9d-8eb5ddb4f2fc", "comment": "Malware payload", "value": "a578e189175265853ea5c7b9803511079066a8ce", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777033512, "uuid": "a6fc0b4f-ee8a-44da-bd6a-568b30acf674", "comment": "Malware payload", "value": "97a93c45ccea6b1feb323179b348676644b8c80a04ea1aa18d1f811ca05b906ff66d47c932251c3adf6e1fe4734cbd0b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777033512, "uuid": "143c92fe-ef23-4a9f-9843-733ee139760f", "value": "T135D023011243C61D05000C071C92768CF0DA085E1F0CFF718714C85C03C7CDC759B381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777033512, "uuid": "aada6520-ad8f-46d6-97ce-ac012f6e0c1c", "value": "6:hC47bxrBeLuVFOOr+DE1Bn23fXmSKOZG1Bn23fJm:d5r+uVEOCDEf2OJ24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777033512, "uuid": "410df900-7b49-46fc-bf5c-cd38785832fd", "value": 207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777033512, "uuid": "74644a6d-a243-4b3f-ac52-ce55af009ce4", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777033512, "uuid": "9c215647-5a0d-4511-bc5b-8238317ed1e2", "value": "HTl6fP60DJVT.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7176eb-3fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777029907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029907, "uuid": "233377e0-ea96-457f-85fa-79c8c27b7697", "comment": "Malware payload (Mirai)", "value": "5422a898e0305a4f2c764171bab5554e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029907, "uuid": "848bcb8c-b1e3-4222-aeb5-1e32ab1e5ad9", "comment": "Malware payload (Mirai)", "value": "b5bd3e8a44064e57b8f19fd7bec905fa653a10f2d9790e609baab41c90623d7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029907, "uuid": "8b47f781-5c48-4e70-96bf-25855329b392", "comment": "Malware payload (Mirai)", "value": "3b06c8978aeef4a051d2abfd8ad8ad73d481a05e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029907, "uuid": "0513e5ef-17a1-4798-87f9-273cde72bf5b", "comment": "Malware payload (Mirai)", "value": "c6e29a7854babbdff71db6c9fbef717cbe21f21e3a7b871505b56d0b1bf3ccd20796d6e0642685da0983b7a511cc6b1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029907, "uuid": "286bd70f-f955-4d53-b16c-5dfe8288886d", "value": "T1CC931945B8419B21C6D522BBFE5F018E331697ECE3EE72129D201B6477CA91F0E27E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029907, "uuid": "4675edb7-d9e0-4fc2-933f-708774738e90", "value": "1536:VAnkkYHvMumqwnxCXBDfxlCmUzdUUJMyAMu1vWcadtotmLFxnxNlskixihzb:eYvMxqixyDJAmUzdBJXu9WRtotmLFQTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777029907, "uuid": "5972de1c-e6c1-45d3-9acc-126444be5fd6", "value": 92772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777029907, "uuid": "9b91459a-c96f-44cf-b5e3-128814367c88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029907, "uuid": "8dc9a2b4-557f-4ac4-98d8-6e5f1fb11f10", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88a6ec9-3ff9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777047693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777047693, "uuid": "fd83ca9b-bdcf-4727-ae4b-0a2c8e4a63b7", "comment": "Malware payload (Mirai)", "value": "39b84b57b0b4e711caf230c1e64b0323", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777047693, "uuid": "e41e4402-feed-40c9-9d66-f1807e76fc36", "comment": "Malware payload (Mirai)", "value": "b5f49312761746ced2a4c6467b7e88d6caf5f4d1387cb282d12dbb4fa2bbfe93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777047693, "uuid": "53d9498e-308e-4d13-b907-e4e48232b844", "comment": "Malware payload (Mirai)", "value": "6242215f8665c34a6c31274708cd3563590ffdc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777047693, "uuid": "229b3b64-9c31-499a-99f4-4bab6d3b64c1", "comment": "Malware payload (Mirai)", "value": "c821239e096a82fd574318ed145cbed75463cc9912835975524c04e96af521cb1043018d4bfbf5ef13d14ef596ae2d6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777047693, "uuid": "4ad7b951-02da-460b-b7bf-cfefc3d484df", "value": "T1BCB2D03C1B151BA8DE1EC0BD439D1B503CB81B359182AD5B6206EDC7AF9A8B47453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777047693, "uuid": "e73d60f1-c13a-4931-ad93-c9d041aac367", "value": "384:YeD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiamdtJgGlzDpH7uNj1JA4H:YeD8ZSWvZHZbs1row697qohQvg9aitJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777047693, "uuid": "417be825-82b3-44f0-927b-9c8a2affe410", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777047693, "uuid": "dd46d6e3-548a-4f68-9b9e-70718955c965", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777047693, "uuid": "c9a9fe66-1294-4ae4-bd7d-5171a59a502b", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03db095-3fcf-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1777029774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029774, "uuid": "c82767d5-8d23-4c84-83f4-2b11fd4ab38b", "comment": "Malware payload (RatonRAT)", "value": "8835cf4e4ab72cf546bd209f1965e308", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029774, "uuid": "db1df8e7-06b3-46ab-870d-c040d8860a16", "comment": "Malware payload (RatonRAT)", "value": "b6a06f9799e05b4b4404a73f227da838ec9ba0e4cc6de376b04807897e55ddc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029774, "uuid": "fe70db84-10e2-433a-b74d-e08a6861cf8f", "comment": "Malware payload (RatonRAT)", "value": "4a9fe8de87aea589a0d7ab83ceb57a5f705d7e31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029774, "uuid": "b1e9e4fc-9b4d-4333-803e-d2902a66acf6", "comment": "Malware payload (RatonRAT)", "value": "b7cec82967aa535534b725135eefe95d04534931bf593c2078ebe5914e07b7cfdb9a67fd92a6bb8e24a779a71e3134bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029774, "uuid": "b5f4fbf9-3029-4bcf-8a60-54f14f64213f", "value": "T1B3934B0473FC2926E7FF8FBE69B550500F72B9279E31D64D498A60980A70B869D20F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029774, "uuid": "3318b5fa-cdb8-4d58-81a5-a8976470971e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029774, "uuid": "521510c0-d55b-4f45-bf47-154fe6a1042f", "value": "1536:Qgc6pMpG5sLTsqa4tsi5tzCANqASbhKp+CbC82v1h:QgcwMpGoAX4tnjzJkASbhKzbCvvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777029774, "uuid": "1024ad5a-33b4-4da3-8f9c-52e9e0d1e0ef", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777029774, "uuid": "89bb3a04-5fbe-425b-86b2-c831e0810fa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029774, "uuid": "97def749-7763-40c5-9421-5d6f86532eb3", "value": "ratooon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7df560-3f9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777008186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008186, "uuid": "d6046470-0aa9-4371-85f2-b41ba59aef77", "comment": "Malware payload (Mirai)", "value": "efd189c33be4cd82f6e829175b945387", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008186, "uuid": "63ae7e9b-bbba-4c30-8881-31370a432ff1", "comment": "Malware payload (Mirai)", "value": "b6a0ae0f7b27ba1aa7624d55aed39f1229b8039286a033451b8a89829ef40998", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008186, "uuid": "754c8803-78f6-4802-bba1-d351bba6f5c0", "comment": "Malware payload (Mirai)", "value": "540c98a874ebe963ef6906acb7adbf7e4356d592", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008186, "uuid": "be725277-f3e7-4e0b-9980-07b5b2206671", "comment": "Malware payload (Mirai)", "value": "bd2f5795cefb457396cd0e2da0862dca0ee651e91a99f2d6d62762f0267c19c5ca9087fb5280df705664570f7729742a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008186, "uuid": "3a164082-a79a-43ca-bf52-16bbfa145721", "value": "T18A630216B08D03BB41908D366D7CE7A697420EBCD0EB392FA81DDC98BBB1D221CD5A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008186, "uuid": "6605f944-bd21-4a3c-b65c-7055f5091f0e", "value": "1536:SXU8q/lJ7PnwnozmAop9d/t/5pf2ETnHBpVnbbwYmUOAkE43Pd:SEX/lRnwoz5Gf/tx9DvtbwdU6L/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777008186, "uuid": "6fd90e28-7d98-4205-aad3-58b2546be568", "value": 69656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777008186, "uuid": "adc6a229-7d8f-4feb-b0d5-ee5ac306f5a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008186, "uuid": "d1ec95c9-981c-4fdf-ade6-b51c764143fa", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6599ddf-3fc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777026295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777026295, "uuid": "034d8f7a-169c-47a3-bb92-0874ed85cf73", "comment": "Malware payload (Mirai)", "value": "3666253233b0647795fe0c7c299048c2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777026295, "uuid": "364a1dde-4207-4bda-8949-b01faece74d9", "comment": "Malware payload (Mirai)", "value": "b715a553ca387bf592a21ac3cde18f2f875afab2c86afcfde6f8d68d86f46897", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777026295, "uuid": "9645a1c3-36a1-41b9-a9b4-49659b54385c", "comment": "Malware payload (Mirai)", "value": "6891cc8a67a369af8f7c363156d99484f20aff40", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777026295, "uuid": "a2d4c52d-ff0a-4720-9511-d577749b20a7", "comment": "Malware payload (Mirai)", "value": "61d421d478c08cc132644a6fbb195a2c3799920ffdb1167867615bd991bab575c589c6f5e0996fa778d4f8038034732b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777026295, "uuid": "8673a45c-d466-47a2-91b1-aea1963c4d63", "value": "T1FED39EB7B70F1091C82506F85BCF5B9D2E7325415E2B86E77C7E323A6A720CA5901BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777026295, "uuid": "7b0a2294-16ce-4526-9a62-93502e3db9c2", "value": "3072:YTeSJNIY8srm/hVSWynGlOTqnpP1gXCR5gEhj0/q:meSk0m/OWArWnhMCRSEW/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777026295, "uuid": "1ad17015-d5f5-4b49-ba40-a4ce7309437e", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777026295, "uuid": "088dc01b-7841-418c-9c94-e9409ee9b014", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777026295, "uuid": "e634d7ee-8a36-4fac-9945-4ab221fcde2f", "value": "vision.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6907615-4027-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1777067446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067446, "uuid": "c77c4906-f533-4194-9f6b-ad01b677c1af", "comment": "Malware payload (Smoke Loader)", "value": "3e95bc9e3842a1b820eadb0751deca83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067446, "uuid": "500fb5f7-0f50-45f7-8ecf-5fb577cc4268", "comment": "Malware payload (Smoke Loader)", "value": "b7a4969bc7371a7092120861e6c1b6c165dfccb1d8297548a239c4a847842062", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067446, "uuid": "108abf2b-0ac4-4643-ab7c-184f3182b974", "comment": "Malware payload (Smoke Loader)", "value": "ce809ced2d5321e81b601db2982b321a06380a05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067446, "uuid": "5630f15b-0237-404f-9b3b-96a69648e0f0", "comment": "Malware payload (Smoke Loader)", "value": "75393285939a3991036c90514948cf267037b6dec933502af83cc5ec094d83bffdabfa2a74fb1a97e5e664b637a8f391", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067446, "uuid": "140c1b24-afbb-4197-b6d9-78a682765690", "value": "T15EA56C81ADD255B3D542323150A672AFB730580D0F3ED797EAB17EB8AA3F6C11827349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067446, "uuid": "a95bb300-79b1-4f18-93b2-02da37fb5dd1", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067446, "uuid": "264c8c84-55ec-42a5-8dfd-e4567e5a8fe0", "value": "24576:7ULHe+TP3hVNg/L++zBiMqxb4iZ+y3Uanq8E+6bhhYegQsN68a15tZwZFiyec01w:7++UQUMq6zFhB5PBc01bsuE1uk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777067446, "uuid": "965fef84-bf39-41b2-b0eb-98c824aff38b", "value": 2122928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777067446, "uuid": "dfc53f0c-6b5c-40c2-a6fc-aeb03fa87acf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067446, "uuid": "bdc3fc8a-893d-434e-95af-8358c3220187", "value": "Setup.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d36d9255-3fb2-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1777017270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777017270, "uuid": "09850855-6e62-4654-826f-077da4017320", "comment": "Malware payload (AsyncRAT)", "value": "73304813dc4d2afe40822791966bc051", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777017270, "uuid": "5b4a46df-c1a6-4788-9cf6-70c28a69b97d", "comment": "Malware payload (AsyncRAT)", "value": "b7bfcc457284207f51138847c2036298f2e70d98d51bcc35e34a64cc5c591fe5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777017270, "uuid": "e0e63587-c5f8-474a-8626-78cc9e2e05e1", "comment": "Malware payload (AsyncRAT)", "value": "195def2301939e36a7526f0ce6ddd98006300f67", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777017270, "uuid": "43787703-23bf-4503-bca9-cf8d6fe759e9", "comment": "Malware payload (AsyncRAT)", "value": "0e02e89bf6f4704aa4af28dc44084f58af90ceceb378b2ee22d5dc6d81ce4e1285a89b249d83cd690a0e0f1d2483269e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777017270, "uuid": "53bf014a-4217-43e7-925c-14a8249d20a7", "value": "T1FCF423F9AA95D992C09107B14B73E3B552A18E5DF510C307CBEDECEFB84A2B0BD24641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777017270, "uuid": "ee52191f-27f7-4d86-bf87-fcda7b890f60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777017270, "uuid": "4d5aa47a-820d-40da-91a2-6ea655bc8ea6", "value": "12288:+9SlMPiQ0JYk4y0t2HwU1asVHF/yxxrIFTv5BiNtQJWi4E65eWsFJhWABv2JGeG:o8b4OHwqVHsrMFL5BuQAjDGJYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777017270, "uuid": "c129c3f7-3e9b-4325-88a2-7b181d4dc917", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777017270, "uuid": "4c8c6295-650d-4ca8-b4c3-924577ff911f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777017270, "uuid": "5689074c-169c-4514-9a59-31151b93c37a", "value": "LCL-20260417- PKL- Ship to Taiwan.xlsx.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0442cf74-3fa7-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777012198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012198, "uuid": "206d71b3-2f66-49f9-a857-b9950a6f1293", "comment": "Malware payload (ConnectWise)", "value": "2e15f9a746ed38ee71ab0efa73d7431a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012198, "uuid": "c6e506f0-27c4-43cc-a0c6-a5ade8737d5e", "comment": "Malware payload (ConnectWise)", "value": "b82814dbe62ca1bd6c2f3ff27a3c4b398b72aaaff2fd94c343dd6159086b7389", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012198, "uuid": "b92fbf43-4a10-448b-8b6c-0d49927ce199", "comment": "Malware payload (ConnectWise)", "value": "8aa786cdedcfe34b0bc93936d2f242450fc4fad9", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777012198, "uuid": "6f0a0b5f-af09-453e-bf19-b3bd84759265", "comment": "Malware payload (ConnectWise)", "value": "124bb28b42704ec0e313cd5f714cfe3a4e66ae0837c7490d2c3cd26d25cea9ad585c0bf23318b36df1705c30b19cecb7", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012198, "uuid": "9f288804-4d9e-42e8-9ef7-584b1c798604", "value": "T153646C11B9C48432C673383107B9E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012198, "uuid": "d772c2d2-1bfe-4d58-b885-471da5a05a63", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012198, "uuid": "3ccb0b2a-06c9-4d85-9090-0cd0a54f1f6c", "value": "6144:NmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9M4:o1iw7gryNkSV1hy1Z1u2JLI9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777012198, "uuid": "5918b55f-f1c7-4749-9e81-503592ef861e", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777012198, "uuid": "ce6b60b9-7591-4a4b-8636-f07854e2c5d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777012198, "uuid": "5f4e50e7-a48b-4f82-9833-b61cb0250e06", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f22bee8-4010-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1777057502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777057502, "uuid": "530ed708-6e61-4ac5-9914-759cfbb18bfe", "comment": "Malware payload (RustyStealer)", "value": "9abe9ef8fc45acdee12063bcca966f8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777057502, "uuid": "fd1c575a-5c78-44ec-9a3c-ff7ab4067e03", "comment": "Malware payload (RustyStealer)", "value": "ba21e24714ffd32c23812ec4d3fabdca99331afbf58e9a5344652107a8643873", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777057502, "uuid": "cc668200-0e1d-42b3-b8f4-73e845a16079", "comment": "Malware payload (RustyStealer)", "value": "b88aea1e9e467e1e9b4c128c7033becfc1b9c385", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777057502, "uuid": "91dd8417-709c-4f2d-9f6c-e0e53cfddac7", "comment": "Malware payload (RustyStealer)", "value": "ff0e5778f63b7fe526a7e741ec9abcfe467819ac3763bc50a8ddd8d9989d72b2e8f80c9b37c27989cbf0c2d0e2732d9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777057502, "uuid": "b1b42840-6225-4798-bf56-d1d53b5c6828", "value": "T174D46D47F9E655BCE16AC038920AB933BB76B8450131BEB706908A713F69B607F3C715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777057502, "uuid": "d6407203-cf50-49ad-86fa-73f8d95b2eb9", "value": "e04bb28ca98bec3b38336bf6babcdfc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777057502, "uuid": "7b9adc4d-9621-43bc-9cb9-2cf151cfb6b9", "value": "6144:eaWbCwc5p2jIUbjZRAcZVWtF7/LtxVd+F59p696rRyg6ZIa85rS1r1CCH0YtJvi2:ehGp/+jAWVQ/nQREJZIrS1oCUYt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777057502, "uuid": "f40dc9ac-17a0-492e-8afd-57f54ad13184", "value": 651552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777057502, "uuid": "3ed9364a-acbd-403c-b355-a57542842871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777057502, "uuid": "6a7f6c3f-2b28-47ee-8cf7-eeefb2fe50b8", "value": "2026\u5e74\u7b2c\u4e00\u5b63\u5ea6\u5185\u804c\u4eba\u5458\u8fdd\u7eaa\u540d\u5355\u4fe1\u606f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32c7d89-4003-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777052113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052113, "uuid": "b0157869-a7b1-4a12-ab4c-cb2a85b533a1", "comment": "Malware payload (Mirai)", "value": "df9a4d5cdb41e78d5d08df42fdf63b69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052113, "uuid": "3659f9f8-cfde-4021-8a9f-e74b663e122a", "comment": "Malware payload (Mirai)", "value": "ba47ee9911c3745c82159bf64d2f419c6f46a5083a8766d79ad596909d7764da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052113, "uuid": "275edcd8-8d5b-45ec-91e3-47e22fdf22a4", "comment": "Malware payload (Mirai)", "value": "787dbbe3871c8bf17109e92831fd61b611b3aafd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052113, "uuid": "80fac8eb-30d5-4588-8a95-151b4e238021", "comment": "Malware payload (Mirai)", "value": "dce030bd3b03e7f239f62687e74f2b4aa7599d7e245edffc422e4681269947bc4c2d890cbc95bcd8b811b71621e9e50e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052113, "uuid": "92dd9821-1075-40e7-b1f6-8b86d4cc9acb", "value": "T178A2E17DFB20C1CCF082847E2957127B456FF8A64B98420E6E15D0C700C39DED49AEB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052113, "uuid": "31b94f75-b80f-4ba0-b9d1-e7deeaee4cf0", "value": "384:TDYC95A2rM7RjFrvX2V6H2XJ8LaHYsbX1chiM4HhBJhpExUC03uhHB3QJmRxm+c4:TDZ5Dw7RjFjcU+O24sDS4HhrhpEguX3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052113, "uuid": "5084a969-7092-41b5-92b0-6c914bce1527", "value": 23260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052113, "uuid": "ce5dda3d-8b05-4981-968d-9f7b3649deff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052113, "uuid": "11489b3a-0d2b-4089-9dff-0a796953b204", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54757cbe-3fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777029942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029942, "uuid": "daa5c859-5a76-4e0e-bd3e-d08ed19a9d27", "comment": "Malware payload (Mirai)", "value": "a8d879c83e21ffc063e6dfa87ff8bf85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029942, "uuid": "c4ddf173-e210-43fd-95ef-8ef42a2d25c3", "comment": "Malware payload (Mirai)", "value": "bab26bf2ccfc24ddbb686bea3cb40ba2ba4555609ccbd0d3f41c3987b32f4f60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029942, "uuid": "3693813e-3470-4db5-80c8-07d065d63630", "comment": "Malware payload (Mirai)", "value": "b50b5ccf984949dce24e50e195ec60d78752bb24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029942, "uuid": "7237c04d-92e9-4182-908f-f8e198daa480", "comment": "Malware payload (Mirai)", "value": "f9fd11ac130f3f37c3baf014030d375c6aee00a608bf8417e363c7b2e03b0ac4eecbe19a9ef2acb3c876b298f2783a34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029942, "uuid": "d375f3d6-d16d-4dbd-84c0-97164b7571a2", "value": "T1CA833CD6B4029F2DF88BA5F5806A0E14AC3576E75B930F27B2B5FCE36D220D87901D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029942, "uuid": "8d192c22-f145-46cd-8c66-ef5b723a9650", "value": "1536:uNGDRwIVQL7tGyiXf2IgY8hhvNQfnqXJrQaB:uwDOIeftQX+l9SnSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777029942, "uuid": "8949281e-b255-457c-8328-b45688da170e", "value": 88324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777029942, "uuid": "82061c59-9e38-4de3-9656-4be1d5aef16e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029942, "uuid": "8736fed7-55e4-45de-82bc-980b8ff509e9", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d5c83c-3fc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777023106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023106, "uuid": "a2569de6-c28f-4e7b-8177-2dd7b22a6f86", "comment": "Malware payload (Mirai)", "value": "7d268f899eaf56b5eafe0a28f3a89970", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023106, "uuid": "fa74a650-1640-4f8a-878d-f631e6465e02", "comment": "Malware payload (Mirai)", "value": "bc025f043b20200511f954e11108fd35613950d37bcf7eff63811323f1bb44a3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023106, "uuid": "0556d3ad-cbd7-4bf6-ba7e-d96bf46000d3", "comment": "Malware payload (Mirai)", "value": "4f055c63e747e972755ef8fe92ae44a3831d8cab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023106, "uuid": "be002aaf-cc4e-47f5-b7b5-d94d72c177a6", "comment": "Malware payload (Mirai)", "value": "570b311901725d0fe9a24295415203a75a92f5be319992ba99f019b61ce203c20714c553f8e84d7781772ac2c63fb75d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023106, "uuid": "9706f0d5-c5df-4dbb-8d0b-d60eef1ff523", "value": "T13075E089F793D4F2F65341F6024FC7E20574A126A017FAF2EB449A767872B922F1522C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023106, "uuid": "1aa8c467-0eb9-4989-959d-05683e960616", "value": "49152:FZSKQphYuhMEC9m05CLmDkYJZGNf6Fc4iP:elphYuh49mtcmNipiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777023106, "uuid": "43239d7a-abae-4593-949c-d4386ad1d359", "value": 1591466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777023106, "uuid": "b40ed2e1-72fa-44c2-b590-f1b07a2b8dab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023106, "uuid": "57ad4842-f712-41f2-b347-456c6ad82e23", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e83064d-4002-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777051327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777051327, "uuid": "8ad76673-62a0-457a-8f6c-6fa2601abfb2", "comment": "Malware payload", "value": "48c783de3a8f3ebadfb1d8a4954707df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777051327, "uuid": "7c701171-2217-4de8-bab6-50620031fc63", "comment": "Malware payload", "value": "bc8299142bcf0175ba531507b7149a87888fd87cbaacce491ea651662f033afc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777051327, "uuid": "f01684be-09f2-4a35-ac3a-f6bf5dc22767", "comment": "Malware payload", "value": "33e5b7fdb40568cc84ec6745607a7095874747d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777051327, "uuid": "a3d6d2b6-5f02-467a-adbb-4d4b60bc8c3c", "comment": "Malware payload", "value": "6da13efe74e5a310d8a4ba58312639a4608702cbb110fb13de34387c197bf4e4d81288b07d1e5f92cd04eae3cf7b1f96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777051327, "uuid": "07f308f2-4d86-4beb-b8f4-4327fa74123a", "value": "T1F176CF23A14554FBCC26163F0867CE9C697BA91126CF5C0B1BA4BC1EAE35171383B76E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777051327, "uuid": "82632fbe-a36d-48b1-b6fa-0b6221e13564", "value": "a201725f1b056b3c6aa189f530cae576", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777051327, "uuid": "764d4dfa-ee8e-4f91-aaac-7d029b051de4", "value": "98304:PcKqo+EkpCp4/SJty9olzWTHihryxcdbDES:n3kpCpVq9olKTHixb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777051327, "uuid": "73d9cdd2-fb1f-4b98-954d-5b459da1d0c6", "value": 7267240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777051327, "uuid": "e2256200-d523-40d3-8bef-41b3c6c7e42f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777051327, "uuid": "452e23f1-5529-4223-a0b0-e69a5672ea0b", "value": "1_E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad643385-3fa1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777009905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009905, "uuid": "fe942c96-52f3-41b8-ac30-c95c252146f4", "comment": "Malware payload (Mirai)", "value": "6baaebc9f832ec9d1105dfcc989c442f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009905, "uuid": "20ab2d92-91f4-44d4-a467-ff3a5cf9b114", "comment": "Malware payload (Mirai)", "value": "bdb4abdc2eb1afa52c3b1fe1eeb9de151249329c9c23f95817c6ac8d632a00ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009905, "uuid": "931c8b32-d2ef-43f1-8319-20d766a84c42", "comment": "Malware payload (Mirai)", "value": "7121337337d50aec793d46aa7ee4c9f12ff4abff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009905, "uuid": "6dc34953-dbbf-43ff-b93e-d94c1333057e", "comment": "Malware payload (Mirai)", "value": "c4a81b873acdd9f98cbf7f216c5cf2a1fdb2115167037bff8440eac3430f830b0ada61b96da2772e4a9fdab996be025e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009905, "uuid": "d3cb6d1e-8794-4fe9-a178-665abba5812a", "value": "T1BF0418457C419E01D5CA33BAFA6E028933577B79D3EA7202CD205F5527CAE8B0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009905, "uuid": "9fb7d6ed-b8d2-4c8d-ae75-1ea52cd761f4", "value": "3072:I/D2Xd9Fg8+g0s4k76Qv5eDWO3bOy8quasQVkVb3GIQLMCTgeY0mIi:y09S8kk76QvQWO3CytuasQVkVb3GrnT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777009905, "uuid": "e526d525-06d2-41ed-a3d0-919698c3793b", "value": 178216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777009905, "uuid": "fbe7574d-bfdc-4a39-a9ea-ab8ca19d4da8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009905, "uuid": "2c750034-81f6-4cda-9cbd-ab1044dbd998", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19fa8e8-3fa4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777011281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777011281, "uuid": "af5038be-abdd-4ac0-945e-cd1a8fd26454", "comment": "Malware payload", "value": "b51e2af65cb748875743dd291215d08f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777011281, "uuid": "7cbfd8bf-c7a2-435c-9ec7-17864b9b8611", "comment": "Malware payload", "value": "be341f29c9cd01fc02dc9a590f27aefee9ebdf56978158d1bf4430d2b22a4d36", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777011281, "uuid": "22dd4aae-8e79-4f54-a72a-5a07e812f50a", "comment": "Malware payload", "value": "c58dae0950122a4f60e0699ba1224962ac5728f0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777011281, "uuid": "1e3923af-5412-438f-a9fb-63253bb05352", "comment": "Malware payload", "value": "4b302f2b57ae6db596fcf9f7f63139f00e8c903156073441c0658567fabcc1156d44bd3dda7e411f7531687137431389", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777011281, "uuid": "a0cb36b0-e857-497b-8e19-135c1d0b70e5", "value": "T15C137D6956853C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C59ADCE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777011281, "uuid": "56bc60e0-85a9-4c40-8ff5-033e77773a42", "value": "768:bG+N9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bG+Ocy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777011281, "uuid": "4f89dbc4-567c-4ff9-9d84-2e45aea74efd", "value": 45499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777011281, "uuid": "1eb3b73f-2e0c-4a2a-b269-29b50bd0d060", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777011281, "uuid": "eeb39dfd-75f1-4d18-84fb-39d5035d93ff", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3e847b-3fc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777024369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024369, "uuid": "ca315414-6bb5-4fe2-ba83-22176cdfd5f3", "comment": "Malware payload (Mirai)", "value": "f9fad8ab5d019903d345e8eb57616767", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024369, "uuid": "ceee0a33-c460-415b-90af-cc4d3ccb5e4a", "comment": "Malware payload (Mirai)", "value": "bf0df86359d4d81f8e6c752b52824748b5ac223fd6ce5e28891f703cc946e432", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024369, "uuid": "290c2946-da19-4002-a326-ecff0398070e", "comment": "Malware payload (Mirai)", "value": "ff4052b93d9389c92c1429d3607d429eeaa38185", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024369, "uuid": "c9b580fc-6386-479f-bfff-86da0c8fb9ce", "comment": "Malware payload (Mirai)", "value": "a5b3b01d5ec519d324c2fb326bb78fc22d31d4761f71e894dc53277de1a98c137a7fc61b9a909288871c9c0ce0a31134", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024369, "uuid": "1eb45bd3-259c-4084-b768-ca7789642f4a", "value": "T155632A42BB42DE73D04310F112F79B664931FE7B2866D686E364BDB5DA350C0A612BBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024369, "uuid": "24454bf7-6b6d-4bf0-8a5e-4e14fbac20f0", "value": "1536:FHusEacKPTxmOb6sMu9QkwN0vd6b1OlfrrB1/+qqFIwNg:VusEarTxt6u9HqodrvW16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024369, "uuid": "b6a60d81-18b4-471d-af93-c9fccdb1aeec", "value": 66912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024369, "uuid": "0031ee14-c0cd-4746-8da0-65839f0ef81c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024369, "uuid": "ab3e4074-75d2-4e68-bd2c-931e12942b8e", "value": "I586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7323553a-401a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777061777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061777, "uuid": "113417bc-5588-49df-9647-4ab564aba559", "comment": "Malware payload", "value": "20b33a400bcd8052918a5877b62a3f72", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061777, "uuid": "690d6034-02ab-4279-9e72-ab1c473d8ea2", "comment": "Malware payload", "value": "bf1200f45516d73045e230ef98dd8d16533fdd88fcbc2489b700c03e149d60ee", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061777, "uuid": "07ec5015-986d-4ab8-9e6b-e003a54cf4fc", "comment": "Malware payload", "value": "b7a1298575263b1caee02e7c5411a313d2d06293", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061777, "uuid": "d9b006ec-d396-48d5-8266-136c80ecf40b", "comment": "Malware payload", "value": "e7440c31b598e36a524bcc86a52ca54b23537ef5b7cf2775d1d336ebca1cd1f01091a699838cf249513d454011317aaa", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061777, "uuid": "399290ec-2e90-40e0-8376-51fe12c49d13", "value": "T1EC25CF30DA8F0758D136B93CC0D75A416375BD9CD3219E4BDEA078A92E77681E12EB8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061777, "uuid": "996c8359-5abd-4709-ba6d-32d8c60952b5", "value": "24576:4oVKrsCc0RUSOj8rHR16SQh4oXTj6+uxKnFPOAWb+WyYjwfL:9xNd6+ugnFPI+WyYjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777061777, "uuid": "64406f52-bb60-48f7-be65-e4c7fdf1103e", "value": 962560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777061777, "uuid": "3038f3aa-2ce9-4965-b84c-e28a82d6bdd3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061777, "uuid": "4ccb10ba-2765-43b8-8578-e446e1dc3bec", "value": "sleestak_payload_1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac84d28e-400b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777055430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055430, "uuid": "de082c45-ab2c-4262-835f-a8efef598321", "comment": "Malware payload (Mirai)", "value": "5c9b822a3a35e3bec473db1e84f7a2d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055430, "uuid": "9d573edb-4180-48c3-9ff1-832afdb8cb1f", "comment": "Malware payload (Mirai)", "value": "c1ef7ba6ac632d417af3b23f525470142b435a0e15130869e6c945ec7171d862", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055430, "uuid": "c09f8eb8-09ab-4d9f-8fec-f3d5efde4173", "comment": "Malware payload (Mirai)", "value": "1f73f56cf0450746d8cf9f4333dad60ed8ca5f8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055430, "uuid": "e75ac826-deb3-4d53-896b-54d11c8b4410", "comment": "Malware payload (Mirai)", "value": "8702720c1e828215f200b2df3c01b6415c3150af7682384c0269822c2ae6665f9536db2c6bbac12821085f83351da1de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055430, "uuid": "67ad4e35-60b0-47fc-82bd-7e394fd3b7e0", "value": "T11E230271480A9EB124703C72DA99938376E12AB1C5673123D6290A3C2FB97531E5BE4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055430, "uuid": "112f9f47-2718-4a43-a0d5-55718ba66a80", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b37Z9q3UELbUXfi6nVMQHI4vcGpvs:DECFd+A6YHAx7MLRQZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777055430, "uuid": "3f871414-2127-47b8-a771-b0f585bc7302", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777055430, "uuid": "48399e5e-51e1-4bf9-915a-0be7c348986b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055430, "uuid": "d80924c7-ff6f-454b-99f5-97cc81097a38", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83e5db4-4020-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777064550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777064550, "uuid": "6b85930b-da38-437d-9f17-e9a8e6d69db3", "comment": "Malware payload", "value": "7c851c56e828bc50855fea7aefdc45a7", "object_relation": "md5", "Tag": [ { "name": "pw-4496", "colour": "#68A7FC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777064550, "uuid": "04315535-40fc-4ced-8fd4-cd95e34d7d68", "comment": "Malware payload", "value": "c25b5826e93fdbd0d2f961d5c5a3afb062c27f3939a9325d5ddb9d12e7e5a991", "object_relation": "sha256", "Tag": [ { "name": "pw-4496", "colour": "#68A7FC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777064550, "uuid": "8e2c2d37-14c2-465c-a064-640e140e4de0", "comment": "Malware payload", "value": "1791042d9e789739e406c99ae7dcd438f5bd9fef", "object_relation": "sha1", "Tag": [ { "name": "pw-4496", "colour": "#68A7FC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777064550, "uuid": "b4cfa7f2-3d46-4999-a9e5-6ce64f9b4ba6", "comment": "Malware payload", "value": "3368070bb4f3998c7051f396785eb5ee1fc90c8b5d7b44f02ddc8227f18721a8758b89013c926a9cb9b268c4e6a9002b", "object_relation": "sha3-384", "Tag": [ { "name": "pw-4496", "colour": "#68A7FC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777064550, "uuid": "293a1c78-d17c-4f12-8df3-fd42e6cd3c2d", "value": "T186E63337A727D404DAACCED087406AD33E497FC2D472B7724D00BB0A892745A9DDAE5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777064550, "uuid": "8abc2eaa-7769-4d26-ae0a-3a6323b89e54", "value": "393216:dqX0ihA4qJladHTAicZ/RnYTE/NeRNi3NxKVXUih:dshDqJEFTvcZ5Yg6Th", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777064550, "uuid": "6a2f8993-51c4-4ed7-88b0-f9cb5de3307b", "value": 14623662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777064550, "uuid": "19eaf703-0190-4e49-a45c-b145f5ae02d8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777064550, "uuid": "54b72b04-655f-4f8a-8072-d081204b6fce", "value": "CS2ReportTool-1.5.0-win64.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0007f6-3ff9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777047757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777047757, "uuid": "58aab273-0d05-4d42-9b94-850ab90f7bf6", "comment": "Malware payload (Mirai)", "value": "e782d6ce876619a17b420c5d9108d770", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777047757, "uuid": "15366ca2-283c-488b-909b-f71076aa2045", "comment": "Malware payload (Mirai)", "value": "c27d21877473765704825212279f0a728e69c4f1b0a7312520963ae8f7cf448c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777047757, "uuid": "4fc3677a-ce34-4b83-b058-0f4f6d6d42dd", "comment": "Malware payload (Mirai)", "value": "3f93cb723d362eb1509a898758c34b97bb68f856", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777047757, "uuid": "5f18c85d-b3a7-4f4f-a6fa-e58fdb635821", "comment": "Malware payload (Mirai)", "value": "a42f005336007739545f41dffbf3cd982996bc5b9a1fb68f0d6ce0ddd601f55eb86ff33ebc7dcc8d5e552da739a9e0fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777047757, "uuid": "c9bb18d5-c4fa-4439-a81b-5c898970155e", "value": "T1DB63951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777047757, "uuid": "c2150f58-807c-4c49-b078-d076680470f7", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAs:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXz3L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777047757, "uuid": "b94ce856-6f47-4596-9a81-7c2036580651", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777047757, "uuid": "38be998b-f08a-49c2-b9d7-691d8f7e73cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777047757, "uuid": "a068cdd4-d545-4128-b536-b907d42f9c13", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7dad87-3fd3-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1777031434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031434, "uuid": "eb45992e-95ad-44ec-a896-5cff19310c67", "comment": "Malware payload (PhantomStealer)", "value": "003eb3f1cbc103b840ec6ab7343c9224", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031434, "uuid": "8d3c390f-d3f0-409d-be52-53e6df0f5aa2", "comment": "Malware payload (PhantomStealer)", "value": "c319bb21d688a407141c5a63b408d0be29823e026456d728b221dedf03455922", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031434, "uuid": "7cf8ee43-9311-4b36-a6a5-fb73be990b6f", "comment": "Malware payload (PhantomStealer)", "value": "e076642f4e1ec83de0457942abd8bb8ed983f5e6", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031434, "uuid": "6619b655-a0bd-4279-aa71-92acafc353b5", "comment": "Malware payload (PhantomStealer)", "value": "6a4c70630d36bb7f9f547498f340b75d64383b90d7de797cae8cf47fab39f3ec5d8aa34f328422029c2e22603f07478b", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031434, "uuid": "a158b6d0-eb86-4a85-bf83-6b9919f42d90", "value": "T1190533406F295E8F8A05433CBD6FABED15A09C0958C9DEE2DD9011C6A567FC8421FCAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031434, "uuid": "0d302471-4ea8-4619-afb9-6b18ed351be9", "value": "24576:pGP0mCutqx6yM2Ds+WMTU1Rgdc367IlOn7KN:pGsmCaeXlLdUbUFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777031434, "uuid": "45c8e23e-d6d7-4f63-a539-3f22d26981c8", "value": 839693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777031434, "uuid": "ccaba2bb-2b75-44c8-bce6-719731649798", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031434, "uuid": "f24edc25-55e5-468c-9254-180338f5b1b1", "value": "Rose.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41db446-3fca-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1777027553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777027553, "uuid": "8a5addb1-9eb9-44bb-a3ad-ffff5a19a494", "comment": "Malware payload (Vidar)", "value": "0001a47218d4469e482147e362f8f3d0", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777027553, "uuid": "36d4f04d-13e8-4ed7-9c20-c61aa12a84c2", "comment": "Malware payload (Vidar)", "value": "c33651ea768c026661e734711116623b8b7e50413d8e88425df95598a34d812b", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777027553, "uuid": "e28a91ae-cae4-4060-b909-2862b7bb2b22", "comment": "Malware payload (Vidar)", "value": "2e75f22e7e44b187052edf33ba115c7698e9c8a7", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777027553, "uuid": "93573754-4869-4499-945c-1a0621d54ebf", "comment": "Malware payload (Vidar)", "value": "b65f93235029e0ea917756231ffd6f7b0ba42e174f36699889fd76423eb03586b9352650be82776256387052c9126c01", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777027553, "uuid": "e8f7ff44-5b1e-4390-bab5-dddebfeb2cc1", "value": "T1C1B56C027C9105EDC099B73149F23681BB35B8490B3627C32F95AA783E37BE15D7A74A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777027553, "uuid": "e04fb631-c43e-47c8-bd23-f55cee7ef530", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777027553, "uuid": "66167b93-5e6f-4fb0-87f3-22ee7d92ea48", "value": "49152:mMohHiE133sNsV5CnsQxpSQK4/fHf1J7kdQ:mJXAvZT7kO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777027553, "uuid": "3359ab20-794d-4fb3-b09f-5ce08f3e4251", "value": 2455216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777027553, "uuid": "1efde86f-5dcc-4617-9e03-c5d5dbe32ebc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777027553, "uuid": "16431f0a-62cd-4b47-abf5-88ad4eb19618", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ee53cf-4033-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777072327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072327, "uuid": "a9f01d93-17fb-4ef3-8f66-5a9b22224b0d", "comment": "Malware payload (Mirai)", "value": "bee19f2fb807db165d0c55fcfd417d94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072327, "uuid": "0c034e74-5537-4e28-93f0-e44224b1afee", "comment": "Malware payload (Mirai)", "value": "c340899a2c58bb15cbfb38faaf8cf7ff1af268be6b7bbf7c272a6bb48d7494a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072327, "uuid": "de14248e-88b6-4c94-b6a8-6c7a783f9ea0", "comment": "Malware payload (Mirai)", "value": "7150033586bf8a8c6a030db1557d24ec39051e04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072327, "uuid": "c6b13873-c939-4b68-9388-6af686da9a34", "comment": "Malware payload (Mirai)", "value": "6f0ebbeb1a0d6538369a4b6a46030ebff47ce15c522300e54d3aed91cac935ea6c7bb38ebfe901f1e4f0de94a91dbde2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072327, "uuid": "e53e22b7-6b20-424f-8bdf-9a405951411e", "value": "T1EA43E651BC825A2AC2E053BAF9AE558D332177E8D1EB3227CC611B107BCA55F1D63F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072327, "uuid": "6391d20f-916c-41ec-85ca-1bbdc296a518", "value": "1536:MnxUS9GToGVtm+3XNtBLozkR8JuQysg5Moh+fAos1:Mn+xp8gl55FhYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777072327, "uuid": "3286dd13-cbfe-4afa-890c-231832fe1e52", "value": 59300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777072327, "uuid": "c3e6b556-1169-4f35-a5aa-c4b8c338a48c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072327, "uuid": "b2e0fccd-da6b-46d4-b673-03445d30be8e", "value": "jade.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787de16b-4004-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777052337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052337, "uuid": "b9d6a126-b71e-4853-b8b4-3b9494ad3b02", "comment": "Malware payload", "value": "e42776f984d926e4022610532fd5f5ec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052337, "uuid": "9f9265fd-a41f-4449-b428-7273a1110677", "comment": "Malware payload", "value": "c39a888dd9d7eb56c918cf2b5e090aeee8fcc87a9630a0e12cf622e7a8982b63", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052337, "uuid": "b6ae636b-a4cd-4f30-919e-aa0d2753cfab", "comment": "Malware payload", "value": "405bb2ddde1997d3e3a6f4638a36ae2ee748b88d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052337, "uuid": "b89842c2-1e5f-480f-8d64-ec0a9d04e0df", "comment": "Malware payload", "value": "ac251c4ff995da6ee087545b3b90f74e3e3b2d8e91455e02eccad14e669b2b4b353d94093ae09c51d91c4d1da6c7c906", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052337, "uuid": "8b259f6d-272c-480e-be01-700866a3b419", "value": "T17662D84D322248D9C549D47851EB9F79ABF1B801D9E78B3C8334D9323E607A5762AE44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052337, "uuid": "9c135d0f-88b6-4246-a218-2d3efcae27a3", "value": "efd7f22fecb87f90fef74b8027a9ff28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052337, "uuid": "01e403c2-4d78-473e-a0cb-0249c558a8b7", "value": "96:kxEtq/3VEg0YoFBP0z59VFaA2g4/JAFsWIycj17GBbqPe1ZIC8EAheHSbwfDSSfn:8EtSFEBvuMAFP81Ks21ZICkeMd4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052337, "uuid": "31403ead-5cad-4b3b-9fdd-a4b40a4e7df1", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052337, "uuid": "84449765-c765-401e-b228-4f998c31f3f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052337, "uuid": "b473d9c4-0e64-4136-bbd2-8d9ced68e0b4", "value": "mmdevice_jk7qnw.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac5925f-4004-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777052421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052421, "uuid": "39197797-a656-42b4-8de2-b1c8ee869e79", "comment": "Malware payload (ConnectWise)", "value": "ff13495dad44aa34f1732a8107d30c2f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052421, "uuid": "f6e8e5d2-5784-4c68-bdcb-052bae03daa0", "comment": "Malware payload (ConnectWise)", "value": "c3f9a7289415de1e238d094c061f2f620058faa59190fe016f86cab5bde25b83", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052421, "uuid": "98adedc3-0869-47ad-9bae-309fadcc55cc", "comment": "Malware payload (ConnectWise)", "value": "c7aaaf747d0528db20ed68cf3ab8d789830ca2d5", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052421, "uuid": "1f67b451-7eee-443f-8b57-75f44dd8dc8c", "comment": "Malware payload (ConnectWise)", "value": "2284e032aedd9bffbced2c63c51917416fbee266e815e0caffa25ae761c0fa68d1a74e027e8c9e52e6f1eb3ad086b80f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052421, "uuid": "d7ba27ff-d1b0-44e4-adeb-7438e077856f", "value": "T17FD61211B3E595F6D0BF1678E87A92655631FC044722C2AF53A4B96E2C32BC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052421, "uuid": "4f283375-ca84-45ca-ba53-5f51b89b2580", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052421, "uuid": "7b9229dd-6c27-4f90-9eb5-3bb832817f19", "value": "393216:SCXvI5MvHx2JhCXvI5MvHx6CXvI5MvHxnCXvI5MvHxu:SZ6HxOZ6Hx6Z6HxnZ6Hxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052421, "uuid": "1688cd35-5710-48ac-8bdd-3c213f2fb7e4", "value": 12762168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052421, "uuid": "e9139b6c-20ee-4f6e-b328-9788dd8e706c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052421, "uuid": "ba51994f-0439-4e2a-9ed6-d8b8a898f860", "value": "ScreenConnect.ClientSetup (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd01ba4-3fc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777024881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024881, "uuid": "246ca68c-e284-4852-a576-d2f246aafe91", "comment": "Malware payload (Mirai)", "value": "dd4bc576d2ca06bf040821a8dcf302e0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024881, "uuid": "388864c5-a8fe-4dad-95fb-668f37857bc0", "comment": "Malware payload (Mirai)", "value": "c4c8c0b66c6f319a8aae8ce8fa41a9248a34a2580eda083546b06b410b3f6e28", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024881, "uuid": "f866d1c3-18d5-4894-92cb-80c22ed407ac", "comment": "Malware payload (Mirai)", "value": "cf08b8b9543a684ad72fbff6afdf12df6d4f404f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024881, "uuid": "bb5d54de-f885-48bc-b35e-ef0e788e3b7f", "comment": "Malware payload (Mirai)", "value": "a8cb1a30a62af91c2dfb1789154496bee85f5bdd1cda64fc66884d92c10ade2cf08e7f819566348ff633a5dbb1ebae9c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024881, "uuid": "c69517bf-5da1-40ea-be1e-ee8a97db3a44", "value": "T10504881D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024881, "uuid": "7015c132-2bfe-4e33-aec6-28c480064e01", "value": "3072:vg57xt7LHZwbq1ESBa3VCvrCsWrFesC5X:vglxt7LHZgh6C9FHC5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024881, "uuid": "67081ede-7d11-4aac-83e7-2d35b072d193", "value": 173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024881, "uuid": "a800afb2-dfe2-48d4-8ecb-2994ee1fddbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024881, "uuid": "d2ec7b52-1cc7-48a2-9132-873e3f45e293", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6424e15b-3fc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777024815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024815, "uuid": "495d67bf-b685-40a4-bf5c-1c21ec40dc4a", "comment": "Malware payload (Mirai)", "value": "d684afe2d7b47ee97985d196e1a9c723", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024815, "uuid": "bf14a129-76d0-453a-b042-03c5731c231c", "comment": "Malware payload (Mirai)", "value": "c60adfdaf12c8ca8151ac29db1a3a9697cec706593e3ae161bf09ae06901ab18", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024815, "uuid": "d8a681fa-d5b8-4eb1-9118-e44373293955", "comment": "Malware payload (Mirai)", "value": "c91c5733c4ba57320253d99e3091f0f1faa3b7b8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024815, "uuid": "fa7858b3-6981-4b2b-bdc2-fb2b036c2fab", "comment": "Malware payload (Mirai)", "value": "5890103fa8942ce75f11cc7729970d26d49c00a318d23c647840c4e3ff94f10236c34b943b900c825d4358a8a3987175", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024815, "uuid": "237eaf75-0890-4fbd-aeee-684996f5d868", "value": "T13811849AA4B158B36CC9803C65AA4108782B001B04451D08BAAE3D2FBF7DC8CBDA553F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024815, "uuid": "8ce1728b-e731-4b37-be44-b72d8c925e0f", "value": "12:p5fmKgKUWvO6SnoFFK4u4m9R3DQRTZHZ3j5yXtNk/NP0J0ffmyYy/xhc:PmKgXaZFwombgtpwjup0J0f+/yc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024815, "uuid": "44b3dc56-1d7a-45ec-a627-b084a11998c5", "value": 878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024815, "uuid": "197a3bfe-eb5f-41e6-a11f-c4535739433f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024815, "uuid": "cb1e15fe-9923-4e75-bb7a-857f7c0b22fc", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410555f6-3fc0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777023038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023038, "uuid": "f90bb6c1-ba51-4d5e-ba09-b3f6daf0e934", "comment": "Malware payload", "value": "5080d49eea75534a38d25f41133b145a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023038, "uuid": "c68770c9-ca67-4881-9ec9-3e1298d8be95", "comment": "Malware payload", "value": "c65d14ee4fc7b03767ec18d304532464e18985fcd558fcd5edad201c02cbfe8d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023038, "uuid": "53213f46-8031-4fc7-bffc-2f2776806956", "comment": "Malware payload", "value": "3246059d795d7de14b717cfb81e53c537c3a4079", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023038, "uuid": "f024f527-6e5c-45e9-a4a9-a31fc6eadaca", "comment": "Malware payload", "value": "1ce9a6aaec445e60ed916fd0905a3ceef0783ff961920caacd99bde816f777bc7cc67bb514cfa1520ea7309f1d891951", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023038, "uuid": "c24ee6b7-e69d-4f14-a6ac-5af58c19b4ad", "value": "T18E65D0637711DFA5D314C63005B3C75556F525A20BE2508AB278C3287A22A6EAE1FFFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023038, "uuid": "4e6431d8-2605-4065-b0b2-20b82dde64b4", "value": "24576:t4CTgOHoJHSTQFzx+J8nVZkpDZmFhJeyxuppkT2z2rPGOO4R2IPpgW3mC7FIXP10:t4CqoQFzxLVZknkzMaS6G6R2IBvB7Fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777023038, "uuid": "38548eff-4dbb-4933-b8df-0c578e349805", "value": 1423592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777023038, "uuid": "bc1870f8-6b42-49bb-bc88-32a411872323", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023038, "uuid": "6bff5aa5-fabd-4d88-8e7c-89d7d657c8ea", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ccc8274-3fa3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777010629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777010629, "uuid": "ca87f764-0831-4334-b933-3e8e30d7ef14", "comment": "Malware payload (Gafgyt)", "value": "eb0ece12a660e77bcfcea6616e0588e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777010629, "uuid": "d6223abc-2eea-4068-9f35-788d85af84cb", "comment": "Malware payload (Gafgyt)", "value": "c780c31a557d0d324f66ca66529d7a960d01619dec2ee32cfb789c95b6a84597", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777010629, "uuid": "9fb4503a-aef4-4f94-98df-d7fcabffdaf0", "comment": "Malware payload (Gafgyt)", "value": "0f46f487da54af3446239e8c040c8f60b57aa865", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777010629, "uuid": "8ce68550-f039-442f-873e-b2b6d8125d66", "comment": "Malware payload (Gafgyt)", "value": "087d7cd85d9980e41360225a7f53ceebb1a28c3b44c481248f0227c86cb5eb83c4884c49ae9c4468639a02b81bd1ae90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777010629, "uuid": "706ab060-e24b-45d4-b70a-60d0e65606e0", "value": "T107C44B59A8419791D1D02BBBFF1DA34873132B38E3EFB1069D195F246BABC1A0F7A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777010629, "uuid": "34a87ca1-e064-499e-ad6f-b4a1f4bbb2d1", "value": "12288:9H/1NSDoGGbvdaWHCquboOEnKLRPUOKyvMPTp7RqzBMa7u2tTvx2OFU39ysO+R2Y:9/eZGbYWHCaEUOKZp7ZWu2+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777010629, "uuid": "3aea7105-926c-4b3b-b608-45d70ee953d2", "value": 580880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777010629, "uuid": "a843037d-af48-493b-b764-489594b71d19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777010629, "uuid": "6811f261-9522-43d5-b3fd-79c4740a5b50", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f27b83c-3f7d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776994366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994366, "uuid": "e5676b81-5c21-4c62-aec6-c92fd9b15a24", "comment": "Malware payload", "value": "2e7059f69a14e4f248baf40f1d2bd3fa", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994366, "uuid": "eb8eec76-400e-4f2d-b123-d734fbfa591c", "comment": "Malware payload", "value": "c7f802baebadbbc1bae50189fd94f8ee7ea9f47f773d3291e104c0abd332f2ad", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994366, "uuid": "01d4f5af-c60a-46f9-afe5-4de2e5af1311", "comment": "Malware payload", "value": "a3da8be913f2304faa095dd97b8bffe9b8c6ec8f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994366, "uuid": "22854af1-65d1-455b-98df-130298ae1f51", "comment": "Malware payload", "value": "7ada3280ad3a51660115347dd85efd67803084637d9a1c3e5bc640ae342ce4cff7d677cc65b579c3d9c0d35321ed7cf4", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776994366, "uuid": "06544659-3386-4326-a557-68b03e43cf7c", "value": "T1FCC08017C1BEC52E9567D0921673550845B0EB4135749A35CF40988C71654D06206142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776994366, "uuid": "2bf8a602-4a67-4c1b-8c7d-e420d7e23214", "value": "3:j+qAHmFEm8nhcDQBfBJpoNIkVViEaKC5SufyM1KvN+KXxZH4nHhXpv:j+q9NqhnfBboNBnaZ5SuH1mQCGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776994366, "uuid": "3ee79e72-4c8e-4cbd-8e9e-a6821f763939", "value": 165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776994366, "uuid": "d755c27a-3eac-430e-83ff-430c84d71849", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776994366, "uuid": "7279a2d9-0a8d-4571-ad40-8d7969bc48b9", "value": "terrible.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b434326-3fc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777024424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024424, "uuid": "b2fd94a1-eb62-4b1b-bae1-428332d1e3a8", "comment": "Malware payload (Mirai)", "value": "deefa4c14f3b3dc5f210cc57c0de3fa9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024424, "uuid": "d387ade3-896d-4fe9-8656-312473e677af", "comment": "Malware payload (Mirai)", "value": "c876cffb991d5916bf5fd3bc4991dabf3e7ee776481f77bfc11bb3d20cf92ada", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024424, "uuid": "c5ff5747-3081-414a-b3ba-b983f2246016", "comment": "Malware payload (Mirai)", "value": "428bb8b11e1c58d5261f77abbd4fc21368f62006", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024424, "uuid": "37441a3b-eab3-4441-96af-b4ba6316ef9f", "comment": "Malware payload (Mirai)", "value": "b00ba063d8c69121489e79c44e09493ac967ef63407740b5d307881cfb95c155c985b5454bbb432e9f16e9fffadb85e7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024424, "uuid": "e1402483-6aba-4476-996a-56446437bbc1", "value": "T196734B276691C53FC05BD1F01BEB9522E862BC7E0E32704973E1FE916F3A8C06A5A711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024424, "uuid": "3607cc24-927c-484b-a6a4-caa7869870d0", "value": "1536:Unir1igF371f0Bpxy8BlYXDRD//zuxhTB2UhBer63tQBu:wirjp2pbBlWRD//8hTB2yeyi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024424, "uuid": "30634a7e-e3ed-44d3-ab2b-cd8e7f5fa0e5", "value": 75992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024424, "uuid": "7a5f7dc9-80ef-496c-aef8-ad61945fac4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024424, "uuid": "138d7182-90b9-4cff-9a50-ae7c6ec4e4b5", "value": "X86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92028451-4007-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777053668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777053668, "uuid": "64fa0c16-08b6-4ab4-83f8-0d5328f51d15", "comment": "Malware payload (Mirai)", "value": "9363fd6854c5bef85624d9d783290c14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777053668, "uuid": "4e01dec9-9b5d-47ca-8327-4457133d097d", "comment": "Malware payload (Mirai)", "value": "cb772aa889ec546f1d5511427155889a20a6ede481e48287bbb00f6c021cf9d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777053668, "uuid": "e88c1f3b-64ea-4053-ab43-62a79ec0148e", "comment": "Malware payload (Mirai)", "value": "e8bf7c8b921229c0a69d4cb27cf5c4010c15b8ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777053668, "uuid": "4c3f0edc-2501-40aa-9ba3-4d1f529ed2b3", "comment": "Malware payload (Mirai)", "value": "b048c1fb4d0d14b3d85d0376febf12ce107e1134727a84ade7e0de2bac19b81fc312e1232dd59f802846bbf6fcd5a3ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777053668, "uuid": "78006f97-65c4-48da-a2e2-29383c7adf8b", "value": "T11F336C36E029DED0C6560234A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777053668, "uuid": "e2955197-d2f2-4441-87e2-fbae54b4b331", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777053668, "uuid": "58ff7466-cf65-4622-82fd-43c06ba376ca", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777053668, "uuid": "2e9f60e8-e102-45e7-9e1d-3770d6733e6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777053668, "uuid": "5e0ddf9c-98b5-4314-84b9-aae984a2c4b1", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2c61b8-3fb4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777017877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777017877, "uuid": "53642d3f-bd5c-472c-9380-9ce06757d0bb", "comment": "Malware payload", "value": "dc8841741ae933aaa98487a19782aefa", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777017877, "uuid": "c7d63a02-213c-4f0a-a989-b28361b983ff", "comment": "Malware payload", "value": "cb9ffd9412fc0890a8117ea916dcbe221482a6c50c086356fad32b361618c256", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777017877, "uuid": "831b64c7-06b8-457f-aa85-c33481b7de4b", "comment": "Malware payload", "value": "fdddf82dc1da274123d2111835b9d3e7a7a74590", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777017877, "uuid": "fa83f9ff-f3e7-42ac-a2d2-b34db32e1273", "comment": "Malware payload", "value": "576cb4d55139fda6484764c02e4ea3d73a7d4e0ab3904a285c9483796e9f053cd12dff147b9cd52df32f893ddea42627", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777017877, "uuid": "bff35942-371b-487b-bc49-81769465f9ab", "value": "T14B252308710ACF53D7234DB490E7C6EA5714BE646F225353BB523B5EEAB89F200E249D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777017877, "uuid": "a6e298d9-88b1-4b89-9533-8429665068e1", "value": "24576:mPA5tM4//A28SQ+bwYT1pefVcZua/YjYOrtdjDRg8:O6McX8WwYT1bZ3M3lT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777017877, "uuid": "3c8ef183-4f01-4551-b1b3-3631c72a2dbd", "value": 1021952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777017877, "uuid": "d3c7ee6a-ae53-4ef7-aad3-8beb5c4fbbf5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777017877, "uuid": "9a022ed0-fe66-4d5a-95bd-83ab5b56439e", "value": "BalanceXPayment.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52e0006-4034-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777073108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073108, "uuid": "dc83cd56-a54c-40cb-8261-f2cf9e7903da", "comment": "Malware payload (Mirai)", "value": "b2439918e18d5c352a69dcea53de2526", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073108, "uuid": "65d0547d-07a6-49a5-9ee4-d9b69cd5a275", "comment": "Malware payload (Mirai)", "value": "cbd949fe03c9c51e135d6415504d3f78e95ce9ae96a09a62ee8af94dd02843c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073108, "uuid": "74ad85a1-c232-4fed-8db5-17f5fb811d9e", "comment": "Malware payload (Mirai)", "value": "760f99f80db4a829bbdc1cb057e37927f8e055b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073108, "uuid": "9bd7b4be-75b0-40a1-a7f5-41961cd5e607", "comment": "Malware payload (Mirai)", "value": "eef9deb2727f99c02fa52adbcedababefe765688022db3887ad8a100026e3377cbcd703d72a8f1c4d6f8cb286720ccfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073108, "uuid": "d6fc5d19-2120-4a7f-b405-f569a3fce99e", "value": "T1A3B35B77C8266F58D268D1B4B0B18FB92B63A915814B0FBE1AA7C2B54043DCCF6053F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073108, "uuid": "5fd67d21-7fa3-4eb8-9f0e-c677b7e80e28", "value": "3072:qCVp94uDT2bCI/CEexgud/zPNWEsWrz/:qe9CbCIKEexTNP4EBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777073108, "uuid": "efc6f6ae-f115-4035-b094-3d41c5cdc9e6", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777073108, "uuid": "d0def3ba-d92a-4ec6-a5eb-77e34ac707a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073108, "uuid": "eab3a6d7-7a17-4ddc-bf3e-ef57c355ee6f", "value": "jew.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd42bff0-3fd9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777034091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777034091, "uuid": "56d0ad51-54b6-4f31-9362-50e9fcbb96f7", "comment": "Malware payload", "value": "aa9a884de95d473be20e89ece28afe1d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777034091, "uuid": "43e014b5-af6f-4312-ac3b-3f4a4b3c6502", "comment": "Malware payload", "value": "ccda376f08490c16d8e61f86c26792a9e91f34f9c95938194347ab94b046f59c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777034091, "uuid": "1766ac50-7231-4efd-871a-a4554b09b2ca", "comment": "Malware payload", "value": "1c442638e9a360c7c7425c8cb9b39ed2d9267994", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777034091, "uuid": "32e3fd90-cae2-4626-8e50-55b112481791", "comment": "Malware payload", "value": "687b3087d6437a8b5a336cce3373b902b4447b76e03b70b08bdd36163308e67ba1890148d6d29a5ebef1e3251047d844", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777034091, "uuid": "2eedf9ae-b4b6-46a6-a379-ef63318a6a87", "value": "T1F43633EA364C4B4EF64CCA7A82568930CBE14C9BCB455D7338790A31DAF30165F6897E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777034091, "uuid": "79b54dc0-e597-4ffc-b215-7864ec5c7a15", "value": "98304:A86tQy+5jDwHHC8uNONfqQndQib/CGiQH+uGZZBcF33A1TGY5HgAFFcFj3jF4IAb:7V2uNOsoW4ULBcF34iSgtPCIAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777034091, "uuid": "65aec57a-6ca1-4593-a4eb-63b7d5c9946e", "value": 4996428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777034091, "uuid": "2f3f310f-594b-4355-993c-fbc02da574b0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777034091, "uuid": "0193766b-95d8-45e9-ada8-b31caaae1f9b", "value": "EXECUTORV2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c75d58-3f82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776996383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996383, "uuid": "2104988a-64ee-4184-8732-387a17e05e9a", "comment": "Malware payload", "value": "c98f8680790d572280d0fd7987c5de1f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996383, "uuid": "16d01f2f-c689-440e-8590-4a5781784fd1", "comment": "Malware payload", "value": "cd972d0428133053af08d2b9faa3e6167b3e7288f8422528ccffb990b0e8a837", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996383, "uuid": "d4b28714-1bd0-413b-a254-ea8169875277", "comment": "Malware payload", "value": "612efe73bae931f96a001391b1992a6fdf421da3", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996383, "uuid": "4600208b-2bde-4226-bba6-90b79aae500f", "comment": "Malware payload", "value": "51e97862fd864ccd98515d1b3d5e970c840305d81ced5be45e3649eacaaa2c10762aa6999eae80dcef59c5307480ac52", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996383, "uuid": "b5912624-be2a-4363-b3c2-203bdeb8e8e0", "value": "T1CCC08C27817ECA0EA967A0A20672954886E1EB466A38EA32DB409988B2614906207192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996383, "uuid": "45d3d817-6a9a-4575-b085-ebe61c2978b8", "value": "3:j+qAHmFEm8nhcDQBfBJpoNIkVViEaKC5SufyM1KvN+mERHhXpv:j+q9NqhnfBboNBnaZ5SuH1mQmERL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776996383, "uuid": "370c66e9-a36a-4b92-8695-78042644a17d", "value": 162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776996383, "uuid": "637d48d8-f4a0-429e-b276-beb5b60c503c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996383, "uuid": "7af754db-645e-4366-806a-8b01da52f64f", "value": "Elementary.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4908b37a-3fc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777024340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024340, "uuid": "b2470822-a2e3-4f3b-90d7-287084d98d56", "comment": "Malware payload (Gafgyt)", "value": "6aab1daa89d7868a4f5eb5e0c66598cd", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024340, "uuid": "9d6e1a55-1c35-4b30-b0db-288affc60ea6", "comment": "Malware payload (Gafgyt)", "value": "cdca813e68da420c7aae63fc7a31f926413c8d24e42c0add78795e339509a3f0", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024340, "uuid": "303dda7c-59c2-4841-a91e-1cbbf34209a3", "comment": "Malware payload (Gafgyt)", "value": "48259056b027078885b96e415b44a3d824dea23d", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024340, "uuid": "d12baa9c-0657-4a7b-a443-8ebfc7b4ee44", "comment": "Malware payload (Gafgyt)", "value": "87c5154018c62f560a92d9520a8b436179443d9edaf4c3b2cc9d817750f3280f825c69ead55fc7dee5884cc45ba0271e", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024340, "uuid": "d3e31dee-6ec5-4503-a4a7-c8736e3f40ad", "value": "T1C4B31B49E9519B1AC6E231FEFB8D418E33131FACE3EA3115D9307BA023F5ADA0A75511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024340, "uuid": "4b1a7657-a087-4298-a2f3-5b3c93e36ca3", "value": "3072:GBO64nHoaq5QotwxaZqb2MdgyMtsIiNfz:GYoaqGotwxaobYyMtsIkfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024340, "uuid": "149a0413-4b6f-46a3-93b0-4b2da4c4965d", "value": 110324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024340, "uuid": "2008b303-d712-49c9-9352-11889d5a1545", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024340, "uuid": "0e8016f7-4b1e-4375-b7b5-73cbb3b21d19", "value": "ARMV7L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0a891f-3fbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777022818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777022818, "uuid": "07c1ec92-b562-4b4a-81e4-3a35fb19acf0", "comment": "Malware payload (Mirai)", "value": "06a18bb1c17b3c64e47679bb641e4ba8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777022818, "uuid": "f7f124fb-6dba-45f8-8374-9f329a1f5ae2", "comment": "Malware payload (Mirai)", "value": "ce270a97a9bfa060a03ee970d92b11b5af10820de59a6b4366674e65846c7080", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777022818, "uuid": "09e87a6e-aee9-4ae2-b1cb-553c87080fa9", "comment": "Malware payload (Mirai)", "value": "13010b9c7a2383e2a95907cf5020dd3c4cb2925d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777022818, "uuid": "1ac4b701-3356-4dc4-b46a-dd05e3878a54", "comment": "Malware payload (Mirai)", "value": "5fb1fab7aa2d5f72e887358368258c1af4fd69bf04776fb42d09623e35833d68f3e9e81e693e5c55b342b83d8d7b7e4e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777022818, "uuid": "8380db45-18f9-46ed-8eef-1bac2a4249bf", "value": "T14793074ABD81AF11D5C913BBFE1E018D335367A8E3ED71129E206F2167CAA1B0B7B451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777022818, "uuid": "0fc7f55a-3db6-4d41-a89b-b55969bcc68c", "value": "1536:RpnmWxz+/BfTt/F0M6HecUCw83F5zVatBEHu8xIEm6mlNliSLhiE+8QY7+QwbZnY:+WJ+/BfTd18ecOC5ZajEHu8x6vpLhiED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777022818, "uuid": "6560cbcb-417e-4917-99ef-e4427cd9c2d3", "value": 96912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777022818, "uuid": "7540335e-0d31-4da1-b7ca-09dd5f99b542", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777022818, "uuid": "788e1d40-dfce-40ff-b333-96f3605beccb", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46f65ce-3fd3-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1777031445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031445, "uuid": "6e434e05-a3fa-4497-84aa-505f4bd96bd9", "comment": "Malware payload (VIPKeylogger)", "value": "ebe2295a3536e91d6737e272d7ae1b6c", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031445, "uuid": "dcf8ba2f-78a7-4d80-8ed9-13a92cd54cb1", "comment": "Malware payload (VIPKeylogger)", "value": "d027f3a41d993665eca328e48794a24ae18c038aa61c2aa76f221e1749e350fd", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031445, "uuid": "845328fb-3a20-43ee-a5d4-17c6384c98ca", "comment": "Malware payload (VIPKeylogger)", "value": "93e8c6045cb55816e7a75ec21a538e54d2fbfe06", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031445, "uuid": "25170910-11f2-44bb-95f2-a81d78e1d861", "comment": "Malware payload (VIPKeylogger)", "value": "ecbdc40e014efe50f8fab0c35d14a8660973849948e59dff46b8f0b643f5a5c338b6de0a0b66908b6355b462cddfea5b", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031445, "uuid": "b1dfad95-d84c-4fa6-ac16-be135ecc8c37", "value": "T1589423280F0AE8B856C4E75D728ABD493F468B40D9D971D3E0C7DCC66E4E942869F0CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031445, "uuid": "014aec49-3998-41d3-b601-721711cec28e", "value": "6144:drBpkLvXHnNgn9+layxb+HORvzV4LYFjXliYjShxIi6QdIkDerjJmBMGcUAv/RU:GXtg9+lay5+HK5iqSvPbefJmuUA3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777031445, "uuid": "b2680174-3106-4cf5-8c53-2b4e8c7625db", "value": 416777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777031445, "uuid": "58629452-eb36-4155-988f-507e5d5df411", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031445, "uuid": "9458bc85-9de8-42de-992e-bd6ce6fd878d", "value": "social.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfbc3d41-3fa1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777009963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009963, "uuid": "4a70c13c-1221-4c78-b803-73d7b0aecb12", "comment": "Malware payload (Mirai)", "value": "0769518588c9f42fc42a2363f2ac8da6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009963, "uuid": "9a1d5123-b08a-4863-955c-b9eae656ef14", "comment": "Malware payload (Mirai)", "value": "d0d217a35967558db63a09e762e1549934d6032ef8cf9205188bb7231a741ef8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009963, "uuid": "3aa47a4a-c1ed-4670-a9d3-2aecd128e3a8", "comment": "Malware payload (Mirai)", "value": "0253ed62f28353792ab622868f7308036d6cf137", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009963, "uuid": "3e3337cf-3182-49e2-9d15-2987e81c89af", "comment": "Malware payload (Mirai)", "value": "f1016f45f530e2b37233cddeda0a28a0eed216e1f5812496c1cb7f7219ff5b7920de6f6ead1bc17a8f103a5a499ac96a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009963, "uuid": "89cff1b5-1c07-496c-8bb6-56f55e550639", "value": "T123140742BD51AB23C1E232BBFB9E428D37196B69D1EB72069C317F5037C68DA0D76241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009963, "uuid": "cfa949e5-3b77-4550-8608-dec753b53614", "value": "3072:qfVG24mHzcm1ZvlqqHPaW7+YRaW+EuAKfh50iFrcYwsjL13:qfoW71ANEuASh50itcYhjL13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777009963, "uuid": "67f7eb43-21c7-4839-82ec-d0bdc9ea3b2d", "value": 204548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777009963, "uuid": "26deb7b0-2948-47a6-98c4-4b0e9b96b7e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009963, "uuid": "8b2cb82a-b1d0-48d8-a08f-976ae53d45f3", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2dfbf4-4036-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777073787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073787, "uuid": "9ea2b6bf-642f-4d75-864b-c1f601666142", "comment": "Malware payload", "value": "0f44fcdc1822aad480194ab9d32bc548", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073787, "uuid": "33ba5595-f9c9-477d-9e85-474323ff5a27", "comment": "Malware payload", "value": "d1b12b48249d339f2203a91420c25a156a78db0bf04a4ffc8b00b3f632049fc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073787, "uuid": "cd4582c2-c4c4-40b2-92b3-824acafa1464", "comment": "Malware payload", "value": "c721a06d4115bef527bc825812020b80e6decbd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073787, "uuid": "b0b88399-5a65-48a7-8196-4d2e1389a1ef", "comment": "Malware payload", "value": "9ef78d0a61c1038d7bd7002bf5b9739817dcc424cac72fee11ec4a1ff6eae02591d71aa9af11ad39a5dacf6637d25337", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073787, "uuid": "1fc28e21-bc29-481a-8db1-a4a5510c55f8", "value": "T19475D153AB090F9BC0EE8F34C41A829A03696D939951C76EB69C3F5D6F3E3994FC1448", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073787, "uuid": "1e3145f3-d04f-4f3c-b39c-2c0074e08fd6", "value": "49152:SPS3333333333333ZI3a33333zxz7XNo5Jxr9bLNoPn0:S63333333333333ZI3a33333t+Rdos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777073787, "uuid": "b016775d-da31-442e-86e8-4cbab59a34e2", "value": 1640870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777073787, "uuid": "fe411b40-71cc-4589-949f-6b3e8a7f9142", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073787, "uuid": "8c62ce2b-2ffd-415a-bd4c-221f40d3e393", "value": "bot.mips64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653c2558-3fad-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777014938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777014938, "uuid": "1c392ca8-8646-43a4-bdc1-6b1d19a4dc3c", "comment": "Malware payload (AgentTesla)", "value": "ea518adc9cc92c298a13155989af1c14", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777014938, "uuid": "d8bb1a07-309e-4fe9-9bc2-458ad79ffb0e", "comment": "Malware payload (AgentTesla)", "value": "d2b15b49e5d1c170f6f68700050c2704267133e19fc42422fd5a92f805e3cc23", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777014938, "uuid": "fba9fac8-fcd5-47cc-b072-169270f2c61a", "comment": "Malware payload (AgentTesla)", "value": "11934c0ab7577b22338b42c67629c3c603361e15", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777014938, "uuid": "4026d99e-5e4e-4525-b756-7f00461c0e65", "comment": "Malware payload (AgentTesla)", "value": "092ab30f183380d535375ea403ad499ed2b41f1f1af56f0d3d23c95462081cd370c25d0e54edcfe0f665dcc03c12d739", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777014938, "uuid": "b16fceb4-2a65-4911-95af-791b733f1d36", "value": "T1BCE3015316C981A200FA9A2CAA15B30FBB5DD5F74B88F1DC228FA5AD600CD5F8617793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777014938, "uuid": "8e09adb7-37f7-455c-9895-0983f44caeae", "value": "3072:PR0zHTuFVzkdaCI5LyyqfabRHuMS3ZmRA5:Si/Z5OyEadOhoRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777014938, "uuid": "370d08db-8998-4434-87e5-f20f5a3106c5", "value": 150297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777014938, "uuid": "dd39291b-4187-485e-9c56-f77fc5525d7e", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777014938, "uuid": "4f846983-be92-4945-b70a-55455b0d00ae", "value": "HKJ987656789000.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9677345-3f9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777008234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008234, "uuid": "c1b9d2a5-aaba-4138-819b-5f26fa022d7b", "comment": "Malware payload (Mirai)", "value": "d1482e71ee74d7aae96ef6882a43d0ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008234, "uuid": "4d862905-810d-4398-ae2d-f6266d826024", "comment": "Malware payload (Mirai)", "value": "d377a81cf36b246ebcb91c37a8341ed85b3ba0e86c4267105dd78a62fd3ab219", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008234, "uuid": "cb40375e-c8ac-4c4d-aef8-c57fbb8b1959", "comment": "Malware payload (Mirai)", "value": "30d288572a041fe527766310b9038e642f264319", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008234, "uuid": "63134a7c-dea3-47d9-8841-00bc063cbc30", "comment": "Malware payload (Mirai)", "value": "24679e2ebe7b69ff8ca3249354d4d6dc74382e665314e7a7af33369131e693775b450a579ee0f0800f56b3469e3cba7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008234, "uuid": "9a8ee623-5514-4552-9647-5a1b6bbecf2d", "value": "T16C140752BD51AF23C1E232B7FB9E428937156B69C1EB72069C327F503BC68DA0D76241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008234, "uuid": "b1f5e9d9-6070-4b6e-bf24-81e6be8e1fae", "value": "3072:k3qnNVmbPUxwF3sJdz+Myno6Zy5SbClYagAyvXCP+gP59RkvJy3:k3Cyo6M4bqYagACXCP+O59ivJy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777008234, "uuid": "4745016b-4906-4d5e-8d6d-9a6a7f1a1586", "value": 200612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777008234, "uuid": "b41f430a-d721-4050-9d88-1c04789ef675", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008234, "uuid": "99efdc00-b91a-40b4-a895-043b2d5af969", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "155f2690-4033-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777072357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072357, "uuid": "692f6f6a-8b66-402b-afa0-37bd48aadec9", "comment": "Malware payload (Mirai)", "value": "80792ef82ad690acc9c20ac3caa5519a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072357, "uuid": "d2028ea5-e09b-4418-9444-822cba976e82", "comment": "Malware payload (Mirai)", "value": "d37845f4205737ead7afd24e5078752ba842432bdb961035f8ded7a4c289a47b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072357, "uuid": "951f11c6-1945-473c-82e7-34018a3c046b", "comment": "Malware payload (Mirai)", "value": "3eb8899a20bfbd2492dcf7160a621990eb7e3fee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072357, "uuid": "e3ccabbe-c68f-44be-9c86-ff9e22ad58c0", "comment": "Malware payload (Mirai)", "value": "2da47982da4385a6a5094e700a138aeb38b1cab6a8d2dde44273f81a7cbe6b03e1ab15dc9fbaa183f1a2f8340bf20c1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072357, "uuid": "e4ffdf40-b112-44b5-8078-8828530676d0", "value": "T1EFA3C609BF350FF7E86BDD3709A92B05198C551A22E97B367A34C858F64B21F19E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072357, "uuid": "5367e3f4-c7df-4d4d-8dda-8a9e19b31cc8", "value": "1536:9kkdyTy3yryaidLVeMLW9iqzrN52rRlspIwVjDZiLcTN3s:9kk0UMSJ9WIorjqWjDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777072357, "uuid": "fede1713-ac25-4414-9b8c-f70af64bda1b", "value": 101680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777072357, "uuid": "b8ae40c4-ed71-42b8-a7ec-16a8fe964e6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072357, "uuid": "1c88945c-2fa5-4e56-b301-b4ae9e259d28", "value": "jade.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509c96fa-3ff0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777043680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777043680, "uuid": "607bb592-bed0-4e38-80f7-6da33138e34e", "comment": "Malware payload", "value": "5c3bf036ab8aadddb2428d27f3917b86", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777043680, "uuid": "1feb2359-4460-4126-8dc1-a6cb6e864bf8", "comment": "Malware payload", "value": "d4c184f4389d710c8aefe296486d4d3e430da609d86fa6289a8cea9fde4a1166", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777043680, "uuid": "5427ba08-7f5e-46e3-8b79-627ba47dc713", "comment": "Malware payload", "value": "e9c16aa2e322a65fc2621679ca8e7414ebcf89c0", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777043680, "uuid": "82a69dd1-0679-4122-b03c-f95e5141793e", "comment": "Malware payload", "value": "73676f7d60079fc33632b21cd71feaf1ab865fef42130b5ddb55d71d80f58ac636430799b654fba00d53fc43a1dcad5d", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777043680, "uuid": "7f2b17b7-0f40-4ab5-bd3d-62e2a739c275", "value": "T19FA2EA4767F61144E1F36F3D99FB40AB497279416A35C22D04AC124E8BF3E22846E777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777043680, "uuid": "674cb124-05de-4ce0-882a-058c3e61c6bf", "value": "384:CfMs6stuic313oMX4V0FQITMr2HUVifpdR4abwRNwtkp5YLJ:C0OTI4V0+IgkjfpdR4abwRNwtkLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777043680, "uuid": "400a97ef-a9b8-4734-9083-bbdf262eea34", "value": 23079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777043680, "uuid": "bc4ec74b-899d-48df-b4a5-7f7b6616169b", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777043680, "uuid": "0c0c665a-a2b2-4ce7-b147-7ee15bcc7445", "value": "\ud654\uc774\ud2b8 \uc0dd\uba85\uacfc\ud559 ERP \uc0ac\uc591\uc11c.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8981be43-3ff6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777046352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777046352, "uuid": "f43899ee-4047-430d-8616-3d48118d5d80", "comment": "Malware payload", "value": "5343f1eb6ab4d78ee50b08bfbdcd2808", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777046352, "uuid": "a9997838-e02e-4207-ae5f-e4346a48225b", "comment": "Malware payload", "value": "d4c842c455ebc4dfe0f5584b83cd8f02eb2540d31f74414c10ecd92deed04142", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777046352, "uuid": "a5e66aba-9188-48ee-8b7c-06a85dbab636", "comment": "Malware payload", "value": "bc763770bc85c5c5f448428ec351e125b202cac1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777046352, "uuid": "a9cebf84-0f55-4d85-a21a-aca9e485ebb2", "comment": "Malware payload", "value": "1a46d984cc1bd46cab167cc67f2e5e6cdcf0d30453ad3a3f51312de205a5587a869977204cd07ed481344d87eedf0be3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777046352, "uuid": "45f87757-1877-4b0b-8f73-929c8fd84273", "value": "T1A885E047FB1C4522C9570EF0197F43D5F7217A5341F5A22A270E67672222E3AEAC738A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777046352, "uuid": "89cb196d-01fa-4bdf-9178-54403e5093c8", "value": "24576:xHUcf3MuHMwp1W6mYSWgZXpAvMCs75qbPlAuRFcag8x/lY5KceDz5oorw:xHUcf3MuHMwpsdZXpabPKag8JwKxDz5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777046352, "uuid": "de5ca01c-b62d-4fd0-b0a8-f5d12d610eaf", "value": 1708717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777046352, "uuid": "1c53828a-dc2b-4036-9532-63c5578be1a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777046352, "uuid": "32a2751f-a70f-46d2-943f-fb41083dd6e4", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc5f9a7-3f85-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1776997957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997957, "uuid": "f1c17606-1b34-4eb4-a35f-250439c0accf", "comment": "Malware payload (MassLogger)", "value": "3bb8a55d0196e2a1e6cd5aa1ab2dd740", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997957, "uuid": "ec927722-f10f-4f07-a2f6-8aa9510acc5a", "comment": "Malware payload (MassLogger)", "value": "d4ddc00abfc90f17f67aa75bf122351f5c2ef7c2b9d475ac185053485c50f54d", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997957, "uuid": "08187efe-8a1c-4ef5-9a1a-f1d43962c841", "comment": "Malware payload (MassLogger)", "value": "c392c86767ce2c41e9e79aa9bbfae3899ac4c037", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997957, "uuid": "82d28c29-2d9d-439f-834e-7c682d03fe52", "comment": "Malware payload (MassLogger)", "value": "bbb7725b5e2eb9e568c45164fc5d98c7a42ffa5864ec9589abf78f8148c5e311fa66e66e126f075a9bd0940f872d44c6", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997957, "uuid": "2a718235-7afa-4016-86a6-9cde66a73fa3", "value": "T156B312510DD393BCFE5FBA24340B64ADEAD0102C945F89DC7EBBD3AAA527517022F860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997957, "uuid": "c52834cd-ae75-4a1f-923a-e22704e0b469", "value": "1536:/Y0u+uaxUrqKMUblVgmbXB/2Z9BnaXgAAAVxbGbwHPrTf3M9jXXgcrMms:/Y0ux/M4gmbXBOLfYVGg3kgkMms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776997957, "uuid": "d064ff67-7865-439d-9dc2-ffdc6d14330a", "value": 108604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776997957, "uuid": "d851d85a-9a97-4358-b00d-c1c083194ce9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997957, "uuid": "3f02bfa1-4cbc-4c0c-acc4-841b5d2cdbde", "value": "PROVIDER.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f85c345-4004-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777052375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052375, "uuid": "b4f9fd3b-9bbd-47f6-91c6-733073560e12", "comment": "Malware payload", "value": "167922e3f248acad9fd1a0082bea230a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052375, "uuid": "17b66075-32a8-4ba5-aee6-ece2271d2d4d", "comment": "Malware payload", "value": "d5083bd3c1ec7557e069eaf8837db0113dcfdb231bb67e1c9758b0b22df1f6bd", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052375, "uuid": "59582943-f5c5-41af-b95f-c2508b765db0", "comment": "Malware payload", "value": "5bc04dd7795e13690fac56e30ff80950f93beb2d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052375, "uuid": "594a6614-b043-465c-b4df-0aea8e738a33", "comment": "Malware payload", "value": "3f2fc4c4c307bfcfc274ca377b0ec6375fc9e1b07c1bfb353ac5b88432fd0cd1e2c8ed98fc7a4ebd33e97ef0e592eae3", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052375, "uuid": "7c9152ac-dc45-4a8d-a0f7-09a3f54d014c", "value": "T1E9F523553684447AE06702358A2666106B37FC245BE1C96F3399F23E6EBE3C0D636F63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052375, "uuid": "7aa891ba-0d00-41a2-abc5-24c9685701d5", "value": "98304:gAxjxaJyivu4IqldmHouhVS4o5Ig9vMDrMMlr0Trbb:g4x8hW4IqloFrS4nSUDr7lrSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052375, "uuid": "34e576b1-fa4c-407b-b3f0-0bfc6e46e5de", "value": 3383296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052375, "uuid": "e5ccb732-9d4d-4812-ad81-7b273721829b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052375, "uuid": "4779b8e2-0a97-4fad-8122-adfd17890cd9", "value": "AdobeClient_1M2GO8AFE3ZEO_19SI0B7FBSUF4_windows_x64.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1452a0dc-4021-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777064624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777064624, "uuid": "3e83a307-4cdb-4a6f-929e-283f09fcc5b1", "comment": "Malware payload", "value": "c8bfb9deb570936219709825918be9f2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777064624, "uuid": "7ab4c7f6-8078-4f67-a7f2-39d9c7f84790", "comment": "Malware payload", "value": "d5245bbd4720737a59a7f8dcc74e222d35c9e1a6576798dce771bce54bd066d7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777064624, "uuid": "ced39eaf-66c7-4f05-801e-4e41356fdd74", "comment": "Malware payload", "value": "bb208b641257dad2b6434d73dba852f5d100d9c6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777064624, "uuid": "a321579c-d95c-4c9e-a13d-c8f6698c40e0", "comment": "Malware payload", "value": "e859bc6220bd0395d2f8577cff3b95beed0f7304fc7fc0c5d558a636bebdff802b39eedc91536938475d6eaca41004a1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777064624, "uuid": "318af281-04fe-4fea-84a5-5b742c11bbe2", "value": "T1BDF42366C6C1F8A9D846D07ABF8F42BFED11DDE6192AE11F6E78A040380D0B27D175E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777064624, "uuid": "18cbf631-f5d0-46b1-8e68-52f099aabbd8", "value": "12288:2h28sP8d930JXWZGhxVJHps5JKMDUfowlleNO8Lcu6c2578L8s5skzViQlp0vD:is20JIGrpGJ5wlwNO8wb5n6s2iY0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777064624, "uuid": "9fac65bc-b197-404b-aead-172be0e916f1", "value": 767187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777064624, "uuid": "cfb72704-5ee3-4b6c-a3b4-a90bb7485777", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777064624, "uuid": "ae64239c-9adc-4d20-8feb-3fb9d69f07b4", "value": "Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee63e6d-4031-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777071863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071863, "uuid": "cb398358-3ecd-4cac-ab54-561351dde44c", "comment": "Malware payload", "value": "b53c3078ac904f724eb6dd434a335752", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071863, "uuid": "e2cdccde-441c-46dd-b47f-d2ada0371753", "comment": "Malware payload", "value": "d621ee9d0a113413a75149e14ed3f222e8a3d2f74a9206627f6c873fea0968f6", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071863, "uuid": "d66a7740-664d-4832-a988-f833f6a3249b", "comment": "Malware payload", "value": "9ac74d90ca4d09e6a5a0d1ac33755d1885b4c14f", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071863, "uuid": "a7be0312-f85d-42bf-882f-e121d4d3ad5e", "comment": "Malware payload", "value": "aed99a26b5dbd9508c0b0706006cdc628b9a4da01f1197aa6dabbfac767e3dbdab2a5651734df77a490df7b0aa15ee5b", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071863, "uuid": "e99914e3-be1f-4721-bbc0-dea72f08fea9", "value": "T19E041215FFA74D84452AE52C30FB99CE2DAC42B4D04C0D7255A892F7093F7BA9393B98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071863, "uuid": "978cf1be-b0ba-40bb-b21b-9c22d380cf09", "value": "3072:TZDoKmapVKeaoKaaaB96snZBjWxP8eNZZrca03aKqlq6Fr5uvyYy1UCe5ec+mG4:TZ0cao8aB9JnjjWxP80LQ3Q0uALl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777071863, "uuid": "b94aeb64-6a14-436d-bf89-f12554ed9b02", "value": 180491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777071863, "uuid": "365f58cb-3eb0-481f-bc3a-3474a832a682", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071863, "uuid": "88b7ca26-fac9-4136-a02e-aab307857648", "value": "Everyday.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cccf765-3f9f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777008830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008830, "uuid": "9f79f106-a47e-4334-a3c1-aa4388e95d07", "comment": "Malware payload", "value": "6a9fe6cb62f3d90ec7242e91b5dc3624", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008830, "uuid": "b407e5a0-83a6-4302-8d4b-f63f75cfbb19", "comment": "Malware payload", "value": "d63dd56fce6ceb730fd56fa35def9bf1e26cf7d1683d1127245f423188148482", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008830, "uuid": "ba747e61-8983-4826-bed3-c3a0803fd191", "comment": "Malware payload", "value": "67228e41289f8b4a64d1bfe315cf1edbaf9da5ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008830, "uuid": "91da5490-5dea-466d-aaf3-6806e752a7e6", "comment": "Malware payload", "value": "1ee412344e3c5d4ecfb77ffcad6e0f29476e4c99eec32d20ed62a8bd6e3617240ab05f357f54b957fe5edba66880b5e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008830, "uuid": "1fe4e3cd-aba9-4230-826d-b41d25adbd52", "value": "T135141902771C0F47D1A36EF0263B27E083ABE96118F4A684751EBFC99371DB21585EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008830, "uuid": "c96cef1b-98de-42b4-a352-e177b6ac761e", "value": "1536:KxXKnP9vndDoQFxEB6uqEI5WxkxlVzI5KJwuqawXlKO6zXTVcvAlDkKl9gJoKGP0:znxndE2aPqWxEl51Sln6NBluWmk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777008830, "uuid": "316132b2-6e5c-4761-8441-6dd456132636", "value": 192380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777008830, "uuid": "c5a075c7-7ae1-4a45-8f92-ae72f4e989ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008830, "uuid": "15d437d4-3461-4291-97e6-4d378af15397", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5971c9a-4005-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777052869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052869, "uuid": "a606872e-9bca-4a23-827d-478b05c8fcee", "comment": "Malware payload (Mirai)", "value": "2952dfdb3c4dfc5cf5bb1dbcb11b4549", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052869, "uuid": "67fdbdce-34b7-42b9-a5bd-5213d1615694", "comment": "Malware payload (Mirai)", "value": "d68ebfc2c9650383c3fad825f1a07279b1141c63a86b26e2f38b88b007179c67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052869, "uuid": "d7d1bc0a-5906-42ab-b1df-0144b65486fc", "comment": "Malware payload (Mirai)", "value": "51e3a69d7e93eaac1aa5d049c740d24580cbe1d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052869, "uuid": "555f479f-2352-4b73-a599-3c4421c03054", "comment": "Malware payload (Mirai)", "value": "1cdeca3da8482e041f1db6a1adafa2f9d466a373912116658699aa33ae36f585ab8e1a8bf0b16443f1c68c2b12419e7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052869, "uuid": "c4309bc9-622c-477e-b915-9c8f3c898b7e", "value": "T1EE330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052869, "uuid": "5cdd67e5-b891-41c6-9b75-e4216fd46beb", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGg:r/hqaJMDg9eqK806MHdkfQX6HuCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052869, "uuid": "d2b9a2d0-437e-438d-a8b4-007249ba4aa9", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052869, "uuid": "256d0683-d0cb-4e7e-afdd-bd279c49efe0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052869, "uuid": "a953e7bd-97bb-4955-9c60-8180e81c7b85", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ebf9b26-4013-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777058790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058790, "uuid": "ab4755bc-b61c-430b-b219-420a547be0c6", "comment": "Malware payload", "value": "a9349a1013bc753ec323310c838de315", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058790, "uuid": "986a0269-be86-4a65-986e-57e7195d7a88", "comment": "Malware payload", "value": "d73c7447308464240a6e4dbec7d57156b0ce1d98f63f92e00a408f39ca04aff1", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058790, "uuid": "441bdeec-9484-4abd-86dc-9c05b7ce65b4", "comment": "Malware payload", "value": "e5f5b62bde3642a32dd22f169e096e3be1a9123d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058790, "uuid": "b8c95993-12cc-40a8-8307-e658342541b4", "comment": "Malware payload", "value": "28bf160df96ac1757ea94d455e282a081176820f70865497474d9c41d4fe2c7f9aa2c79799ff545d7034b2dcc93be427", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777058790, "uuid": "a101f1e3-e9e3-4f65-946c-c781a088dd73", "value": "T128E4F20545CC2FADDEE85B2C90FD271E73A04A8A941A698AFF637D06AFBF544530F085", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777058790, "uuid": "dcbb71c8-7bee-4d8c-b228-2ed67e4836ce", "value": "12288:cyCGDzSnfTk/8R/sVZTrtoIMUpR2KB4YsrME5r1:B8Tku/sLrtoIfAKmXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777058790, "uuid": "72e98dc2-5216-45f9-9989-3e284bf4ac1e", "value": 702024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777058790, "uuid": "b0c7155e-22a2-4a6a-87e9-cf4adba1db9b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777058790, "uuid": "8c978f98-871f-4c40-809a-41f1198f2fb7", "value": "tmp2DCD.tmp.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202db536-4033-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777072375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072375, "uuid": "0e7eeac5-ec0d-45a1-8cc6-5234d3bf081c", "comment": "Malware payload", "value": "f4354e31f204a9b22c9e99ff12ca10c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072375, "uuid": "1b027ebc-09c6-4909-baa6-9f21abe41be0", "comment": "Malware payload", "value": "d878d0f9722f5986044cff47ba24d614337f69b0f2921510b648a4db276d421c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072375, "uuid": "e470550f-8c25-4156-962a-5cc347ef285f", "comment": "Malware payload", "value": "5237d0c3e0d4796e7866ac9a8e195f266f716dda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072375, "uuid": "5e372e06-a37b-4007-80dd-6886f4bdd4bd", "comment": "Malware payload", "value": "e4584bd4e8e49858261f905b7dea67c6b6eea91992c4f17927025457184b9c2c68297d05452a4eae76f7fa0027c9a262", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072375, "uuid": "6614c47b-67cf-41e7-aeca-8dbf6997827f", "value": "T10E85E18AF783D4E2F25341F6024FC7F20574A126A057F6F2EB449A767876B922E1532C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072375, "uuid": "c8d32d4b-3d24-47c5-9085-a4d5709de29c", "value": "24576:UaZSKQphYuhMEZ10ObJPFEnPV/wyQBWPBnMw6NZN1z/W3s5pmCFz8IS/2AVJGlB3:FZSKQphYuhMEC9m05yNp/LH7S+APc2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777072375, "uuid": "bf61bf1e-40f1-44cf-b4b7-a922180f31ee", "value": 1717911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777072375, "uuid": "4e7cb903-56ed-4b74-96c0-46f3e2128e6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072375, "uuid": "97015a62-bbbb-4f79-a119-9b5850ad1ed2", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a72a1f-3fea-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1777041326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777041326, "uuid": "2dab9d81-8e0f-4313-bea5-8dc170bfdfd5", "comment": "Malware payload (PhantomStealer)", "value": "ff185b05b231eed98d33239f1b202241", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777041326, "uuid": "e885b16b-ddfd-4a36-957d-4dc765bd3d2e", "comment": "Malware payload (PhantomStealer)", "value": "d8a05deefe97c6bbe1e083e9d8a182e6b6e5fbc77af483d2cdef0b4cadec22ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777041326, "uuid": "d0268bf3-9877-4545-b44c-ebbc8b8a3c4f", "comment": "Malware payload (PhantomStealer)", "value": "fa12ecc7f62ab4af572a2ff261ff7c88f525bfe6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777041326, "uuid": "59b08cbd-0c44-45c2-a1f0-f11c4303436c", "comment": "Malware payload (PhantomStealer)", "value": "a8c2bd0ea655400fe2023079a9b418c8192788a3186e9be93f1a8c645549c58ed9cd644a73843aad6babde4dbd25c4b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777041326, "uuid": "ae9c439d-7c7f-4e28-a0ab-f26e5fd14ead", "value": "T15926BF06B7D40995D11BCA34CA1BE332C2B2B9650A36D2CB1965E74B2FB3F914F3A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777041326, "uuid": "18870cbe-c111-41ee-9fde-de46d5d58add", "value": "b1ca4f99aa188364d5170a21e93b5cb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777041326, "uuid": "933cdfd4-87df-4147-9859-057bda9413e8", "value": "98304:j87K9q2QTS2cvDVu8lPs/4jXISObkpXsd5KPiba4jkwUoyETGUJGYSBKshieGdXS:qKuGu8lxXfJXsKab5L1shih0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777041326, "uuid": "867e0ccb-640f-4116-8e9c-5ba7409e5e89", "value": 4633088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777041326, "uuid": "3d9ff485-e60c-4875-9ee3-4dfae50163dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777041326, "uuid": "055f399e-00f9-4e79-bb3b-528822c73907", "value": "pdh.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75ee1db-4004-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777052442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052442, "uuid": "2310bb1e-5779-4f3c-af4f-6f939d24e8f6", "comment": "Malware payload", "value": "12caad188354bb95f319335140a251ed", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052442, "uuid": "5fb9d06b-dde6-44aa-876a-b34aeee6b7d3", "comment": "Malware payload", "value": "d927e11dac042493b09ccb35b5a402e9eb550a5a2a5263b52aedfa70854072d9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052442, "uuid": "1674f90d-3d98-4401-8e1c-8db337fe0cb3", "comment": "Malware payload", "value": "6358277a6b1d756d41564e1d0d949b605a651f14", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052442, "uuid": "9d0e3062-c9af-4169-92c4-088d22a759f2", "comment": "Malware payload", "value": "24de0ca48abf9702c0e922a6dc93b08f01b968e818fce541afe5c019ed07e5ff1c81f94e87324026f658bebd676cb461", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052442, "uuid": "e88ebc24-99ae-47d7-ac7d-3e5118ff46b0", "value": "T1B362B70E321358D9C90AD47991EB8F79ABF1B801C9E79B384334DA363E507B5762EE44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052442, "uuid": "cbb06eca-f822-4feb-9c37-bb397ce570c5", "value": "efd7f22fecb87f90fef74b8027a9ff28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052442, "uuid": "513aebee-16e0-487d-9e31-d278db6d8911", "value": "96:GuEtq/3VEgUd/v/F6P0z59VFaA2g4/JAFsWIycj17GBbqPe1ZyaxEAheHSbSnfDf:JEtSFEfdPKuMAFP81Ks21ZyaXeqd4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052442, "uuid": "544fa47c-29f5-4afa-a3b6-4b31b4ce453e", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052442, "uuid": "6bc50c57-3e8f-4cc3-bbd2-ff63ab0691c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052442, "uuid": "d424c0b8-966a-4913-b30d-7cdd00cac4bf", "value": "logutil_p4r9ir.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea91f670-4031-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777071855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071855, "uuid": "1f132814-469d-4925-941f-989d9fbf168c", "comment": "Malware payload", "value": "f40eb1258906d5d3fe7e9f51d8affe50", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071855, "uuid": "376ffb7e-f551-4743-b9fb-218a2eaedfa9", "comment": "Malware payload", "value": "d957bce255b4cd2aa39c40b6e8843b933ed82db3052069b567f685633e15c107", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071855, "uuid": "868dae88-6324-4220-9472-f584b225b566", "comment": "Malware payload", "value": "b81b6d578e21708e720b2271b652743295471ec8", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071855, "uuid": "a38c46ea-28f0-4fb7-863a-2b4bbd3f57d6", "comment": "Malware payload", "value": "405991698b0d60c30454bd7616907bcef14d833b67936ebae37344d7a885f1a6c45cf258215e3429018419c56fef0504", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071855, "uuid": "5009a3fd-b6d1-48a8-b7ee-aabf33bd4239", "value": "T1B80523009DBBF92D2C3E0156326F1B0ED9B688F0A05D6D909FDC21E7A7E7E814506E78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071855, "uuid": "c141d7ff-7390-411a-b393-91ad7e0035b0", "value": "24576:4tNOdp8ttQq1vXiNsIafXrvoMwYu6QKHHEd1kMl:c0CPRDTFnE1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777071855, "uuid": "c9305a70-bca5-48c0-9789-90bcef02cc28", "value": 857651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777071855, "uuid": "cbf7e7d5-7701-49d6-ae6d-d5693ea44985", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071855, "uuid": "7e1abf09-64eb-4563-af09-8d31d173666d", "value": "DISTRIBUTE.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3eb095-4035-11f1-a769-42010a9c0008", "comment": "Malware payload (NetWire)", "timestamp": 1777073417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073417, "uuid": "553b2914-94d0-4a3f-917d-6588aa761bf1", "comment": "Malware payload (NetWire)", "value": "15436e835bad3a947c97bcf3da1429ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073417, "uuid": "40c580c7-1aa1-473d-9c3b-6ef3afc662fe", "comment": "Malware payload (NetWire)", "value": "d98322a279a554b9c24fc637a27534e1ae139382f84ad2de580096a71a35b3bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073417, "uuid": "6cfc8f66-9c14-4c41-accb-ee52bec692d5", "comment": "Malware payload (NetWire)", "value": "5a88b86b75b360d1d73b494ea645a32f55033cb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073417, "uuid": "94b753a4-7f3c-4571-a54f-e3393de34065", "comment": "Malware payload (NetWire)", "value": "c292f4ce58356431b208550e0459499946cad50b337ed73883604bc54f76f10f68ab00a70b076ae07e27450515dbf3cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073417, "uuid": "c9930379-cda9-4d57-8828-35b4b2f59309", "value": "T1BFB3F905E98BA0F6FE0F1C7092DBFBFF46399904C234CE62CF54AD82EA63D1A1149655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073417, "uuid": "b05c96a8-6ff3-4b4a-9649-2bc5f6dfaf9d", "value": "844b1e992f862088369589b7cf91ba21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073417, "uuid": "2dcd5d6d-7129-40d6-a043-de28842e1b97", "value": "3072:ROzIy5XGViztldWl88Yed2DQuIAQvQ+d0aY/RX:Ro2ViztvWlvd2UuIAQvQ+yF/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777073417, "uuid": "107ee5e6-4f7b-476f-8d1d-dbf541123ff0", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777073417, "uuid": "e0fdae81-09f7-4996-8a76-b1528a368825", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073417, "uuid": "31975b81-82d8-4300-ad3d-6efcaf0a3bd8", "value": "15436e835bad3a947c97bcf3da1429ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb983a5-4034-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777073097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073097, "uuid": "b93984fa-46c5-4052-b84b-75f21d3db31e", "comment": "Malware payload", "value": "c1725bb7aa1bf910950462fa0fc0f940", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073097, "uuid": "726cc686-af3b-4654-bd1c-575e2adf27f3", "comment": "Malware payload", "value": "daa4569b313407d348bb230825dc5d39bedb7956b9d6a9803faed5ad15c27171", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073097, "uuid": "57a3d97e-d6b9-44c8-b339-a67af8e247cb", "comment": "Malware payload", "value": "eab40578270d49d64254f580ce8c029e4a7a7ed9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777073097, "uuid": "c26c0841-c30e-421e-8f2f-63599368ca31", "comment": "Malware payload", "value": "1f9abae2e41371cad9e9e828b21bc159c5b451ede5837c6f00b2cec0f1a713608cf39dcca9fe9b72813da7a3ce2d401e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073097, "uuid": "b10a18b1-c690-437c-9d15-df8033f8bddf", "value": "T10095E046F2F374FDC467C030835BDB626936F46551222D7B21C4DA382EA6EB01B29F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073097, "uuid": "755ecee8-7811-4043-b2d3-40eca785486e", "value": "49152:A19DV6Ab6AGRERWKznF4Am3W/ylu1YQ6edKbQNL54qp5Ril/:K9DV+Ridm35luyGMbQNd4q5Ro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777073097, "uuid": "474a5be7-120a-460d-ac12-4912813b6008", "value": 2022543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777073097, "uuid": "16839b72-5761-4dac-8969-61509a4367a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777073097, "uuid": "c3e817ef-db82-4799-ba6a-62f0fa16e4bd", "value": "bot.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1745ab92-3f71-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776989037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776989037, "uuid": "ada6c880-b28b-47e9-a23a-13afcbe394f2", "comment": "Malware payload", "value": "0956364ef12f42e621cd83336f86b536", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776989037, "uuid": "a06fc338-e73e-463f-b65b-6d8a9d9c5a46", "comment": "Malware payload", "value": "dc6d60fded45b1bd8f6155e607754dc945657096139f0fee54d31a380a1df06e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776989037, "uuid": "a517cf9d-2e5f-4747-88f7-35a71443236b", "comment": "Malware payload", "value": "e48aafb00dd8d28ecf265bf248f33af8c593b011", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776989037, "uuid": "44242986-5c1f-4722-92a7-84b65804e05f", "comment": "Malware payload", "value": "d4eb77f341c4cc40e9ec16ad3f17337ca229441afeefbbbd1b293ed247947a9bd5efadbcfa9bffb2b217f35e77dacfc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776989037, "uuid": "b469740d-6401-4f69-8a47-26e36bec1ac0", "value": "T1E7D37416BB519EB7CC1FCD7305A94901208CAD5A12D92B6FB2B0FA5CF36A94F09E3C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776989037, "uuid": "75b9ec03-e2b6-4e64-a764-e07b722c8e45", "value": "1536:nLMeT/Xv00DVT/RTqVMk0tDFyy94+uNg4D9erG9cwZfuJEESGpqHzacC3+KgX:nLtvBBF74+uD9cwsJvks3xg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776989037, "uuid": "5ed57f1e-10d1-4636-b90b-a35ad5737250", "value": 131464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776989037, "uuid": "740559d8-e53b-4d8b-ba70-0ed34a6dba63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776989037, "uuid": "bf7d54f8-f6b5-47f3-8906-36f8aa6cc334", "value": "MIPSEL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f428e42-401e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777063381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777063381, "uuid": "3c166285-44da-43f7-b600-956699da38d2", "comment": "Malware payload", "value": "2606cf922b75a54f1f3707b8eff3bf61", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777063381, "uuid": "fe34d8f4-8dda-42e4-b0cd-3cd9bcdb740e", "comment": "Malware payload", "value": "dc9bc84596cd168d1dce24600b5accdcaff53c1b2ff29b71bb53b23a5ec9c8c7", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777063381, "uuid": "aaf19753-4644-4b3a-9955-b39134b023c7", "comment": "Malware payload", "value": "5e9a86048f986d8a0eddcf625fc2fd67d6de698b", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777063381, "uuid": "a853f42b-2989-4073-b5db-552b861433a6", "comment": "Malware payload", "value": "ba0e2b2749eb34358bda304f220fb60129c309ecd42c97ab6aedf5140186b163cf1a20a3b46ea7961a4d4b93bf053767", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777063381, "uuid": "8cd96354-a147-44cb-91cb-2d856e0ddbf0", "value": "T1C062123DD9A5FCC4036F72D05A6A3F46105C5B23FBB16B6CF9C508AA1824689DF3A19C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777063381, "uuid": "347dbbff-9a0f-4958-a0c5-5a78569903ea", "value": "384:lR9wKCh+4usBchcb0csYeNOZ1MEG5lvWZJNgfZAU3rgB+1h+7YT1:ZQoR6wcFCFW7+HuYT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777063381, "uuid": "07851579-b074-4361-b32e-a4141d83e976", "value": 15343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777063381, "uuid": "d5432e82-5d9a-4dba-a255-7e90b23c71f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777063381, "uuid": "d1f510ce-12bb-4f79-a23e-85c80762eb80", "value": "script.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c93865-3fe5-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1777038944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038944, "uuid": "0c9fe081-f15d-4226-a2a5-f37acf9e61e2", "comment": "Malware payload (DarkTortilla)", "value": "a972417f0ce8a7f2c9d291d0d2e52ae9", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038944, "uuid": "be5122bf-d951-4b9b-be6c-934d36a70c9c", "comment": "Malware payload (DarkTortilla)", "value": "dcbc11334c0273afead141a14c127662e1caa06bc6ba0b119d1bbc67d1f0e148", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038944, "uuid": "ec1d699b-a089-46b0-a0ef-14c4a300ea87", "comment": "Malware payload (DarkTortilla)", "value": "e779fb3f452e7ecc2a598f3ccd7bf30b299d94d3", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038944, "uuid": "cf750769-c3ad-4004-ab00-663d5fb900a2", "comment": "Malware payload (DarkTortilla)", "value": "c820c57ed2611b90adebc6721955a7d03ce53b1660a68ca6296ebd13c3ef3db7c139eaed6c5c189c9f2f63730c80a1f6", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038944, "uuid": "6002bb30-4341-4f96-b11f-d15a25c6050c", "value": "T1ACF48D1227E91B58F4BEAB399975150407F6FC26D736DA2E7C9810DE0972F40CA63B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038944, "uuid": "d4bd35e3-c135-4069-85bd-0604b8c0dc20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038944, "uuid": "203a0277-fd91-4447-aa43-dd2f61902978", "value": "12288:E/kUZXO+MriwQUaYeP4SQGoKet6ruxYaDDk:mk0HMm38ePPTQ6r7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777038944, "uuid": "c2a9aedf-2cf4-4571-abea-cd411c398a43", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777038944, "uuid": "bfa037e1-76af-45f5-ba0c-5d456e2b17cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038944, "uuid": "b1ccb8a1-0aaa-4740-969e-5d76fccc17f2", "value": "RFQ 16042026_SAMSONG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60bead3-3fb0-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1777016362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777016362, "uuid": "0b42ca54-4f89-4679-a511-d16443418d73", "comment": "Malware payload (Joker)", "value": "22d6f216cd7c9e8b2033927937c7e613", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777016362, "uuid": "d8bc9e5c-22f0-490d-b52a-e394fbd376e5", "comment": "Malware payload (Joker)", "value": "dcbf6bc8edf9f7ee69c522374abdb8fd0af0987d1783cd21cd6fd2cbd5426202", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777016362, "uuid": "e3560a03-ba1b-446b-95b2-0f4ead3f5d9e", "comment": "Malware payload (Joker)", "value": "af5f4da525db0fd211427d2eb50b2c8b650b069b", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777016362, "uuid": "6dd4f054-d178-4048-be82-7ede5fea241f", "comment": "Malware payload (Joker)", "value": "e6fc28708b946fa125249f5d458c5e61e736630e8449844f1b4484a35ce73a5c75ab7a15ade7f34fe20cbf7b5f57655b", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777016362, "uuid": "9f51af27-54a1-4e5c-977c-b03260baaebd", "value": "T14CA70107FB4DA42ADAD6B23C8A751732B1266C681302D3D72511B23DADF7BD48E19BC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777016362, "uuid": "678cd1ab-4706-420b-b7b2-566a70cbeb53", "value": "786432:PPdLGNQMd/xx6PamFvdZW5+qaqW1vF8vH6K5n+Igq/WK8CWdv:JGNRvYs+qa5u8IgOWpdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777016362, "uuid": "d150f067-f692-4ba9-a762-29e06c40a08b", "value": 45854724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777016362, "uuid": "e570caa7-3e71-4def-a144-1f3ce850e4a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777016362, "uuid": "7fcebde2-18a8-4cfa-a1ea-fa9c7daeaebb", "value": "com.simjunk.hugap.cleaner_8.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb682133-3fb5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777018599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777018599, "uuid": "a9b1ae6b-6f68-4958-b5b7-926e0914f098", "comment": "Malware payload", "value": "0ce0f7933f6b02cbd9cef002ea698f5b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777018599, "uuid": "e7f563be-7d4f-4efc-93b2-6f5ee186050a", "comment": "Malware payload", "value": "dccf8726ba96b0d308bd14391ddb77f33428b0a240dde7087374d7707cfb46a8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777018599, "uuid": "162fe299-ac87-4501-904f-c4c9dc367c85", "comment": "Malware payload", "value": "6a99d60616e33243eb11b59dfc324ea54c62555d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777018599, "uuid": "82e5f5b4-1fe3-42b7-94fa-9e0066a1149a", "comment": "Malware payload", "value": "b34ca11f81e44aef529b3562665f565e1b09a67c096d40fa8ac4b9ecd81b4a9f76fbdf6fd7363a4bea98a6a346613b91", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777018599, "uuid": "ef6124f0-c1fb-48a0-a0b8-71b9194d275d", "value": "T12F136D6566913C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777018599, "uuid": "d31df7da-e988-4549-9198-c7485bcdf671", "value": "768:bToLXRWNGxVrG9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bToFlxljcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777018599, "uuid": "5468b98d-4320-48fd-80a9-553e1f3117ea", "value": 45535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777018599, "uuid": "007adbb2-3a9c-4c10-a284-0c24a9c3d106", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777018599, "uuid": "de19e67b-1d49-4208-92e0-7b5a11f78c2d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46324cb5-3fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777029918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029918, "uuid": "d2626f1e-9422-4623-ac36-c15c5a194250", "comment": "Malware payload (Mirai)", "value": "da7e754f5f953c7ffe587bc362ca5985", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029918, "uuid": "c302778d-d2c0-4d48-a885-07d6f08cda3e", "comment": "Malware payload (Mirai)", "value": "de12026f859976f1300504a9732ecb668914df29e6f371a9e117cd33356f1b36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029918, "uuid": "a9607c04-6a67-4360-8a41-63f29afe49fc", "comment": "Malware payload (Mirai)", "value": "236ec83071a78fcfa0afbeeb69add36aee5657db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029918, "uuid": "b4f9aa01-7198-4c41-bce7-7662973690bd", "comment": "Malware payload (Mirai)", "value": "f1e5752006d666ea2bfe600ddc0789dcdddcf42d8b955411f8562cd313bbdc11fe850d0c0bf3747292058abb85f43145", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029918, "uuid": "728d49fb-14e0-4972-a8df-593080bd2a36", "value": "T13E630891B841A626C2D1537BF9AF018E371497D8E2DA33138D255FA0778AC1F0D67F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029918, "uuid": "0783aab6-b1a6-4abc-af25-b02d32feea1e", "value": "1536:8aDOMkJ1GdjK3GX9nuDa2LC3lmvDANvhWi5w5kwx:8aDOrmuDmm7AjD5ax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777029918, "uuid": "23a8009d-4bd6-4024-90bf-195873fbe609", "value": 71036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777029918, "uuid": "e3854d4b-a358-41d7-8ca3-2f6e1e77449b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029918, "uuid": "03040366-f579-4fd6-8e0b-672573a890bb", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cceb4a21-3f9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777008240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008240, "uuid": "ca59af07-163f-4ab6-bd2d-f86d8e6bc97f", "comment": "Malware payload (Mirai)", "value": "044e070b6a3a0f03f3d748acbcf7c5bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008240, "uuid": "f16f7def-a8dd-4750-8625-0855eb09f8d0", "comment": "Malware payload (Mirai)", "value": "de74b719b87ad02c9600e209d52727d48952e84d474430056b60e8d32c3eca25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008240, "uuid": "0c3f3d3d-4854-4a24-9385-dc7d0e32c567", "comment": "Malware payload (Mirai)", "value": "d7a697acf3140c60394580d43a5173a53a6df561", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008240, "uuid": "f23a7212-27cf-4e7c-a596-836f5f4736e1", "comment": "Malware payload (Mirai)", "value": "690377eb61c4c55fd77ab54f393af938b087ebe9f1937d483ac13461da180fc8f27a37fea36dc7a81f0a87b5b4ca135a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008240, "uuid": "24a35c49-287d-4004-9c89-775a3bd6ecd2", "value": "T1C644841F2E228F6EF36986B047B79E24975C37D626E1C680E16CE6105F502CD641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008240, "uuid": "f56f0de0-2596-45f2-ab76-b996f6cc7d4a", "value": "6144:wtyT/TQNCGnpwCaIiZCTiHcxqJrUu4GRtry:wtSZCKcxcjry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777008240, "uuid": "6172c703-0c83-4ae8-92b4-5941c9dc43c6", "value": 256820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777008240, "uuid": "62dc3811-02d7-4354-b923-f023ea91739c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008240, "uuid": "4c1bd579-64a8-4214-964e-b41e45dae7fe", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ce6f8f-3fe5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777038831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038831, "uuid": "723d76ae-1777-42a7-aeaf-8518e56a0ed1", "comment": "Malware payload (Mirai)", "value": "ca5002bf58624a9da28bafa43a1f2788", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038831, "uuid": "c4dfe9cc-e722-433d-a351-01aaa1adb0d6", "comment": "Malware payload (Mirai)", "value": "de84e4612ea713035803bf419b99a5b74871855028e4764ee755d0286a569612", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038831, "uuid": "1c44b57c-ac6b-460d-8e8d-cf3bec0fcdb5", "comment": "Malware payload (Mirai)", "value": "b6d654113f7571770abaf90c6477fe975bbf7801", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777038831, "uuid": "d5f61e43-f8dd-4e88-b7a6-5b171903d7f7", "comment": "Malware payload (Mirai)", "value": "5eb1f1b932e11087c436f3039446fe435add5d3464126b57d7635f4a7e447dff35b9b1ffe6d10c545fafdfb9ce8680a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038831, "uuid": "56b77f37-2eb6-4978-88ce-db56128f8f18", "value": "T150140945FC918E22C6D412BBFB6E428D372653B9D2EE71139D215F21378641F0A7BA82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038831, "uuid": "a19f7373-3486-485f-9717-c727667c7511", "value": "6144:09rj0/NzLg0om4mtrPVE4FLI+n+f0iievSh:09rANEmfE4BIk+fviT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777038831, "uuid": "47721a9a-2db1-423c-b208-33c4ace6d844", "value": 207584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777038831, "uuid": "06cbd9ec-5da5-45de-a889-3a6866915b52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777038831, "uuid": "945da863-826a-4900-9044-c52a38a28864", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502b52bc-3fc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777024352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024352, "uuid": "95e1fe47-2923-4ccd-94b0-7bf26e0cb4f1", "comment": "Malware payload (Gafgyt)", "value": "2142fba0633d568c7bfc44cf99c83783", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024352, "uuid": "f2bad947-78ce-487a-aaeb-342e74b814d8", "comment": "Malware payload (Gafgyt)", "value": "e141465a9a44bd03a86e594d80609921771a1f12bcc656e97b39d5bd01c63a56", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024352, "uuid": "b556715e-6ad8-425b-ad2f-091750eab308", "comment": "Malware payload (Gafgyt)", "value": "aa4f8cf12f185da4603f99ec17cc638fc162202f", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024352, "uuid": "82168397-0332-4a76-ae45-8beae6944059", "comment": "Malware payload (Gafgyt)", "value": "5052e3c606782c90a8b0da20a9a63d2f8d748518345b521e628e0818cda133f7ac58885fc0827b7e2c88b678720fd076", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024352, "uuid": "2157191a-d4c7-4c65-a662-987ca00bb455", "value": "T117830884FD059B1BC6D371FBFB99028C762A1FA8E7EA311699317FA023F65D1153A120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024352, "uuid": "5114f815-3aad-468b-80f2-37f884ab2daf", "value": "1536:mm9gSD1tfICMfd2FJhTOvaiDHHFKqVSbzuouL:h5ICM4JUgq+fuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024352, "uuid": "25bed0e2-a4f3-4f9f-a0bb-df4b1fb8259b", "value": 82592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024352, "uuid": "2f2e0546-e464-44d1-ba27-184eb3743048", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024352, "uuid": "d251d8b8-99d8-4e57-9343-cb18e132f37b", "value": "ARMV5L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5cb728-4032-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777071939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071939, "uuid": "97d5c47a-c1d1-4810-8f26-a1158aec959f", "comment": "Malware payload", "value": "fb322d21906207ab8a79c00fba2cfd24", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071939, "uuid": "bb5e1bc3-9e37-42a5-ad0f-1578f816e0c7", "comment": "Malware payload", "value": "e145d07069dd9959f941d52ba708d8d8ff14cd029ccb9133e83f3f3249c0a002", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071939, "uuid": "d9ed9af7-beb2-483c-abd3-fca60c2ee15f", "comment": "Malware payload", "value": "e2c9ef62ff19a3a7a0c833c9153a2ae9c18d00fd", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071939, "uuid": "a5d57f50-d573-419a-9305-7142170505ea", "comment": "Malware payload", "value": "b23c81612a89d2c6a06a9326aec20aff1d75f3e8e9d29255c64262254714a1d46fa71a040afb312bb0b9a47fed0dece8", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071939, "uuid": "99fa8522-d32c-4142-9a1c-ef07b03181a4", "value": "T1A304123454ECAC6109D04D7CB2E67B1679780661D06CC897DFF082A7BE4E6EA04BFD86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071939, "uuid": "6ce17a75-bfe4-46d5-85a3-271f558e2d4e", "value": "3072:uHrEQQQGGw1H0K6DZb6Ll0SZWmzlP8uSQQ7SCDKi6blMZezwTbd6+SDxhY381UNT:uoTD9UBDZW2SwAP8kk+WZnb0+SlhY3PJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777071939, "uuid": "32eeb223-f33c-47a1-a4d2-324d0038c067", "value": 180325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777071939, "uuid": "9316182b-bfb8-4d66-86a0-c0c8728636a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071939, "uuid": "5f814019-91a5-462b-a5bd-c8ba78276bb2", "value": "setting.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c347edee-400b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777055469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055469, "uuid": "1eb8769e-a92e-48d4-85e4-9bbfa0426a6f", "comment": "Malware payload (Mirai)", "value": "617e6c1bcad8c7d5948bcfe8d59638bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055469, "uuid": "56200ea5-7040-4eb8-9f8b-5142ef7842e8", "comment": "Malware payload (Mirai)", "value": "e1a86c2f2c4af213a51c5179e468f7d0de82bd4558a0010dbd93a7e52b5a8331", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055469, "uuid": "c43a84fd-9ba1-4683-968b-059dbee32c29", "comment": "Malware payload (Mirai)", "value": "564c4194d3a008aa2af1ae1367c330328ebdd884", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055469, "uuid": "4a41ba84-8282-47b0-9578-a61db3c2fdcc", "comment": "Malware payload (Mirai)", "value": "5c27e033a991807cc142860461a7bb6647916aa70cf47d3e9ea827ddee05f76a90ad9bc87b39d2e04db0bd68003ed8b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055469, "uuid": "ca2ff51f-7e0c-46e4-b38f-76bc546e6307", "value": "T101C35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8675F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055469, "uuid": "40407fc5-caf9-4a91-b739-08299fd402a4", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHomrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuImrSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777055469, "uuid": "81b03278-3803-42da-bec0-1041dcd6a0f9", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777055469, "uuid": "ff295565-95ff-4046-ab01-f886c65dddd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055469, "uuid": "06ec3cfa-0846-4457-b236-f7667b1569a1", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d8d18a8-3fea-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1777041124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777041124, "uuid": "c64c1136-0c75-426d-abdf-c4538e0675d6", "comment": "Malware payload (DCRat)", "value": "01150b1e4a39eb4d7f4e4d1f2decb6f8", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777041124, "uuid": "3019eed7-5e72-4cc7-8030-59f8cce4b545", "comment": "Malware payload (DCRat)", "value": "e31f76e7935eae990cc580dd463b057d8d8259c04156f8c9b8fb374b42e43a85", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777041124, "uuid": "6ac3e46e-ac8a-42f7-8097-a704bb5830cc", "comment": "Malware payload (DCRat)", "value": "d6088c2cc5b0b666c116c9ad2672a6ca3af15a0b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777041124, "uuid": "5323b60c-7a7c-45aa-93fe-18bcf6d3616f", "comment": "Malware payload (DCRat)", "value": "44415dccbe3773980d8eb151c260dbdbcaab79746aa58339deea06c712fca717251264ef88644f9f6f2cb2e612e731c2", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777041124, "uuid": "b36ce61a-82fc-47e1-b1e6-8014aab20032", "value": "T11705D6017E44CA11F01A2333C2EF494887B0A95167A6F72B7DBA37AE55123A77D0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777041124, "uuid": "f6a5b1fe-b0d1-4e12-98ca-eabfb9f97996", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777041124, "uuid": "a937539e-d9a7-463a-89aa-5b760e5f9f8f", "value": "24576:LVr2+LTg4Q5mFe0GyYHtI78hrpgiYHRuK:hr2+YYwLHmi6Ru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777041124, "uuid": "56c50294-1a7f-45c8-b692-df235c207058", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777041124, "uuid": "50ed85c9-06cb-4526-b6dc-f8d2a12ce2de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777041124, "uuid": "00b43e11-a9e2-40c2-bd84-1dc82eb01976", "value": "01150b1e4a39eb4d7f4e4d1f2decb6f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d018507-3f76-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776991382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776991382, "uuid": "fbe5387d-c085-480e-8781-34094fc38ac9", "comment": "Malware payload", "value": "86edbea9c1aa1f2842eb6d728273d1b5", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776991382, "uuid": "69f49263-716c-4d74-88ab-21b59ff1ef44", "comment": "Malware payload", "value": "e37c391c9cf75d272a6581bd569060f8e03d4d26e8772073df8e3de2ac0ccf0e", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776991382, "uuid": "754c424c-899a-4fde-bc78-d10f5ff32469", "comment": "Malware payload", "value": "ea729a89ed44e2807278509e6464be4b520fb320", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776991382, "uuid": "005ab4b6-fa64-497d-9dfa-fd62451425bd", "comment": "Malware payload", "value": "4aa6245d5c15d61f3484c7eb07e3b7f1fab0f3b9f36f27e6358ead90db95d3d1e2458b48c35226595fd99ea4bb863ffb", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776991382, "uuid": "a704e3b2-45ad-438a-8318-dec4e38f143a", "value": "T1EFB01216B84DD52A002580EB0A31E61EC8F0ECAD2B5E7F154764C84CB16F9EAEAA7542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776991382, "uuid": "27e418b6-4661-4b6d-8379-c92708c595b4", "value": "3:FER/n0eFHfBw+IIkVViE2J5xAIZmzhohHFgfPFjZpv:FER/lFHfBpIBn23f0zhohH6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776991382, "uuid": "9aa72cf5-a395-4bea-9c4d-b2e2e64178bf", "value": 119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776991382, "uuid": "51a372d6-8d4c-4b60-8325-82578bbb22f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776991382, "uuid": "17c157cf-1e3e-483d-9def-89bb944f7130", "value": "c56e7b25000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9952902-3f85-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1776998007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776998007, "uuid": "154d24a0-fc2b-4660-ad73-468c4a86b9ed", "comment": "Malware payload (VIPKeylogger)", "value": "3f435e398c9bedeca0b03246ec5baae6", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776998007, "uuid": "b3cb8c3e-3a26-4206-b055-2377d7d495d6", "comment": "Malware payload (VIPKeylogger)", "value": "e37ccc8bf737978f18519177a6810065e1da8a62d4e6ff627350d85e60d3c7c1", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776998007, "uuid": "45339ced-1151-44f5-a51b-85beb8bd8a8e", "comment": "Malware payload (VIPKeylogger)", "value": "27b818836204655cbe05369913e05d60fe7fb65b", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776998007, "uuid": "c06484f1-eec7-4f8e-a831-fe6e5c217690", "comment": "Malware payload (VIPKeylogger)", "value": "45a123ffb949053802a88685119c7d5f0539430bab1267bed3cf1acd69122f0e6a57397023259da5bfa4b6f78274d08f", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776998007, "uuid": "2ec7b309-eded-4ce5-8064-d9c3b8e28820", "value": "T1F3B302011B569DCA17C3B26EA89AF099FE22C07385F89F8435DDD9A37F12116CB3D145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776998007, "uuid": "1e5dd99f-b12d-49be-9fea-d2cce820d0e7", "value": "3072:lo+CAgUa9K+BeY2Iqwij7JQhtq0Nwh+PqzJK2S6zueRWL:lo+CAgUabBeYcwk+htq0Nwaqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776998007, "uuid": "959f9f53-f71d-4064-b109-b6c7d586fb72", "value": 112758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776998007, "uuid": "94647a73-05cf-4b20-9030-b3afb3baab3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776998007, "uuid": "40f0d8d5-e3da-4b6a-a5a4-bb7047042579", "value": "Tail.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd9dfe98-3f7c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776994148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994148, "uuid": "fb038286-35d0-4890-92ec-2f7b16379125", "comment": "Malware payload", "value": "b13bbcb696c831489b8e6d86cfe2b6a6", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994148, "uuid": "e4752d62-97b6-49ee-bddf-72812936dc3f", "comment": "Malware payload", "value": "e3d9fbc02604469ca06b61c86e6bacd6b7666c330039ecea462615781f9d3b36", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994148, "uuid": "1a0ed827-04df-46db-92a8-a45b68e6e71e", "comment": "Malware payload", "value": "d0a9fa8475bb6edb64e7da5a056f6125020823fc", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994148, "uuid": "73a00d78-8575-48a7-a8e2-7fa758a0fa55", "comment": "Malware payload", "value": "c6b648022930b5f2a9b87820d82dfe2b058cefa9bfba0e8f1337d4136d4475aaf7018c1c5a01c778b2aab1ce5448ecb8", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776994148, "uuid": "9f7269d7-0d37-4e24-93cc-fe924c1870a6", "value": "T1EAD3448A5A8B88E58B5F747A854F5C03DBAD932B051CC5907BDF9FA13F046E8B0B94D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776994148, "uuid": "89d19af8-e087-43cb-9a62-ec73d9a1226f", "value": "3072:pQvvvalRkHRQRlQKbavVv3gc6xRvXvg2ALL4rtapCiR6HRF4sBG4qE8+UMl9NY+m:pFlVRlQKbavVv3gc6xRvXvg2ALL4rtan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776994148, "uuid": "ca808c7f-b7ed-42a2-8f61-0269879dc46e", "value": 137611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776994148, "uuid": "9d6eb71c-c07e-4f7b-ab7f-fbae23fd26b9", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776994148, "uuid": "5a2cf7f7-3326-4696-a347-30a43afa8930", "value": "Delta_Logs_Sydney_3547.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a0205d-3fca-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1777027528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777027528, "uuid": "cb644f00-44e0-408f-9c59-dd7f8de94aa2", "comment": "Malware payload (WeedHack)", "value": "e0f6437928527aae837ef14f81b048ff", "object_relation": "md5", "Tag": [ { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777027528, "uuid": "cbfbd6a9-d642-4f34-8537-94110452fd96", "comment": "Malware payload (WeedHack)", "value": "e4475526196a357d12a6b152279d653b2530eee23fec14202292aaba565900eb", "object_relation": "sha256", "Tag": [ { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777027528, "uuid": "40d0b3d5-22d4-4659-b3e5-0bd894cd9bca", "comment": "Malware payload (WeedHack)", "value": "89e11670675ce9a44ee1e9320bfbea01245438fc", "object_relation": "sha1", "Tag": [ { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777027528, "uuid": "e65a1dd0-e862-458e-ac17-81925cf05640", "comment": "Malware payload (WeedHack)", "value": "f4291a2c7b77d18999c0b39e6f9a91a46538eac0b76608b13151482531a1436b49793bc01ed53a1f3f526e4be9a75082", "object_relation": "sha3-384", "Tag": [ { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777027528, "uuid": "caa8d09c-2b4b-44c3-9a68-ef50413b7b5c", "value": "T18BD312DABAD52CF3D04209BF6A29A4F811F77D64D28C7C4CB8179A99CC41193B5E708A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777027528, "uuid": "daa67fdd-9c0d-4f20-a1cb-816531c9e571", "value": "3072:xIEW8w2tDkE/wfbrR7WjtV+GTTNw7hRAVbjnWcATWFbWQ:xId26LjMbzoDAVPWcwCSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777027528, "uuid": "69804065-6872-43ab-9a34-0bc98698ee98", "value": 142244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777027528, "uuid": "887607f2-9246-4135-a853-cc0c9506fcbb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777027528, "uuid": "48af63d5-548c-4064-8313-7d284e6b2a3e", "value": "BBVA_Transfer_Receipt6.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a0747d-3fef-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777043131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777043131, "uuid": "b1433809-4926-4802-a482-f8cff621fb06", "comment": "Malware payload (AgentTesla)", "value": "b0ec6c7bcf73fe5cad95af464d865f78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777043131, "uuid": "afe3b293-b4ff-46c4-9e93-91ae69ecca8a", "comment": "Malware payload (AgentTesla)", "value": "e48511825e675b741ffbc09c796321fff8c8bde788596718b5e2f2b84df7fba3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777043131, "uuid": "fecad071-af23-4c42-b0b0-bfdfd30fd49f", "comment": "Malware payload (AgentTesla)", "value": "907c970deb38e8fb2cbde1686858912270fe6332", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777043131, "uuid": "4999654c-522e-4154-9170-e2e7f10a91c7", "comment": "Malware payload (AgentTesla)", "value": "f010e1ad246e2711a6d956d92d7bc07ca979acd3f90aa6c7b499d8865976211979f2cffc96d1e772a4c85bd133ab2024", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777043131, "uuid": "a9022d78-3ee2-48df-adaa-2e2f15ffd61c", "value": "T1E482C81A8D49AFF0055E33A26F6F2C1A2A0107129A30385DF88FD86D377D751DFA5A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777043131, "uuid": "81268b27-2c1c-416c-958d-2f7e6c9c53a0", "value": "384:KUDyS6p3buD97qBB5/TplEiH0EwpKD/uhpZKjQQECbyMI4h8t7gE827:K0SlTrEXsQJbCbTIw8iJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777043131, "uuid": "6e459fa3-66aa-4f66-98c4-2247c149d6b1", "value": 18221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777043131, "uuid": "16c31e3a-26d3-4611-8e96-a01ec870e2a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777043131, "uuid": "262dd2c0-2d7f-4002-bd0e-315442d5d18b", "value": "BOOKING.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cbb6734-3f82-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776996375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996375, "uuid": "0570f91b-b9b2-48f5-9428-c57908d100de", "comment": "Malware payload", "value": "5bc4adfd162a9b99160fe888a2f5a12b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996375, "uuid": "1f9892fb-1f51-4d59-93c7-ea92a2cc9675", "comment": "Malware payload", "value": "e4fe682b8ea85d8cd3df2debceb406644d7a8fcdbeedef337f37c275c410dd91", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996375, "uuid": "6be56c17-3f9c-4daf-a7e9-f0479c669e2e", "comment": "Malware payload", "value": "8fdc9f086761795b7a2bf61b752b3697f4505260", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776996375, "uuid": "faf6741c-1fe5-47e5-860e-11e30fa7615f", "comment": "Malware payload", "value": "10610ec22578c790aff9fd891347204858530b2212c2094d5239393970878ef3f7b2c08e6d7c54e47fddf67c3a732fe8", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996375, "uuid": "d27bff9a-1818-447f-b961-c71d38ad2c80", "value": "T1FFC08016917EC50E9567D4D60672550846B0EB413A349E32DF5099C871514906206042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996375, "uuid": "aa98d3ef-a7ec-4250-a0b2-3c595cb5e85b", "value": "3:j+qAHmFEm8nhcDQBfBJpoNIkVViEaKC5SufyM1KvN+utAWhXpv:j+q9NqhnfBboNBnaZ5SuH1mQiAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776996375, "uuid": "e9ff7234-c9a5-4e2d-9dd5-0218bbb832fd", "value": 162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776996375, "uuid": "ea6186fd-594a-440a-9028-58f67f83f8ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776996375, "uuid": "dbe75dbd-2910-4185-a82e-1c8b4bfccc32", "value": "EDUCATIONAL.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb9ac17-4031-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777071889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071889, "uuid": "0aff45c5-a487-4a8b-97a8-b9cfee3d04af", "comment": "Malware payload", "value": "42f28c55a72ddac1801c7da4c62b632a", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071889, "uuid": "c4cf08b1-d2ae-45b4-85c9-24ce231d0b05", "comment": "Malware payload", "value": "e7046c9208cee3881fdaddeff91851f9f8533607c0f7716776743b751de5c9f3", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071889, "uuid": "7e80b6f1-2f11-4174-9395-7519598e2b88", "comment": "Malware payload", "value": "39750cb62411cf4f27fdc60988751c245766f53c", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071889, "uuid": "27b9fef1-90dd-453d-bb4d-e0a29d9f3f86", "comment": "Malware payload", "value": "be64509414fcd4c7a3f37b0624d9485482635b1bf9c9b7f43462e60fc31d7fa0fd038dbae665578312a55bdee67e3645", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071889, "uuid": "8b24d84d-fef5-4507-8c3b-fb2211aba70a", "value": "T179942340DFDD4BB605D54B6C33CFECE91E814E17D0CCBAD564A49A44BA0AB12A19BC2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071889, "uuid": "c4d71b59-57bd-496d-9205-9b9f29ab8c49", "value": "12288:zCIMWjEqruHjuPpxBPjZpLwlUTvxGIukFOG:zVfFejUvpjZpBTJGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777071889, "uuid": "89b27962-09cb-49f8-b3b3-1b161cf53b97", "value": 414688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777071889, "uuid": "cd0d518b-88e7-4b45-995e-994913e460cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071889, "uuid": "88ffbc99-7cd0-40e1-aa9b-6048cd00480e", "value": "Peer.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b4ffb9-3fc5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777025411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025411, "uuid": "cd3223e3-1f19-4d34-a122-d9d183768bc6", "comment": "Malware payload (Mirai)", "value": "a109801554637905fb6c8efd788cf9d5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025411, "uuid": "047b2b6f-6e4f-49ea-a222-bb3d63f95fe6", "comment": "Malware payload (Mirai)", "value": "e7a55193197248b61ab29c80fa878f7bcfbd4a812b00bcbecec3812f1d2e5824", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025411, "uuid": "a3947a86-b71f-4f5f-abc5-8091ab6d0644", "comment": "Malware payload (Mirai)", "value": "7da5d328517bc66726cf141bd646ce289ca0e814", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025411, "uuid": "2fbaaa7d-a719-4b92-adc0-4092b51cec50", "comment": "Malware payload (Mirai)", "value": "1b2be994071e2e6740da34454a7784fe06459db84d013b8079bb321aa02b21a8400fc8f21889fca21ec519db40d9d640", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025411, "uuid": "380dba9d-cae6-449d-bec9-cd1edd4d8a4b", "value": "T18DC32802F98184FDC0CAC1340B6FB63AA976F1DD1238B2EB67D4AB123D4EE615E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025411, "uuid": "37d4edec-b2a7-49db-95b5-41e25291cc14", "value": "3072:e483TghM/1weZbcnITO1yosFAIxnJdhgpDb7BA7WobozQPAdojgaR/E:eH3TghM/1weZbcnITeyosFAIxnJdhgJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777025411, "uuid": "2b3e8e5d-35f3-45b2-8497-edb604853dfe", "value": 125472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777025411, "uuid": "e1946453-5728-488d-8c32-f6b5f5fe8a5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025411, "uuid": "f4fa1ccd-e928-495b-bd27-7cf3c7b1785c", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a567fc2-3fc5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777025281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025281, "uuid": "2d1c39fe-5a27-4966-9c94-fa3080317b3d", "comment": "Malware payload (Mirai)", "value": "4a18fbcf1f12923ea0de67b5c686420f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025281, "uuid": "92b83827-f1b6-49f5-bf95-5874f7734741", "comment": "Malware payload (Mirai)", "value": "e8448e71d83c588d0c24035e96dc3582b4b5838f1d3195e363dd59f00fa02e88", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025281, "uuid": "b85c6589-f327-4d71-9995-fe543c673d73", "comment": "Malware payload (Mirai)", "value": "b4ec06bc230ed6aca98e6a09e35a337444cb2a3e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025281, "uuid": "cae74c00-b055-47dd-b744-706e2266b1ee", "comment": "Malware payload (Mirai)", "value": "d9b109d73bc32cf15c888482c2103022a667a649a12bcef61eb0b7975abd587e29a9bf1a0d0e97e886cc710783ca5cfb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025281, "uuid": "e53e8ed3-5940-4e6a-a33b-a628fcae2ce3", "value": "T15D93D551BC82562BC5E423BAB6BE668D336577E5C2CF722BC8214B117B8551F0C63F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025281, "uuid": "14e6117a-0ed6-4ae3-9cfc-2b1caaf36744", "value": "1536:Ud+d+6yn9H/NTzULgW4W2luLaN5q00brz9ikZcxew+7YY1:++dAn9eL6w0ecxetd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777025281, "uuid": "6aad9f08-227a-4c1e-867f-ada7d6bdf74e", "value": 93800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777025281, "uuid": "3e51cae3-4386-49f0-8d4e-188d9eda7f5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025281, "uuid": "90e82907-bd1c-468d-9714-a76b0a952a03", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad14f455-3f8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1777001315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777001315, "uuid": "a3168529-7155-42e4-bd65-d8012106c4d7", "comment": "Malware payload (Gh0stRAT)", "value": "cd4b32743efda11c627e39381af90b5f", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777001315, "uuid": "b328b4de-8c15-4b3e-a683-2c93ebaf269b", "comment": "Malware payload (Gh0stRAT)", "value": "e938236bc97fd9cff5238292feedbc6b5f209ecf67837a08ce44e978ba2678d0", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777001315, "uuid": "6ed95fda-b87f-4c22-90eb-446a0b3fdeba", "comment": "Malware payload (Gh0stRAT)", "value": "2e86931c16516ce99dba3ac0c95769c0e31fe818", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777001315, "uuid": "4cd13e7b-885e-4478-8846-be321d14ebaf", "comment": "Malware payload (Gh0stRAT)", "value": "aa09563150086fc62c995ebf5d264dd13ec1d0ca8a78016d615d84f419a6eca4beed847067a32a8b140ff8813a8100c7", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777001315, "uuid": "6c1f661f-ed07-403f-a6f7-5014639e8f6e", "value": "T17566CF11FEE704F1E24A523149E6677F7738A2091724DBCBCB44CDAAACA37D11A3531A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777001315, "uuid": "e93c8832-3841-4136-9a48-a9f2b7cad7c0", "value": "6ccd07c1b338ca09df2766e1f57b5e6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777001315, "uuid": "80989986-e8db-4514-b6dd-5db1518be811", "value": "98304:QYPsVz9lsDon7795sSSAtr3pYAWjNw9iyt/5OalSc//////0JRgj6B:2A6v9bSM3n8Nw9iyt/tAgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777001315, "uuid": "1416d13b-06e5-4c95-a96e-3efa933a6645", "value": 6520832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777001315, "uuid": "672b5996-4bff-49b3-a5fc-f8a299a11441", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777001315, "uuid": "25fb697f-4010-467f-891f-2bf55cf1446f", "value": "TT\u65e0\u89c6\u9f20\u68074.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b63ee15-3fc5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777025283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025283, "uuid": "2d05a117-f0ee-40c1-8bb3-2233d80c7c21", "comment": "Malware payload (Mirai)", "value": "74183872c0fe21217fdbb5f6cdb5bc48", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025283, "uuid": "92e2a996-9261-4e4e-a20a-cab7561c26e2", "comment": "Malware payload (Mirai)", "value": "e9d4d3f1a7ef21c8f2af84449bca929e0a8808d25868c7dea5fd4ffeb07a7083", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025283, "uuid": "d57fb356-07c1-446b-9569-6721c097060b", "comment": "Malware payload (Mirai)", "value": "a2abf1f42e7e871e355ed20919ba973975a54b6d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025283, "uuid": "4b412a45-d582-4efd-8945-994ac17e149c", "comment": "Malware payload (Mirai)", "value": "840d6220c9c0776126d7db6083b73c1f9c92988cbf27d1ed66017edd60ee8804dd4e872f4765c9edfb0aa9ff3590c847", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025283, "uuid": "4a152f5f-61a2-44b7-a1cc-1d78abfc9f4e", "value": "T1D3D33841B9829A27C5E523BBFA6E018D332563E4D2DF72178C215F217BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025283, "uuid": "a2391542-1654-438f-8cb7-2f344cdcaf59", "value": "3072:snFif7apx6XS+kUgpjWXlsCMobmaY0qhzCQSp:sn8ZS+dQWXlsC17YbOQSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777025283, "uuid": "b8d157bc-86d3-44b1-9bd1-28bc7a0461af", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777025283, "uuid": "1160f57d-79d6-49f3-a6b5-55b6651f5a3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025283, "uuid": "dac4f804-c53e-4e6f-bff2-67e6a5cda339", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3267a45f-401a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777061668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061668, "uuid": "b04afce7-5af6-4c15-8227-4172079080c3", "comment": "Malware payload", "value": "a5ad18f088515de3d92abf16c625c0ca", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061668, "uuid": "98a7a063-1ea6-4dc1-9d39-1c2de430e0ec", "comment": "Malware payload", "value": "eb617ad2ff2bb5d1eee85737851b2676da7c6f5d21e1c488d6aa8e5b66d4ba8b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061668, "uuid": "7d757390-958c-4ac0-83eb-15f2275c1b1c", "comment": "Malware payload", "value": "fa454e8d434c468d89123312ca99d0a5b9ca4896", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061668, "uuid": "7efa7d39-1fcb-433a-bff9-7fd472195190", "comment": "Malware payload", "value": "393e286667f39ea14c86d0143ce5723ba822c60bbd5f540d8df020b77dd81e1399654bdcc4bbf64eabf76dd621a98a16", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061668, "uuid": "c1a7d0de-b1c9-4066-a21d-a116cfbfcaac", "value": "T1D1658E07F3B800E9C0A7C179D9161A17EBB17405136497DF65A08AAA6F63FF21B7E324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061668, "uuid": "eb845db4-35d0-4f90-b208-78be40564d0a", "value": "d28b74c90862a3d1412c0dcac614f21e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061668, "uuid": "c888401e-983f-447a-b189-037c13bab2ae", "value": "24576:qz1UiTI9YbJRzMf7DutcvxvW1BXZHlEzu5ZB6nJorqqKpu:GM7u2vxv0ZHlEzu16n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777061668, "uuid": "63bd7a8b-2211-40db-b274-4e9aca16ccca", "value": 1491456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777061668, "uuid": "2d5207a3-b047-405f-a196-3dc9d7465037", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061668, "uuid": "be2f3fbc-53ee-4801-811e-7a495f814710", "value": "c_x64.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b89ada6-4004-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1777052395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052395, "uuid": "eebda3fc-6453-45eb-a6d5-1ff340c14f3a", "comment": "Malware payload (ConnectWise)", "value": "d830fcdedc2100be262c7537ffc5b78a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052395, "uuid": "0fc0a7c8-d227-4f74-9353-6873c88b1bcc", "comment": "Malware payload (ConnectWise)", "value": "ebef9a56758e158208aa1396fe129d84f8a67253f17e871c966e4b2c8ee39f6f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052395, "uuid": "06dd6023-d0f3-4e6d-a28c-65b041fad619", "comment": "Malware payload (ConnectWise)", "value": "4076ae042599611c955a1acc91106878fb433dc9", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052395, "uuid": "bac3fd77-6e72-4525-a415-a864e1d9596e", "comment": "Malware payload (ConnectWise)", "value": "2e55f6893172d4c83bbb8c58bc6267364141c9fdfc3ef9264dbc401c8ac434c8a462156dbc7cea1ffeb030c3b4aedb27", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052395, "uuid": "4b686603-847a-4a7a-bcd2-e053b49a62d3", "value": "T1AD072211B3E585B6D0BF1678E8BD42654632FC144B26C2AF53A4796E2C32BC08E72777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052395, "uuid": "bfc2f13a-be19-4295-b27b-d7da7bb9dbf7", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052395, "uuid": "dd54b83b-3047-4361-9d9d-dffb481e97df", "value": "393216:ZCXvI5MvHxrJSCXvI5MvHx4CXvI5MvHxYCXvI5MvHxeCXvI5MvHxrCXvI5MvHxE:ZZ6HxYZ6Hx4Z6HxYZ6HxeZ6HxrZ6HxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052395, "uuid": "f03fc6fb-ce50-449e-8389-400bd974512f", "value": 17095736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052395, "uuid": "15b5b1c1-9afb-4ad1-8dcb-e36251171ec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052395, "uuid": "2cef5bc0-3e66-4203-b307-82a926dbc2ea", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6bb619b-3f9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777008203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008203, "uuid": "3250da69-a38a-4f1a-bad1-8e76316ecd24", "comment": "Malware payload (Mirai)", "value": "7eef087a18be5981506645220e08f78b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008203, "uuid": "6b98da92-f831-43d9-916c-4eacecd542f5", "comment": "Malware payload (Mirai)", "value": "ec41a35c7df2a684c7a97da730d93c63a15dc34f619474e8cc03fd7afe063ef4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008203, "uuid": "70c64647-c481-43d5-87bb-eded944f952c", "comment": "Malware payload (Mirai)", "value": "f40e0d22e5a8776dbd7508914ca9ae50e9753bf1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008203, "uuid": "3ab2e996-949c-4a98-a913-016f1791a2aa", "comment": "Malware payload (Mirai)", "value": "56f1458e96fdf585435f0a745006db861f4bf6a16b0017d050b983632ac3742ea834bd9a748d6271684cd29e3db607ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008203, "uuid": "5f6fd059-6cbd-447d-bcca-1e4a73f4008e", "value": "T19F53025408C152D2EEF2ADB4BA5022840712CC36D5F3FE41786859E865EF742AC7EA5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008203, "uuid": "72d14b1b-bd3a-43b7-bc86-721d833b7701", "value": "1536:nKv6rW/nzBIxdCe+BQi2PrSFZZVxBXLtOgK2sD:nMkwnzeeNOBPuNXLtE5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777008203, "uuid": "a8492068-64b8-483d-9891-bf087abe214d", "value": 64112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777008203, "uuid": "d10aad06-ce5a-444e-a018-d538c622c948", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008203, "uuid": "22551e35-7b3e-4bf7-863b-352f670c8fde", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc7cff8d-4026-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777067161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067161, "uuid": "cddecbd4-213f-40c9-903f-8796ad5196a7", "comment": "Malware payload", "value": "1d1332496873c63dbc18d4a8aea9ed55", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-cv", "colour": "#603258", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067161, "uuid": "cac8b34f-cd97-44f9-9f48-5fc6cd2c90a3", "comment": "Malware payload", "value": "ec93cda0aacf730dd1ef08f79902249fd35b5b180d03494e9ab1b46dbbb4d035", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-cv", "colour": "#603258", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067161, "uuid": "533700c6-fe5e-47b0-9501-5c78205d8112", "comment": "Malware payload", "value": "df08d5374a0155a2dba100043b147ded6ef4149f", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-cv", "colour": "#603258", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777067161, "uuid": "0c9df635-ba95-43e8-9619-97247ea79345", "comment": "Malware payload", "value": "a5f086a779e1db59583e33463ae2c7bc433e5e3d751fae8754c524217bc361e5220eba06149e59b8bcb507457afe6d0a", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tabbysbakescodes-ws", "colour": "#BCEB0A", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-cv", "colour": "#603258", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-ws", "colour": "#47C608", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067161, "uuid": "c70bcc24-612e-4889-9592-db1c0ca80b85", "value": "T1670733C79936C8E0CADA1D7585E68279612776387DF1B3EA3849CA7BCC864724C33319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067161, "uuid": "5fde061f-4e6e-4883-ab51-a41925595249", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067161, "uuid": "12ec9b37-43f9-4d88-ae76-ca36e6a06a26", "value": "393216:JmBuoTBpnNFeCSMRHrFSVml+A+fnciEbII8gyYH7zJQs+l:JiuWnK5MRUMInciE38ghH7NQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777067161, "uuid": "247f62dd-9112-4359-b1e6-e24053b782c7", "value": 17238016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777067161, "uuid": "a6ffdbb4-b725-4619-a141-56c491a59b8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777067161, "uuid": "8e243f23-8d81-4a17-8ae5-512c22d9dd0d", "value": "Installer_v1580_x64_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f3f461-3fc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777024920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024920, "uuid": "672a1786-cefb-4888-9a33-7d3ac3292c10", "comment": "Malware payload (Mirai)", "value": "d5d17633ce57e0a1ce828dd2a00f02eb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024920, "uuid": "d29c19b0-db67-49b3-9f91-69b4d8d6d1d5", "comment": "Malware payload (Mirai)", "value": "ecd8d9fd5f0635e3ae4aa16f3a2bd682f5ccb1345084f9beea57c164f39e85d0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024920, "uuid": "0256208e-4a7b-452a-92c2-d266f8652dc6", "comment": "Malware payload (Mirai)", "value": "b2b0c592b16570a13cdc58e7f4168557cfa80e6d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024920, "uuid": "46072c8d-ba53-41a6-aa2c-3273b1c8dc39", "comment": "Malware payload (Mirai)", "value": "a4b024a28ced3f28ca6c160792f4176cc21184b71b2927669cc636fb5186dcb9e270663f23ab7d9725fdd9f09ace6804", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024920, "uuid": "0e6a5424-0ba8-433f-b713-e2453b685a9a", "value": "T12F937CC4F243D4F2F84305B1507BE7365B32F1B9201AEA43D36A9A72DC91951DB1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024920, "uuid": "e17d51cb-eafa-4e66-9ca5-314018d5c254", "value": "1536:rsQ5ZHxZdGtH3C5JEhL5PuW7ezbdNoqKoA/lLSXLem:rR5ZHXdGB3IJEhL5PV7MdiqfUG6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024920, "uuid": "949c72a8-1954-4e4e-89ee-6f192127260a", "value": 90024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024920, "uuid": "a0b49f97-77c4-4bdc-8aa1-32caa1065cab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024920, "uuid": "d06032d0-ab0c-4d10-939c-767f6a8a01ea", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f90633-3f85-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1776997900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997900, "uuid": "1af12944-4728-4530-a462-a05ab7a4d72c", "comment": "Malware payload (XWorm)", "value": "3de3372412fbc7fad69e7e94811200fe", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997900, "uuid": "01ff0647-1c94-4c44-bf85-5ffab3ce9644", "comment": "Malware payload (XWorm)", "value": "ed2001b4af76a38afef7dac1caa1c26b857d4f52737368190922593cf37d9c21", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997900, "uuid": "a3e36a3c-ce27-4bee-86b9-aaf46b5b20f9", "comment": "Malware payload (XWorm)", "value": "b710b72a818497e58f691ca499325585724d5ac1", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997900, "uuid": "59b9bb2e-7915-4152-975e-f3a5e8fa75be", "comment": "Malware payload (XWorm)", "value": "be481a1b9bca50862c84c4fcbaf6456af991db69bd7f695135e0ff33fe03b2487f1dddc4ed7f2b904259cdfcf4c41be2", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997900, "uuid": "2a3499b0-2d73-47ed-8640-e41f072fda49", "value": "T117930230B2526ED10A16E6FDA59BBB847A5283FB40577F4134E460E81F87640613BE7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997900, "uuid": "596f6510-5472-487c-8d82-81ede7577cfb", "value": "1536:iqEdeLu+4kWF4IfSUFtwhQLaHstdQ7blzESTmULCtLAZqpVC8u36g:VEdeLu+4zHZWhQLvkVJTNu1IEbu36g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776997900, "uuid": "fadb72f5-ded5-4371-8365-66a49d559058", "value": 91089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776997900, "uuid": "52f795d5-6cc5-43da-b19b-1d414963d834", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997900, "uuid": "c04d747b-9fac-40f6-83a1-a3abcd672ec7", "value": "Dominate.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76fe774-4003-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777052120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052120, "uuid": "4ac2765e-73a8-4931-9806-ac17a28afe13", "comment": "Malware payload (Mirai)", "value": "562ba149b98ddbc6aad339eac784dacd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052120, "uuid": "471dad9f-8822-409b-b9c7-037531930ad7", "comment": "Malware payload (Mirai)", "value": "ed571d767ae0319cf7f6f23fb8744fdeb99280b88b463f75fc74280602377f8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052120, "uuid": "fbf87c04-e9c7-4977-be45-65b1ef30b9da", "comment": "Malware payload (Mirai)", "value": "6a3e5ebc217fb4d320bb75c7bd48991891d40b23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052120, "uuid": "a66c6a0e-0970-4994-a78b-ffc477e57937", "comment": "Malware payload (Mirai)", "value": "3c2984e9d052092110c94a0b413ddfcab7460b7701ad7e44f159b9b9c93f2ee8d232da894347968eba377dad7d6f74bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052120, "uuid": "61af87c0-f3af-441e-8bec-87e45685d76f", "value": "T1B6432921B53A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052120, "uuid": "6731b8ae-e910-42ef-a36a-068c061c4103", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAw4:RqtmZPuutfbltZFBSJsBcfDSTFI+BE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052120, "uuid": "54d2e876-dd19-432d-84b2-740693aee319", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052120, "uuid": "2eaa46a2-9277-42ac-afbc-4e9591c4c79c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052120, "uuid": "a0be34c6-2f7e-4a62-ae57-9addb8f939d8", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0084be5-4003-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777052081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052081, "uuid": "4cf036a9-4dde-4551-8906-fd5696dbc877", "comment": "Malware payload", "value": "e646dd53445c19ae715bd85f9c8cd619", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052081, "uuid": "70b03c93-f2a8-49be-80f6-76a0ab64b6f2", "comment": "Malware payload", "value": "ee08f1ef63f656534dd90926390b81d267a324f6a93edd265883e6af70c386cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052081, "uuid": "9917ab8c-3a11-4a61-bc6b-d21ba41ab5e8", "comment": "Malware payload", "value": "2edb9b4d92974394b56b4d0c2ffb103bdd47a153", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052081, "uuid": "d18c2c40-3192-487c-989b-adcdd84fa1d2", "comment": "Malware payload", "value": "3724e1b8c0e94db3493f76ac1c7443ba97ac46ce9cfa10d83fe873c00cb3fd18605d35204b26722a7da8a286bf3a383f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052081, "uuid": "af5ee6bc-bdba-4543-82f2-f62f2115dff9", "value": "T18155CE16F8808F62C5D125B6F65F8368731747B9C3EB620699189B343BD796F0F3A281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052081, "uuid": "36975717-8f33-495a-af1e-a8f5256f3cea", "value": "24576:6z/qLvfxB+6qHxWiOeiJnaGYTAlGm+zAISBvIFRFX2HOafyOMAFlKxr7:6kfxB+bxWitGYLlKAT01fyOTlK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052081, "uuid": "dc78673c-2162-4dfe-bfc3-e485e06fae13", "value": 1298784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052081, "uuid": "eda663cb-557b-4463-8579-f4804ffcda4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052081, "uuid": "9efadfb2-87f3-41c6-ab0e-bcd766e74e39", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e8c260-400b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777055451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055451, "uuid": "58ce4c14-808b-48d3-a574-a0754973e191", "comment": "Malware payload (Mirai)", "value": "ef77181fe123e1031f22fdb2dc4c846f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055451, "uuid": "4e84d656-5719-4a88-983b-5a9f7a6a4f5d", "comment": "Malware payload (Mirai)", "value": "ee86d4bdbeeb8964d739a26477fc6a8a110c554980b9ed4075de82590e0adb81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055451, "uuid": "5325f470-4f02-4c3b-9925-67dcca9f88d1", "comment": "Malware payload (Mirai)", "value": "10d870f7f764366dbaf20524ee0a4ccea7737f16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055451, "uuid": "071857f0-3c11-49d9-ad7a-601cff1d5373", "comment": "Malware payload (Mirai)", "value": "82ae0d109ed51ad0bd8e785352ff00cdc6ebc88bc21691b3a0388ce355c4bbc6dc138a65e0e9ade58fb5101c611c53f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055451, "uuid": "f12ad4a9-c366-4901-97e0-8e8910b3fca6", "value": "T1C2C2D0E07726FE31C420AC3DE52A4C8A7A51067C91FF393664258D358FC1A5B67E88F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055451, "uuid": "a8d5faf8-0930-4d82-8c47-23aa472e4b6d", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwrPu9q3UELu0:PKy4qfqoeJdXWgbLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777055451, "uuid": "3cbce3ff-6836-4594-9c86-21423fcbb4a1", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777055451, "uuid": "34aa8110-4129-4d6f-bc50-276c9ff8c4ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055451, "uuid": "afe88c9e-8cbb-4e34-b1f5-323cd61124fa", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f512c0-401a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777061679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061679, "uuid": "018bc12b-c54e-4acf-b6e7-1dd401233da6", "comment": "Malware payload", "value": "013bbaeb84bc3fc220d0e1d321e744d9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061679, "uuid": "429d20cc-440c-4343-b7bf-08634f8b98dd", "comment": "Malware payload", "value": "ef4ba9a94d965b2a9eeaf0fdd6135b5f4d0749c7d33d4da9d1d29f768c6150d9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061679, "uuid": "26e58196-6bbd-4139-8743-1c640e5e6268", "comment": "Malware payload", "value": "2a67380ae9b7bb7dc857344319af8af4790144ef", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777061679, "uuid": "089206b4-909c-4440-8a6c-512c85deb920", "comment": "Malware payload", "value": "0a94dc49025903f82c0fd56c3345b30af48b9f3486af3d8e53dfd8842268b432e4f2d204204d75a14891db8505ecfcec", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061679, "uuid": "608e2942-8d75-4b70-bf06-334f6c215670", "value": "T18225BF83D292915CF41AC1715B2EA273F537BC458B29AFE76390DA261633BD02B7A710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061679, "uuid": "7630fc2c-887a-4fc9-aa50-a1d306a9720f", "value": "5119aa243ba31aa561ba123ac413a1c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061679, "uuid": "641a366d-225c-4f9d-b813-eedf574941b6", "value": "24576:X+pq02TJOEe0JRh+w+aY5bkY5bBY5bq9:XDTcEeiRhTYiYDYw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777061679, "uuid": "64f5be25-2028-4e68-9f91-595ef880644d", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777061679, "uuid": "eccbcd3f-0cc2-47f2-8611-24a5581bc77d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777061679, "uuid": "f219386e-51b9-4382-a9c4-35267fb53ccf", "value": "w.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59ffa5f-4003-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777052090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052090, "uuid": "2da9539f-7fbc-4730-819f-462b4bdc172d", "comment": "Malware payload (Mirai)", "value": "dc2102e799502227182f20e324d7ecd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052090, "uuid": "cbad9c50-b2bb-44b0-a514-f2331f93fe3c", "comment": "Malware payload (Mirai)", "value": "ef963989aa05b3a2ecb0c5ea3a8128f1f1de07df45e2efffe45c9c6c385ca619", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052090, "uuid": "48d7ddb1-e1a9-4746-bdda-b85da97baead", "comment": "Malware payload (Mirai)", "value": "214de09fb63c0da1140c2843176439cded136d82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052090, "uuid": "8b5e18d2-81b8-47a8-a2df-ef55170c3b84", "comment": "Malware payload (Mirai)", "value": "691cbbcfe9680347af27ab30368afe30dab511f36860774323219b0fab5dd0866cf600b8d6957552abc7f4640997c85b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052090, "uuid": "5ad788a7-017b-4cfc-8540-693fd7f2619c", "value": "T156334A42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052090, "uuid": "64fe84a7-a435-4eae-af83-c354334b2673", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GwPS4yns96BktDgIPi8Twf:ivW3jdQGqt7Y+Z+zN9cGgI6bf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052090, "uuid": "a076d77e-d2a2-4fa3-a5a9-86bff1b2ce84", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052090, "uuid": "d91a3a4f-52e3-478d-a99e-8921b796f025", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052090, "uuid": "aebd0aa9-8583-46b7-bd38-86b8e9822d8b", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51b5200-4031-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777071873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071873, "uuid": "d55cf824-a014-4cfa-8643-3648304a932e", "comment": "Malware payload", "value": "3306a20999b9b0aadbfca12ef883f610", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071873, "uuid": "968e2cac-e265-4e39-9e13-740a6132be6f", "comment": "Malware payload", "value": "efe82e4361366e5bea41353ab9b3c97ad29b2b8792cf2f0faf9f457f7c0ad833", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071873, "uuid": "07bd5d55-2e70-40a1-a0aa-3b33f87c9e0f", "comment": "Malware payload", "value": "34ea9aa05504b80087ceab51b828ff67dbe42360", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071873, "uuid": "32b76cba-956d-4979-b991-8ce9d6d38843", "comment": "Malware payload", "value": "ebc7ad958fae29fd5a3403d139f2aa7ebed3eccf0c5984faf45ec973b16c16715d830882c756b2734f34a0d52ae238fd", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071873, "uuid": "dc073a82-c34e-42db-ac93-cbd1be53c928", "value": "T12725233A4E77DDFB337C94ED523B2E056E686887815AF192328FD2E79A9D6044C07834", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071873, "uuid": "2c4bb4df-5b00-466c-84ed-ffeb483fb645", "value": "24576:cW0yjDtJEpQ6tu2CPcDEPRT5QGv5KK25i/ywDTUHrk:R3bEpQLQ8wY5CB7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777071873, "uuid": "fcbf7faa-e124-480b-b049-eeed6ea85bba", "value": 1008019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777071873, "uuid": "2a6cffee-43e9-4b52-8e9f-d423dc66c383", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071873, "uuid": "e37b2773-252e-478c-9424-d1553aa1a433", "value": "LOL.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d42f94-3fb4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777018135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777018135, "uuid": "dff1570d-fe27-46e0-9d66-2302653cb9d9", "comment": "Malware payload", "value": "6d759cc730c3d9308a9971373bb70cbe", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777018135, "uuid": "68d8f600-158c-45fe-a8f4-9226e606f953", "comment": "Malware payload", "value": "f06e6519db9c9a3cbdf3d512e2fc40cd68081c4bc199f0f8843bd59d0df13de6", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777018135, "uuid": "19d4d153-c238-44fe-96db-5ce3d2e473a3", "comment": "Malware payload", "value": "1fc3a2cefc0f6fd2766f3652556d07b893938043", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777018135, "uuid": "4d6ef447-9b28-4966-b24a-7c5f90512543", "comment": "Malware payload", "value": "a879d903cdcc7a1c01df5d4a139d707596cfa1d6901a105ff343976dad0bd2f4da248623b7ba65f8de9ae9e5dd898486", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777018135, "uuid": "9f4ebd94-3f39-4d31-879d-7c0583560235", "value": "T19D0183F2C0CC4E9CD5128DB26983AFD8941000810C1618AB9701B10EAEEBFD8E7A21B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777018135, "uuid": "d81f23f4-4b7e-460b-9751-a405cd8c9fd5", "value": "12:5j+RzL3q/BJ5FNg7SeIPsr9hxALOdSUJf9vX8HhgSbzFSHkvtnbckd+ozMJaH:9qzL3KBJ/N6SHsh3GS9vXghgi5IkVnbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777018135, "uuid": "bd54e80f-12f9-4353-b644-afd30fcc65a0", "value": 705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777018135, "uuid": "4cb20485-3860-43db-92ea-bb87007c74a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777018135, "uuid": "01ad0c6d-21bb-4621-8d54-e8ebce9feb3b", "value": "Product Inquiry.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2186b2-4032-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777072314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072314, "uuid": "cfc2db9d-495f-4846-a9f3-d540286e95e2", "comment": "Malware payload (Mirai)", "value": "56fe3ec3401c14bc0abff6b576cc9310", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072314, "uuid": "cfe36c0b-cd2c-45a7-97f3-ac42f55f8147", "comment": "Malware payload (Mirai)", "value": "f0a027f6849d314e9210c9651bd37cc7015d2993fbb1019d94b2ec2c361d2df7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072314, "uuid": "2e816895-0621-4ebe-88f4-038221cf46ea", "comment": "Malware payload (Mirai)", "value": "d52661ba7baed1b5ea3f8334f2b1190a97eaf00b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072314, "uuid": "b8f7da2f-7984-4ef6-a3d9-65b3a03ca81a", "comment": "Malware payload (Mirai)", "value": "0b2c6cf0102ba607ed4d1bed79d5a66af40a5d9b4327bdef6ed891e82fba63ef5cbde2832b6ef4201f416640687a06b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072314, "uuid": "d7b584cd-9fda-4025-aac6-279883c6a4ee", "value": "T1D873F907B9C184FDC04AC130166E7D3ADC26F1ED1239B2E767C4BA276C4EE624E1E959", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072314, "uuid": "2383c341-0984-41a3-80fe-87ca22cc73a0", "value": "1536:ezQKatUKIOqz4J3t9Z39D+1rHoPbSLy7TLCEENwE0kgVR7gA:fK+UKIOqcFPN9arIP+QCCEqVR7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777072314, "uuid": "b58f3dbe-1e7d-4a3d-bd80-fcc3318e48c9", "value": 75008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777072314, "uuid": "3ba2c776-c385-49a2-9d41-d0f399221f20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072314, "uuid": "a32108a0-c0d1-445d-8a3c-0b5abbc8e260", "value": "jade.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca8d13d-4007-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777053659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777053659, "uuid": "4393df0d-fed9-48e2-afac-a8b24a6fe316", "comment": "Malware payload (Mirai)", "value": "c6696e1a10ae480610ae993f120dbbe4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777053659, "uuid": "65ad8619-c791-4312-9ed1-fffd9fe60512", "comment": "Malware payload (Mirai)", "value": "f12fd1151108655f2f0658403d05775eb81bba95f7645c02f978501364a12ae1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777053659, "uuid": "a548d2c9-c8f2-4ba7-a6ba-f3247c362c4c", "comment": "Malware payload (Mirai)", "value": "65b88cc3ea2df5c22849f99bc5864461fd66a2ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777053659, "uuid": "49f297d9-c6de-4088-8cd3-652cae7f14d6", "comment": "Malware payload (Mirai)", "value": "2f33c23105ae4d6db49a07fb5593c260401aaeb3c33f633411b4fb0b3e1e943b668bb3ca4ce87e2b5c047016d8497337", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777053659, "uuid": "1a7a634a-1863-4c1d-997d-dad16e5c49ee", "value": "T14BB2C0CDA1943084CA8D7C7C278D4A664F6CA0D0BAED9B16E350CD98B3BEA4F745D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777053659, "uuid": "1c063193-710d-4c8b-a813-0dc336739e28", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBp6ZqSWv9:4QlS07FUXqIYSXQKquOq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777053659, "uuid": "3eb817b7-8292-43fd-994a-0463007f9a24", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777053659, "uuid": "2bee921b-6a69-4447-832a-40b83aa8e46b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777053659, "uuid": "2e6306de-6a0c-4f62-b629-9e50957a66b9", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0cf3104-4032-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777072295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072295, "uuid": "71c6a7cd-a232-45e3-85d6-8323de1630dd", "comment": "Malware payload (Mirai)", "value": "96b36d62738ace32f62780a9f2c5a6e0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072295, "uuid": "7903f522-57f0-4e9e-a90c-8ec39e7966aa", "comment": "Malware payload (Mirai)", "value": "f2192b5c4e1c28ba44e579161b4f3e6f8ed46d8921ccae4870ae753b347d37ef", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072295, "uuid": "444d76b3-870c-4fc1-a804-f5b3b5ae320b", "comment": "Malware payload (Mirai)", "value": "29595b59ea39a006a4190e8b373b7541ae7cb182", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072295, "uuid": "0cc50cda-542c-4e0c-954b-89b3c105358c", "comment": "Malware payload (Mirai)", "value": "35b2ba8c2ceaad0698bb203df9dbea3769b97edc38437de18c6b5744270f988dd2733189febb9eb31e83ee00416e2fc3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072295, "uuid": "6cb3ab7b-2320-4344-bd2e-39a7a50568df", "value": "T1865171C913D120726CBED9377AB6C944B5905097A8CD7E889DEC38F8E1DCE0B60D2742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072295, "uuid": "d427848a-5376-4968-958c-d2e83d2d09b4", "value": "48:ipG6p0ip1wpZspLYpxUpDOQpYeplYpM0pb4pH4pPIpqEpzb:i13gUaMzvgB26Srx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777072295, "uuid": "d8e0369e-c6aa-4d6d-a5d2-e760b5197178", "value": 2854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777072295, "uuid": "7f830d82-8093-4844-89d4-63ed0904c6c3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072295, "uuid": "295bed86-e6b7-48da-96e0-0cff935b6220", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6147f14-3fa1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777009893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009893, "uuid": "cee2202f-6ed8-4388-9e84-c3118d798611", "comment": "Malware payload (Mirai)", "value": "105b8eaefefa94a9fbfdf0f41762279a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009893, "uuid": "931f67c8-371f-4a58-a3da-7a5e05152c6b", "comment": "Malware payload (Mirai)", "value": "f23b456e8367faa29e586ba1463c9686cac03c6b6720685908a0600c64f924e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009893, "uuid": "edc79be8-f235-484b-a54f-e77f97d5d52b", "comment": "Malware payload (Mirai)", "value": "2c209925226b53cdc5bd15d466f09be4b391ada0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009893, "uuid": "c4179f57-b10d-44a3-b7a2-5bbb52b08751", "comment": "Malware payload (Mirai)", "value": "6022d64766844f5ed82e3b56c87a80b76e564b646714e24365c2d1864612202b9d2099be96f1a371be7641ef9e648ee1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009893, "uuid": "7ba0895b-0f74-4541-921e-30cc9dc713d0", "value": "T10F5302A186CE7A75B70004BBC99F85C3B7C1573453B6A5B82105CD4FB50B62535ACA73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009893, "uuid": "e996a3a4-28ea-4b88-b698-7307c3dcbe0a", "value": "1536:iOwGH7aTG7okygtnSfzCjVAZxW12hpAJtpdU:iOwhTG8kyYSWVASXJZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777009893, "uuid": "3b29d020-b322-45e4-abaa-5015efef3db6", "value": 65928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777009893, "uuid": "1cfebdb7-ac72-4833-860c-0709df740062", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009893, "uuid": "bb605685-b8a1-44cc-b49b-bbfde8846b92", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "109734ea-3fda-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777034123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777034123, "uuid": "adc92422-c1bd-4d92-add9-5b57939af19d", "comment": "Malware payload", "value": "f01deca914949de8cf9302e238e516f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777034123, "uuid": "d6bbd55c-e0f1-4bff-83ab-ca30a868c678", "comment": "Malware payload", "value": "f241d92e0a83fc26fb02b477b3a8b30416414a3d20fcfcdf94352cc975786462", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777034123, "uuid": "37130027-bc7e-4664-b1af-b5e5c3b3d148", "comment": "Malware payload", "value": "ad92c6504d221dbf810d40b28be9f3537a8f4a0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777034123, "uuid": "2d7b217a-8600-48d2-a84e-ae478a7908f3", "comment": "Malware payload", "value": "75b3e561cce986202defbfe5661c3c09ead9adb7ec2964eff4bfe97b9595b8bbae92168acc4520b57dbd9b4889c1fe24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777034123, "uuid": "79dedc36-5899-46bf-a854-3d451695b3de", "value": "T17727D01AA7B501ECC0E7D5B88A175D13EAB2784913329BEB57E089552F23AF05F3E710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777034123, "uuid": "1ea1829d-3c0e-4403-b1e9-a6cb1330608d", "value": "e5a2c85b0f13d6d706a027c875e2df5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777034123, "uuid": "2ba2304e-dbbf-4b99-b804-26e570b0bde2", "value": "49152:oVdbcZiQ59a3EbEMUn6RVR4SME9ca+35SEGHo+/o+wiofnxaPKq5wMJn7q4TUEk5:ok2+Uns+0FOfnxiKE1TO8TIzVRJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777034123, "uuid": "e851742e-1c71-4831-ab30-c007cb213ebf", "value": 20926157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777034123, "uuid": "418a4ea0-46b6-4b58-9f36-7e3b2fe10f3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777034123, "uuid": "cbeb92f4-eb03-47b0-b865-12a4d385d22e", "value": "iM3yR8ToBk4C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61bcacee-3fc0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777023093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023093, "uuid": "5655e7f2-764b-4dab-8ef3-979fe3e9c775", "comment": "Malware payload", "value": "b28e6ce371f2ae2c0377473ef166b91a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023093, "uuid": "bf267aff-62d2-4881-9bd0-77494c835c6b", "comment": "Malware payload", "value": "f2f0c181598dbdd6ecb0011808d61a2bb3d8edf1b7d27e15b31a50ef8448a815", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023093, "uuid": "92fcef51-346d-4bb6-858b-3fa6a12b65ca", "comment": "Malware payload", "value": "6cc07785ce4239c83e118d8f016d2a3b0cf4579a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023093, "uuid": "f3066082-798c-4891-9e87-d862c34b0b16", "comment": "Malware payload", "value": "beb266536bac129974a11bbb61f203fa4fa11e3af8815a56510c6bc5147feaec730c93de05dcb3aed2ba9214b6b94c3e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023093, "uuid": "c5a98731-f7fd-4fb6-97fe-bdbc70669f34", "value": "T12575DF42FB184523C8570EF0197F43D6F7617A4341F5A22A270E5B672632E3AEAC774A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023093, "uuid": "05b81c42-addb-4e69-871f-22ea9dce9aa6", "value": "49152:xHUcf3MuHMwpsdZXpuu1wG66VguKZ9dv/FY7Z:xHUcf3Muswp3N6V2bK7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777023093, "uuid": "d892254c-fa08-4b40-8677-67ba2550ee5b", "value": 1575001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777023093, "uuid": "1233a981-a11f-4c73-a23c-f10e3a2eb0a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023093, "uuid": "b072379b-e11d-4f00-a4f4-f1dd382c8bd6", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "999e6305-3fc5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777025334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025334, "uuid": "73e6dfe0-6cd3-4a30-b77f-2de5fbe3190b", "comment": "Malware payload (Mirai)", "value": "7ecfef8940cd28b420838af7c0fb0578", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025334, "uuid": "21696f09-4208-4f2e-a67b-1b7270cd5ed1", "comment": "Malware payload (Mirai)", "value": "f32ef1ba5591ed8c23823a7bfe4b69d21a650111d46dabeea9a5621e619cfc32", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025334, "uuid": "93ce0f7b-b600-4461-8aa0-41a3d35943bc", "comment": "Malware payload (Mirai)", "value": "365ba8a8a56a1dd71cb016c2e0e036beba355ee0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025334, "uuid": "695cb074-3af5-4237-be8e-e6210956991c", "comment": "Malware payload (Mirai)", "value": "92682dfd9a5d229acab963afa0e0e57b537bba71f87675feaba705e4f7dfbbfbd946faeea3481d0448b18589f7d2600f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025334, "uuid": "2425f927-b384-4c66-bd3f-45a22d2e6b78", "value": "T109041905BF110EFBD89BCC3B45F9270529CC581A62EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025334, "uuid": "5c3411b4-e2d0-4f7b-bc4a-8bb263f2a02a", "value": "3072:t60NrtUpT/5dltGgXGGP9M4S8lrXwU2worKFLYV0fCtZ1SD39rsJzjM9fx49SY2U:t3nEr5dfHPq7UTo+FsvR9X0l6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777025334, "uuid": "452287a9-eafa-4f04-aad6-90e702162ece", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777025334, "uuid": "ed6b8fee-77ca-4b45-8657-d25ac822c13e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025334, "uuid": "7674afa9-71b5-4dbb-9d94-3d02bc97185d", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9626bb75-400d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777056252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777056252, "uuid": "86d2b51f-f1e2-4dc1-9901-26cd1f19cee0", "comment": "Malware payload", "value": "9e5cc0dde197ca9ddcb1ad787dbdc634", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777056252, "uuid": "090f09a0-2475-40f6-8486-4904b6fd92f8", "comment": "Malware payload", "value": "f33f514789690e94270aa5fd512983c31512f6ba6d22ad026a24a34c4f21a0fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777056252, "uuid": "2a2081e8-75c5-4099-b2ee-7c8ad42e5196", "comment": "Malware payload", "value": "a1926ac53e3c9d5d71b7e77944077e8fe19c9d18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777056252, "uuid": "c969397f-adb8-4bcf-a75f-2e90811959ce", "comment": "Malware payload", "value": "1eab081bf55d7655e06e5afa98a06bc54487b4a9b9dfbe6d11ce348ca80004830141325665808663772ea5aef175759a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777056252, "uuid": "891b0842-316c-4f49-8f9f-6ed17f41dbd3", "value": "T17F65E05BFE9E3C47D2D6E33E9F8AC3B1532BB191D31341523581422CE9C6A9CCBA1691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777056252, "uuid": "cec67354-b1f8-4e4c-af0c-f10f19285301", "value": "24576:dJ9uTMBCNwyCeThYVf+QcNkDZu++hu7JALr3o0WpeTQxwIgo10hvGqZSCoW:tr+of+yVu++QJG6pesxF1e7NoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777056252, "uuid": "5c3c0aaf-3335-4c51-8fcd-6c8730671798", "value": 1424920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777056252, "uuid": "551818ca-ea39-48c5-b3c0-71007c393548", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777056252, "uuid": "50755912-8333-4af5-8b5f-290ab4d6f604", "value": "bot.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ae5f67-3f76-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776991313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776991313, "uuid": "9f97824d-3000-4b05-8b76-1741732823eb", "comment": "Malware payload (Mirai)", "value": "f2891d688c695c45e0cd76a4c65d1cde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776991313, "uuid": "572659c1-fb5d-4cdd-8f7b-27f983ee1305", "comment": "Malware payload (Mirai)", "value": "f392af839e6a0568b12c9f9b4be9b2d4b30c894fae7e5aefd10701e9cae69e9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776991313, "uuid": "3a34611a-4b66-482f-a7db-da01f28369c4", "comment": "Malware payload (Mirai)", "value": "351051f5b4b629e343d859cd0a69d63274bf2abc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776991313, "uuid": "43ab7b67-8882-44b5-ada5-e3a0d68c036c", "comment": "Malware payload (Mirai)", "value": "f461e2a6fdf88f639aacdd45ab959cfdd3e28d4fee5d8ebf062df4708feb10e5cf7fe5af3de896b253647ee04ec31d5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776991313, "uuid": "1b271c15-463e-404f-9eab-2b3c3a3bca01", "value": "T1B3D3433E7E21AFBFE178823007F75E70D75929D626E18244E26CF6085E7128D185FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776991313, "uuid": "da0afd9b-4df5-44f3-ac65-0d8a8a53b45c", "value": "1536:byp/QQWYhX3faRU6pBbu5DTCBLmjbbnUEYvqlT3WqoZLmNSwdgpfvFWnF1feRTdw:t59C3lTmqoZgSwdgB4F1aTsIHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776991313, "uuid": "a9651cbe-e230-4304-bb37-d2ed779a479f", "value": 131464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776991313, "uuid": "47a54c2c-684a-450f-9c0e-f36c6c0a8c54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776991313, "uuid": "0a8d9c6d-2bd7-4b5b-9f27-3305a2b0b6f5", "value": "MIPS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "badcbfea-401b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777062326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777062326, "uuid": "294b4bb8-8a21-4883-989d-f3e6ae27dcc9", "comment": "Malware payload", "value": "b50b1dda513dc10d0ccb3041b0ce4f7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "MISC", "colour": "#E0D06A", "exportable": true, "hide_tag": false }, { "name": "Trojan-Spy.Win32.KeyLogger", "colour": "#D3751B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777062326, "uuid": "85a79e0c-e3e1-429b-91ba-4178ad56f9f8", "comment": "Malware payload", "value": "f3c37244ef4207075ef16bf3fe283afe07e491c46f6449252321aa9c01f98358", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "MISC", "colour": "#E0D06A", "exportable": true, "hide_tag": false }, { "name": "Trojan-Spy.Win32.KeyLogger", "colour": "#D3751B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777062326, "uuid": "dbceac8e-8990-4f20-b57e-e3520b8561b0", "comment": "Malware payload", "value": "b2f9fbb87b6216feb013529acc0f62565ab255ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "MISC", "colour": "#E0D06A", "exportable": true, "hide_tag": false }, { "name": "Trojan-Spy.Win32.KeyLogger", "colour": "#D3751B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777062326, "uuid": "a4515e7d-282f-40ee-bbf0-d3a73f88d901", "comment": "Malware payload", "value": "ff2e2274d737abff9901b15728c06f2fafe75fbb16c9d2f554ede0e0c28dfbd69f0a5ff485a0e27a0ad3990e88692dd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "MISC", "colour": "#E0D06A", "exportable": true, "hide_tag": false }, { "name": "Trojan-Spy.Win32.KeyLogger", "colour": "#D3751B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777062326, "uuid": "b7fc617a-d45e-4183-90b3-c72b31275d24", "value": "T1456733203635C22FC57055301E6EEAAB166AA8701B3708D3B3DD19694C779E3173BDAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777062326, "uuid": "97a34399-9252-4522-8d5d-5d4159cdd71a", "value": "eb036a7aa7da34774a211513c2fc9cae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777062326, "uuid": "8fe553a1-2ae8-4403-9994-ecb106ea479f", "value": "786432:ZiggY3z9HiGVneaLijopTUIwgyG2xf4X85ZVT+Ae485kTcd4:ZvgwC+eSa6T1CG2xg+T+J4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777062326, "uuid": "9932b911-5668-4d35-9fdc-cd284e518f7b", "value": 32183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777062326, "uuid": "9c46875b-58b8-47c0-a4cf-adaedcc2ceb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777062326, "uuid": "155018a4-777b-4ded-9f54-7214fc460415", "value": "bzvfZqmXNedca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29c3fd4-3fa1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777009887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009887, "uuid": "6f6108ab-d39a-4aba-bdff-ad8f9fb1e4a9", "comment": "Malware payload (Mirai)", "value": "361b7cd3bef99ad60b9bd3129d107e63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009887, "uuid": "306ca26b-5c70-49ec-bab3-efa8fcd2e921", "comment": "Malware payload (Mirai)", "value": "f40e7d990ef4a2b9e7b3444eb480968ffa74b608779920e63ed5ac246825eedd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009887, "uuid": "d847b884-b3f7-48a9-b56e-c36bab8ff3bc", "comment": "Malware payload (Mirai)", "value": "fcf46cf2329eeb6c2c0d2c73db3bccdb93a90812", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777009887, "uuid": "82f7c3ad-eb00-44b0-886a-c9688c25b854", "comment": "Malware payload (Mirai)", "value": "7a154d4a531e36e281cb4c2f13b120b594af1fbf72f2d1070b26fdd30ab42182204a85c596cd70e185a472b6255649b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009887, "uuid": "a12fe50a-7e85-47a2-a8af-6badc5f2b33e", "value": "T13E530222F61AFE27E3D145BD2DCD541E12C358688266747B6A69C23CFD0124BB8B7387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009887, "uuid": "b1974412-61ad-43e4-97df-c1cbe7068ebf", "value": "768:0e+C6bEgNLnC1ie449ACfLxCXMyrbXqP184JN4ZzbozDxUzvA/EYuqKs4wDg/Fii:0ed6YgNLQ7X6vrbsKpGCvA/EY1YNcHBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777009887, "uuid": "d8aa38f2-3d76-448f-a385-d22e302a0156", "value": 63204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777009887, "uuid": "40a5060f-94b2-4570-b7b9-35ee48f7a05b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777009887, "uuid": "34376894-69eb-4c3e-96de-b27c4117a2e1", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b442fc-4003-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777052087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052087, "uuid": "fd8c825c-d3c3-40ef-b278-1fb4ac4e611f", "comment": "Malware payload (Mirai)", "value": "2dec6811e4153ac269e7bc0730caae38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052087, "uuid": "992d2e83-eb07-4e39-b139-ec9bde05cf25", "comment": "Malware payload (Mirai)", "value": "f44080bebb4c37db1c66e0d9ea6db3a522814c56912310a0b6c29ed14a4d2950", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052087, "uuid": "4d744c06-e61f-4e42-b9a1-f27ab04ddbe0", "comment": "Malware payload (Mirai)", "value": "af4d3e051956e155cabfb96f68f35d7eb3204322", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777052087, "uuid": "c16f50f2-661e-4c5f-99f2-f5fc4acef6e0", "comment": "Malware payload (Mirai)", "value": "aceef6cddd42d022222d3c0881fe5d3d5135cd1ed33be84cc7d43b96d2af10a1e50a49c2b14dadd84a0ddef9cb1b62e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052087, "uuid": "8cfe0ba6-9acc-4f58-9bb5-ec72151f26fe", "value": "T1A0A2D1BFE8D64997DDAAE53B011D00CA50BB5C5413A783C23FA535B389678E8F836680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052087, "uuid": "89344af4-5685-4547-acd7-066651a98ac9", "value": "384:MccDqRfKUWFH39z+/49ETVQrGLruI8qB+eANnlBQpMr/1W7MM+v1Rpx:NMkKJFH39CBVQey7qsZoMTA7Epx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777052087, "uuid": "a9afe7fd-b852-4a8e-9107-4a303d7afb8d", "value": 22448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777052087, "uuid": "78be28c2-dde9-4fdb-a2e4-cbdf755af626", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777052087, "uuid": "7f935410-c1a0-48f8-aa1a-2dd47063a5d4", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4016f449-3fc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1777024325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024325, "uuid": "b5c94107-3b03-4d9d-8a07-37d049bb225e", "comment": "Malware payload (Gafgyt)", "value": "64e8a4d69c3662f062a30cd55faab57a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024325, "uuid": "c23dbaaa-3713-43fb-af3e-fc149a11db5b", "comment": "Malware payload (Gafgyt)", "value": "f4fa39763da0dd7a2b6f2033442fb586557ea23451b797ab5cf9699e2ae4b6f1", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024325, "uuid": "f809aafd-cf47-4539-92f2-832bb9ada6f3", "comment": "Malware payload (Gafgyt)", "value": "aed7e0bb0400e0ea9503018460af78ee52e8e19c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024325, "uuid": "18d964e7-e1ca-4d3d-811d-f47cce170092", "comment": "Malware payload (Gafgyt)", "value": "5bb81643d4e720dd8f5340bfe60445d84603e2028f0e415e3616ded11692bf507ac31a334fa17a2c510ffdbeebd97df8", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024325, "uuid": "37f66321-eea3-47a4-a3bf-7c8763a8251e", "value": "T147931A49E9519B1AC2D231FAFB8D518E33131FF8E3DA31269930BFA023F16E60935525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024325, "uuid": "bcdd17dc-8984-4c94-89c1-ad520af2d41f", "value": "1536:QwnztuVvCr8aG1jaauyJiC6xhk9mpki2atEbxVy25U5bYRMZG+:q+lG1jaauodQtE7yAUBps+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024325, "uuid": "88b218c6-fdce-4698-b2a9-5711b156074b", "value": 95264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024325, "uuid": "88d7035c-2ffd-4e52-a6a0-f0ac72a5ace7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024325, "uuid": "a1c00368-1fd5-4f52-9f73-be485a6ef8d8", "value": "ARMV6L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f46baf72-4032-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777072301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072301, "uuid": "49719000-e530-4d21-8e34-b69da71b9d43", "comment": "Malware payload (Mirai)", "value": "88982ac4adc7299f01f5274801328f23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072301, "uuid": "e9e9d489-ad61-4f16-9ff8-dfab7a75f857", "comment": "Malware payload (Mirai)", "value": "f5728f05c916d54de6100fd98935a12d4f71b763daef9879d4642550be420a7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072301, "uuid": "44f4944d-30b8-4412-a7cc-de9d3f7fd9f6", "comment": "Malware payload (Mirai)", "value": "5f2e578cf53a38e4331669036e85acf7170be1c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072301, "uuid": "873b5faf-7526-42a9-bc58-71af40049bcc", "comment": "Malware payload (Mirai)", "value": "1daf67be2c99ee76624d8ccb6214eb801ed4c69c0d87b8b4b6ec5a471e4cca54a5306ce86656f71c8612e772fef9a82c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072301, "uuid": "3d8d23cc-6776-4ba1-8f00-c7e329709219", "value": "T172733A4271280B47E5930AB42D2F1BE05BFEEDD031E4B684695FDB668A35E375086ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072301, "uuid": "a0e03b52-f211-4ac8-8db3-3dd6d9ef5fbd", "value": "768:E1OpIF9M6jcY+C0rRixDTAkdlS1ZEeB+uJmHHhPPfSwYeSiqM7kDHOOnrImrRYN4:hJXJrcUkdM1WeEph667UFY9UIs3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777072301, "uuid": "2fb54479-b364-4b58-8757-b9e74bc7ea9e", "value": 74848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777072301, "uuid": "207f65a8-aef4-48cd-8917-e67eb95ba0ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072301, "uuid": "c47bcd2c-1d14-4e64-b785-73ae6d3c527c", "value": "jade.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4e4da4-3fd0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777029954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029954, "uuid": "393e7d0d-db4a-4259-972e-4dd1598df304", "comment": "Malware payload (Mirai)", "value": "6e07aa82453ab79f14294091d76d249e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029954, "uuid": "eeb8ed3e-b769-4fe0-bdbc-23abcd1a4201", "comment": "Malware payload (Mirai)", "value": "f62bd6b5521a2300fcdd4bae1dd6db0c00b03c7cb2da39c30787ebcfdb9e0d67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029954, "uuid": "1a98321e-4197-428d-85d1-b58d5f998abd", "comment": "Malware payload (Mirai)", "value": "cb4277e6975495b5503f4004c7f315a0d75fdbe9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777029954, "uuid": "66cffe99-e645-436f-8688-08bc33363b98", "comment": "Malware payload (Mirai)", "value": "c7faaa236fb551e19ed5192549a0e4d33b5460cd13c3ef4fe8d2dbec127d00992377ca49b01cb5c04ca1caf4b75b65eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029954, "uuid": "2789a1c2-7ff9-4250-80f3-2e02701cd5bf", "value": "T1B7B3A5193E21DF7EF79D827847BB8E20565437D62AF0C185E15CEE481E7028A781FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029954, "uuid": "8d2df08c-77ec-4951-a16d-2fe64378cb2a", "value": "3072:8l/LbyWs45NfM2bR0FpY3/aXGAo+eEmKf:8l/vyKy/U/8GA0Kf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777029954, "uuid": "0cfde27c-b6c1-4889-b5ea-d4f178284980", "value": 117808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777029954, "uuid": "4d48ddaa-e9a9-446f-965f-899eb8ebe157", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777029954, "uuid": "df6d19b3-9b33-4811-b39a-e6eae1f21b1f", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2afbb22d-3fc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777023001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023001, "uuid": "0714b7f4-3db9-4cf4-afcb-59e890d8a5db", "comment": "Malware payload (Mirai)", "value": "a10fcdcb393fe55a5e373da6937f4ef5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023001, "uuid": "2256486a-d1e5-47b1-ae40-58e265648052", "comment": "Malware payload (Mirai)", "value": "f66eb9f42a6cdd9831d9f8281e5487564bce2683e151f99de34a8d5cb2303cb2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023001, "uuid": "7d208b34-b90b-4e86-bf22-1b9381471be1", "comment": "Malware payload (Mirai)", "value": "fd7ecfd4093ed86fb223092b34748eb44b0a9826", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023001, "uuid": "d04ba68e-6f44-4ee1-bc76-7c58c4eede8f", "comment": "Malware payload (Mirai)", "value": "c1cb420c684fa9ac915fccfa5fdb6b0b121676e9dab7f86b560f399f3ba42ef13a688966f172e175e959d090fa58d2c2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023001, "uuid": "c2a0bfef-a9ba-48a3-a0d9-23d41057e155", "value": "T17F55E09BFE9E3C43D2D7E33D9B8AC3B1532BB191D31341527681422CE9C6A9CCBA1651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023001, "uuid": "af8b8abd-413e-4e49-a15f-b2946a0c93bf", "value": "24576:dJ9uTMBCNwyCeThYVf+QcNV5lwd3tsbsyiME7dALlKodvSIGM5H:tr+of+5lw5tsPTvvzGAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777023001, "uuid": "2c37076d-756d-493b-9b04-7c5c45fcc8e5", "value": 1355072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777023001, "uuid": "5950f8f0-5f1e-45bd-915a-24161efcf4ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023001, "uuid": "34f77c03-2630-4f95-951c-6f6ca88430b3", "value": "bot.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c158a0e-3fae-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1777015406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015406, "uuid": "4bea4761-b964-4a78-b41e-60f42b02ecc2", "comment": "Malware payload (AgentTesla)", "value": "9fc20beeaf73d7694262e7d67c08af6d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015406, "uuid": "05d64471-f7cf-49ce-85e1-ddf8b9f71228", "comment": "Malware payload (AgentTesla)", "value": "f77c65b3850800ed490772d091f0fbac93f013488f880795f913d05463ae91cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015406, "uuid": "b11f0661-3796-44be-bd54-f7e281b50d48", "comment": "Malware payload (AgentTesla)", "value": "64d33a3dadd3ad3b645145d1cf62fcf9bade3688", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777015406, "uuid": "18e9310f-cd36-4623-9d9d-e9874e832381", "comment": "Malware payload (AgentTesla)", "value": "058747e1a58b57d8a3d1b7a3b3889644f51ea7b670b5499da2382862f799066f68413ec8c22e9a5881774c1d8d799b53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015406, "uuid": "84c7ff79-abe6-4a12-b43c-2dd42b125a52", "value": "T1F7B40160E5E4CEA7D04E44B288ADE66124B96F4DC4B5442F2252FA1DEB73383453FE1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015406, "uuid": "6dbb9d4a-b257-4cc8-9a91-3111f5d74af1", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015406, "uuid": "601aa9e2-4005-41be-8c19-0c347594bc2e", "value": "6144:nbfopymvAznZAJi7WPzgQw7WpbGCmZfHANaZ9idblzUHNG4dU3wedPz18yAZM:nb447e0idpbLmZYYjidNUtG42gedPGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777015406, "uuid": "e3794946-7ee2-43a3-9d52-1747f3de4902", "value": 502012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777015406, "uuid": "0e2b4dcd-d6f2-4d0b-9fe7-2a3059e8559e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777015406, "uuid": "299ed6e4-2c53-41c7-a770-e3ae6b3b01b0", "value": "Copy20262404001022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a83089-4032-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777071906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071906, "uuid": "72ff3b97-391f-4713-b296-04602ef16df9", "comment": "Malware payload", "value": "63e3e39bfeedd06dde88d9f54aeb43f2", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071906, "uuid": "da31f8b4-e8f8-425e-b71c-11efb60b0d2f", "comment": "Malware payload", "value": "f7819391e1a3c1e523ec2193eee251eca92c07d811eb7b7dcff4b4e125884d06", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071906, "uuid": "053bf13e-298e-4ce7-afee-e1b4f7d6f5e9", "comment": "Malware payload", "value": "c0ae435bc5eae77a01387c1410b1e44c67273a83", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777071906, "uuid": "55a4aa00-b81e-4cbf-ba23-5f4550b9ccad", "comment": "Malware payload", "value": "496c5ec759a09832e989372a8b056fdb94af5d5184a8d80ad2ecf96164e6edf98b369b373c6aa0f74646a342e27a4cce", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071906, "uuid": "b359da86-0ed7-445b-89ea-a6c045b4b25f", "value": "T1CA052370ED38FED80998E33832FB495987C41AB5C5E0F56F73ACA181A15FB08465AD72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071906, "uuid": "9c395c70-65a4-4a6f-8201-2b36426673cc", "value": "24576:KmQbp6ma+w9PUCWjshRUV23RtVOoUj4q+9LMUO:obpUdUC6i/qjY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777071906, "uuid": "8eea4190-20d9-448d-89a1-8af192d1ae42", "value": 841162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777071906, "uuid": "c30e7565-0d0a-4aee-bd8e-6f02fbd64d9f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777071906, "uuid": "a7dd591c-8605-4f57-b537-cd7ab001521f", "value": "politics.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37498631-3fc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777023021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023021, "uuid": "336cbb75-6297-44f9-8df1-f65c9817d8cb", "comment": "Malware payload (Mirai)", "value": "548fae65fa130ef9354fdd9d3fcf57c7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023021, "uuid": "77212c2e-85a0-48ed-a91d-96d30c14505d", "comment": "Malware payload (Mirai)", "value": "f7aabb83fc06f1265ca459d4502d86aa1721929141502a45e5349e05f0d6886d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023021, "uuid": "259c1de9-ae70-44b8-b22d-c3847d58d20c", "comment": "Malware payload (Mirai)", "value": "68772c4a968c807aa2e47a6902fbe5cb681c076f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023021, "uuid": "c2480010-ed4b-4009-8eec-b4421d32686d", "comment": "Malware payload (Mirai)", "value": "000d680fe5418084df948769d39cdad0e8b6225ff7d24d9dcfa7aaeeca9a29c9ccd23ae4a4fee606ce0b3b6e99e96602", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023021, "uuid": "f0ffac38-fb1c-4fae-9f87-306b326068b5", "value": "T10845CE16F8808F62C5D125B6F65F8268331747B9D3EB72069A189B343BD792F0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023021, "uuid": "0c45039d-9dc4-4583-b1fa-fbbdbb9de284", "value": "24576:6z/qLvfxB+6qHxWiOeiJnaGYTAl+rDUCxducdtm0JzJAiqxcGlIQAc:6kfxB+bxWitGYCKduk00JzYcGlRAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777023021, "uuid": "878c9443-ea5a-4688-8738-03d204e3892e", "value": 1236556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777023021, "uuid": "acf31e66-38e6-4933-8b3e-7e6014379674", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023021, "uuid": "cd393149-6ca3-4b7b-966d-7799c2f50f8a", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4800c73c-402e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777070294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777070294, "uuid": "7abec6db-0409-48d4-8dee-7be92bca9a01", "comment": "Malware payload", "value": "a315baa11b0cae78f52189e7b61eb336", "object_relation": "md5", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "windows-telemetry-cc", "colour": "#BEF4BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777070294, "uuid": "b5b04008-11a9-4297-bd4d-612f9ae5041d", "comment": "Malware payload", "value": "f825a78f294e7296b13a590ca7c4b857f4fbe596fd1da44b4e7e4bd356abaa43", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "windows-telemetry-cc", "colour": "#BEF4BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777070294, "uuid": "f254a6d1-3b75-4e50-85da-ed36ea1a6635", "comment": "Malware payload", "value": "8dc6a0463291180933e1cd43916c53336cfb3a60", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "windows-telemetry-cc", "colour": "#BEF4BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777070294, "uuid": "1bf2f748-0807-4926-b0c1-427794be2f1b", "comment": "Malware payload", "value": "9786bed77d57dd04d784bf94f0126f42d0c2fde74ab83ed129ae0c11fe0682437adbc07340e19daa97294b55e04fa195", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-CountLoader", "colour": "#38E942", "exportable": true, "hide_tag": false }, { "name": "google-services-cc", "colour": "#976AA5", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "windows-telemetry-cc", "colour": "#BEF4BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777070294, "uuid": "bfaeedb4-4a2f-4c17-8cf5-30a4c4be1deb", "value": "T11F444126FDC75C6783C39B63D2E3D21CBE7984AC850B9EC4B9B8C2825861D691749F1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777070294, "uuid": "cd985ccf-5d9c-4e9e-8641-0bcc1b01f136", "value": "1536:4XtDhC8pwLWz7bhynW0ncAmJEjJetAUaXtA:43CiwLWz7bhyn7nxnjwtMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777070294, "uuid": "d88898d3-a8ff-4abe-871c-5942b51acd54", "value": 259657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777070294, "uuid": "eaa5552c-c2e2-42a9-82b8-f5b70236c855", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777070294, "uuid": "d0c31232-b76f-4052-af39-a6f7e5ff8334", "value": "falsepositive.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5993152e-4033-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777072471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072471, "uuid": "02864012-42c3-4ce4-bfdf-9c1f04a07336", "comment": "Malware payload", "value": "a7b2e65ec3aed0ff8de3788dd56c6432", "object_relation": "md5", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072471, "uuid": "3e544db1-fe84-4423-9f3a-bd482a5b4bf2", "comment": "Malware payload", "value": "f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f", "object_relation": "sha256", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072471, "uuid": "62a3252f-655c-4c33-904e-1745aadabcac", "comment": "Malware payload", "value": "d035da4f55af9c977f622270ab52ee69faec1d87", "object_relation": "sha1", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072471, "uuid": "c27a2f5a-5d84-4081-92e5-ef14d03c8186", "comment": "Malware payload", "value": "1cc766525b7f1cf0f45eefdab201814fc375c1c06e8d242f2405bab6aa55505b27568e6c604dfe0dd9c9917d857c4c8e", "object_relation": "sha3-384", "Tag": [ { "name": "celebration-internet-cc", "colour": "#DFF49D", "exportable": true, "hide_tag": false }, { "name": "dcdivas-com", "colour": "#DBFCF9", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072471, "uuid": "52e4133d-d642-4bd1-9cde-a97ed25f41b4", "value": "T1EEF4D4EFAB60B5E4D821ABFCA4916D0183B07DD0798142AF11C7FB2BCD78A539F09651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072471, "uuid": "5c137c0e-3977-48d6-abcd-152268a2310e", "value": "6144:1RnRDmcvpIUIHa4t4MLWnVXyklQ1UB2vCGCFy+2fUSfciSDzClE6zip6ygCOnY:1uqI7LW/lUUB2ChQUSfci+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777072471, "uuid": "bb786cc8-5c13-4e27-83de-92c7b3016c76", "value": 733440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777072471, "uuid": "8def4f82-e160-4c05-b5e4-00d0caf47fb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072471, "uuid": "bfc2d3cb-f080-4675-9772-3a7129af141e", "value": "Decred.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4529c65-3f85-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1776997998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997998, "uuid": "af7ea4c3-3bd7-4979-8a24-9fba2b873533", "comment": "Malware payload (VIPKeylogger)", "value": "539e7d30d60e384d4bee8dffcfe9ed45", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997998, "uuid": "a8729ad5-f459-4625-970f-478b97a4500e", "comment": "Malware payload (VIPKeylogger)", "value": "f92d0596edc34fa3b1fd60022c44eb578a47db995f24c6adcf86331e81e87a72", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997998, "uuid": "1eb747f7-3f6f-4de4-a7f2-f2557be4f1a9", "comment": "Malware payload (VIPKeylogger)", "value": "b13a2eaba3679c7eb9f9e450bdf55c2adb137044", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997998, "uuid": "17c52617-ff2e-4f0c-be98-6e6766d43c57", "comment": "Malware payload (VIPKeylogger)", "value": "2eeddecabff76d1cc41e8334d4dc18ffa0a8a0c8e23cb19cee24200fd9d319504d8f330ae677fa93b414c34611747649", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997998, "uuid": "dd6c8da4-9bfc-472e-8993-535acf52ca00", "value": "T13AC312704E1219AD42ADD62AB47BF68AFB140BB1014EBD0E7BE646D0D9DFE4F14101AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997998, "uuid": "3491e5f2-ef3f-4fc9-8590-bdbc3f29b593", "value": "3072:bcI8y8AwvxN0ZIGbCwjtyga5PwiDux8xLolqyNSA1mgj:bcI6VvoZCgyga5PgxQssyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776997998, "uuid": "b365b8ee-67f2-4805-b0d3-6135601e4bc3", "value": 123924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776997998, "uuid": "f01fc9b4-4b14-4466-a12c-18dc110b848d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997998, "uuid": "fd5781b8-88b3-4e59-ae27-7cd1276b7357", "value": "suffer.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1214c1bf-4033-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777072351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072351, "uuid": "320fd067-b190-40eb-8562-0327d1a97bf9", "comment": "Malware payload (Mirai)", "value": "af1e125730e517432aad0b93823b9f2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072351, "uuid": "d928c497-60f9-4bcd-898e-fcdcc343fe9b", "comment": "Malware payload (Mirai)", "value": "f92f33cb25171067d18b3f559f38f70e3188368bb816d60e4f4459c244e4633e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072351, "uuid": "693893c0-f9ce-4873-b291-06c86bda4040", "comment": "Malware payload (Mirai)", "value": "46a34c632196d124c7bc7ea5890eb46b89bce906", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777072351, "uuid": "d75285b0-850d-4eec-9ceb-b11dadd73a9c", "comment": "Malware payload (Mirai)", "value": "ed0995f089afc3f189b37f136b0af56100d3cbdef8d727f15b1243477808e239fed6a08e50d66080390e9160225704d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072351, "uuid": "acc86d06-cdcb-46a2-9f8c-85eac3102e0a", "value": "T13C732891B8C29A23C6E0137BF96E418D372563E8D2DF32179D252F6477CA81F0D67A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072351, "uuid": "20bc4ef1-6081-4676-a3f6-343067c81f1e", "value": "1536:6l/kU9LApJQL6bkrru8yxp8gT8cvU3ahWnUm7pX5ezEF35l9t:6lty4gXvUqho3X93R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777072351, "uuid": "e40aa2fb-f36a-46f0-97d1-6e9c2915e1e4", "value": 79268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777072351, "uuid": "9de3485b-ede9-4a5e-815b-7a66a05b98b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777072351, "uuid": "a7eb889e-04a0-4921-9232-8b9c49f50e10", "value": "jade.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b455c4a9-3fd3-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1777031392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031392, "uuid": "91155a61-7053-4e99-8d45-c4397dcbcab8", "comment": "Malware payload (PhantomStealer)", "value": "ab1ecf5011403e2625dcb5792b08004c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031392, "uuid": "302f7229-77fe-45df-b4a9-b5adb448973a", "comment": "Malware payload (PhantomStealer)", "value": "f9a47e24ba812456adc1faa2ce6d48a49e6b1c479b70f7dd9747ec3d2ea12108", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031392, "uuid": "015c638d-7b16-46ce-8649-2afd2c2e218c", "comment": "Malware payload (PhantomStealer)", "value": "68470f8b016aa4f73cd3c1c612691a6746df32e0", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777031392, "uuid": "8c03f52f-02b3-40a0-8511-d3ddb7f4fc22", "comment": "Malware payload (PhantomStealer)", "value": "89044f6c3114261359484c356bd8158d68891d9f6229e22da1ffd655f27cd74b901025f309be206009e7e36f5955d25a", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031392, "uuid": "ed713545-2833-402b-9ec7-a9c31ec567b5", "value": "T1E035022259D83FB9CEE85A2850BE061E63E046CF506B64CADB737D47AFEF900511B0D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031392, "uuid": "00157072-401f-4244-af37-2d14de2ebedf", "value": "24576:45FxIoklRKWyCSCyWaTq+N47dkkEIto9aQ3gkx5c:OUXl4WTyW7VAgE5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777031392, "uuid": "d8c0c4b1-f393-481c-bedf-bf4cdd57f125", "value": 1130667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777031392, "uuid": "5021f768-828b-44a0-97fb-e76c966638cd", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777031392, "uuid": "fce65fdf-7113-4556-8775-090ecbb28d8c", "value": "Online.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "981d7fac-3fc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777024902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024902, "uuid": "f84077c0-efb0-440a-b364-911d75d04bff", "comment": "Malware payload (Mirai)", "value": "a10080269a0f1072aa901c4fff8db2ad", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024902, "uuid": "4c4dfed5-fd8a-4cb3-b1d8-b65f36b19f37", "comment": "Malware payload (Mirai)", "value": "fa5aa20953233a8b28de6e9e35c17f035a40d517939a83a8cd3e5b8f21052a90", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024902, "uuid": "a4cdaa70-2aa5-4475-90ef-ba682b1f9574", "comment": "Malware payload (Mirai)", "value": "080fd077038454c1980b7966e399a236e6c3c428", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024902, "uuid": "30b13761-1a24-4f84-824a-deae4e3cd9ca", "comment": "Malware payload (Mirai)", "value": "4071caef45499dbb535eaab899ba1728aac72289588939500ff2e8502afec406e30fd71c1fce71e9ba49cf37991bb59e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024902, "uuid": "d0db097e-e15d-4fec-b3c3-80afdf8ef8d1", "value": "T1D6E32BC7F900DEFAF80AE33648530905B630BBE115925B372257797BED3A1991873E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024902, "uuid": "970953e2-6a2f-46e3-870a-565ce3da9909", "value": "3072:IXIrpVCNs5jgpC+CdjYQ9ODVvjbidLj6Q2y8opM+:IXcjgpC/dX9OQLgy8WM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024902, "uuid": "f8665f30-34ed-4f24-90c6-fae98f513fc9", "value": 150496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024902, "uuid": "01182628-b250-4344-b64c-a939dc4b6fcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024902, "uuid": "a1f315af-e036-4a6d-8557-8e6ea5c978f6", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67d3235-400b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777055420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055420, "uuid": "320c9f8b-6542-4ed6-9930-4e215449e8d0", "comment": "Malware payload (Mirai)", "value": "9f4ff48afeadce62618c7b8da020fdec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055420, "uuid": "d85a9f0b-f384-4bdc-88fb-2bb5f90e2808", "comment": "Malware payload (Mirai)", "value": "fb48c0f267772d5bcb05c4c672374cbea01795e39f1dacb7e2a81feebf5beab9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055420, "uuid": "632c343a-ac3d-4fa5-ba57-b79630742171", "comment": "Malware payload (Mirai)", "value": "346473371bf0da06d7d766febe0bd9ca1d6f76eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777055420, "uuid": "0e68febb-5412-4b13-b97e-6936b4cae635", "comment": "Malware payload (Mirai)", "value": "a0985db7a3f88919ccac30ffdf4e05d9d49d7a770677f7742f5f607c2238d89058aa0d816d1ab8cf0a4d38cf874ab4c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055420, "uuid": "817f0454-35cf-4368-addc-76ee72b00f5f", "value": "T181B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055420, "uuid": "d620a68a-96f6-4629-956a-912c7f358db6", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg13/LWy:c9sSyzz36YaWWgg13q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777055420, "uuid": "2ff589f8-6194-4053-8c15-ba8fc671387a", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777055420, "uuid": "5dcd2cd5-6d1e-47f2-9f74-96eb0835be36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777055420, "uuid": "9cae6bab-6114-41aa-a724-8a48919dd491", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f511a5-3fc5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1777025351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025351, "uuid": "67f501c2-943d-404e-874d-6f03eb43a5a9", "comment": "Malware payload (Mirai)", "value": "b55adcb0867f5fd6fd39f24177ff34d3", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025351, "uuid": "1136697b-e914-4d9e-bccc-54ca76fcf521", "comment": "Malware payload (Mirai)", "value": "fb69d3892bf3ea8c5b2594540cfd31300c6170334934bbd983479c79fda01ddb", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025351, "uuid": "3bcb04bd-fc80-4768-b575-e634fb055508", "comment": "Malware payload (Mirai)", "value": "a236c94099c47de98c3b46e3f9941d9f2da22f6c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777025351, "uuid": "aea9cd57-65d4-4a0d-8dde-e16394e7dbf2", "comment": "Malware payload (Mirai)", "value": "b992301882087d50c538af20d74d21bff9402c170c5a378701c8375d0af906e51ed6a435155dceb577d9043af40fba70", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025351, "uuid": "d1f6ab08-f2f6-440e-90e9-aed553069279", "value": "T157C39D32D8396DC4C1945434F8B1EE711FA2A5C441A25EBB1AE5C97900C7DA8FA0EFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025351, "uuid": "f59c1cee-82bf-4519-bdef-38defacb4cd5", "value": "1536:6aZwsA5XjVZJK0twtfXd/GW25UhMMJNu5xWKLYMYaXgDe6u8KSgnMwSMwm9rFHwj:6f5Z5Z98XdmVMJaWaXvbjSqSMrHQwEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777025351, "uuid": "05149f7a-25d3-4e59-8244-4c5c76a3cc42", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777025351, "uuid": "6c110446-796a-40a5-a818-6e536b8af262", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777025351, "uuid": "761f4750-bbe3-474a-a146-99c181162c9e", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab486a1-3f86-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1776998143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776998143, "uuid": "5379a1d6-c7e9-49ce-a524-9e6a647cc1cf", "comment": "Malware payload (njrat)", "value": "76d622a3a2f86e2a5e6217155a6ee1d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776998143, "uuid": "581a7ed2-864d-4d56-8e0d-9bf3d93aa151", "comment": "Malware payload (njrat)", "value": "fc094a9cbf6b8e30b323d1b55d5b9a9a49c2d2ce34d48014540d00ea845fafe9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776998143, "uuid": "24c0a1aa-cc50-487a-9505-4ae62f1b5eb3", "comment": "Malware payload (njrat)", "value": "e095d3b85a18bd8dda63bfd1c12f60c02b812597", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776998143, "uuid": "8cc16bc3-5db5-4911-9c22-c81b9a56cfc9", "comment": "Malware payload (njrat)", "value": "03ccbc1b2012e26bb4eb478fa7e5c43f9aa850f69967ec95cb8b565099e6304f19ef5c89fafb377cd8adc0626bda69be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776998143, "uuid": "853e9619-cd82-40be-bffc-1530ced0b981", "value": "T1F0751252F5A401F6D4AA81354D632F11B7B6F43A4720ABFB4B48584CBF63BA41D7AF80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776998143, "uuid": "7f7da8f6-3eba-4ffb-a0d2-17fb75df876e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776998143, "uuid": "f126d9e2-f988-4fe4-a7f4-4741d55773b1", "value": "24576:HyMPPZKL1YpDI8/WFCoanWgU6psHl2LPrA+YjIs2aTMpwoGcPAdjXbH:HyMPBKZ+skGd6pjLTA+w32asxg9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776998143, "uuid": "6da9b942-f18c-46f6-bd86-206c303407b4", "value": 1606656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776998143, "uuid": "6f46950a-c875-4753-b824-a1a064aaf30a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776998143, "uuid": "ba941c08-0fb3-4b60-b9a0-9d07d75bb7a9", "value": "tpmspoof.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798c646a-4013-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777058781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058781, "uuid": "05019321-20c0-4aec-afec-044678b174a6", "comment": "Malware payload", "value": "4860a55f26435ee24892c2bc6a093446", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058781, "uuid": "017e78d2-098f-4781-811e-60cc258c104b", "comment": "Malware payload", "value": "fc23e34e985b5e40b4d5a6b793b8b429d36374708ff3ea0812728a17abf1bfe0", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058781, "uuid": "3ce49718-be6d-4462-a94d-c42e1a3fe3e1", "comment": "Malware payload", "value": "088876ba4280352006d3e6cb7ba66923d57ead6d", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777058781, "uuid": "361fc6da-0ae4-4f35-befa-8016491a48ad", "comment": "Malware payload", "value": "ad675c2e556efd19c903f28f49dcbe1a4e07114fd462c17ac32fb917b60c3deb8357a3433ecced22d0c97bffba76d6f1", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777058781, "uuid": "269d4acf-8dcd-41c4-8345-bc71b8bb7e6e", "value": "T109830225721C594F912D8812DCB7DC4BF6D0C5339C8B86AE7AE19143349D4B68AEBBC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777058781, "uuid": "d31b2806-d55a-4ab6-af6f-1f9750af71f4", "value": "1536:Jk/DieSAX3zqzr0l3ai6eUNPodQ+qrRBhVoiyToEeRCxFRwAmrarX:qbN3q0OX+wROi6XbxFR+arX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777058781, "uuid": "1e7ebe56-f59c-401c-8f36-ecaf5e053890", "value": 81881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777058781, "uuid": "8958b129-4711-48b2-a920-e182fa05e422", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777058781, "uuid": "5e7c70b6-9be4-49fc-a863-37762136ed53", "value": "Journal.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9c33f7-3f7e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776994819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994819, "uuid": "a7cf16e6-f876-4740-a072-5da744885d6e", "comment": "Malware payload", "value": "cb5645022c77f177697d67eacd590805", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994819, "uuid": "53fd48a3-7148-4480-a2a5-2f743d2fe3da", "comment": "Malware payload", "value": "fc6f995d544f5e4040b7801cda7d739b805fdc9936138066c8d5775cf7a69775", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994819, "uuid": "349fdcaa-4d1e-43b5-adde-a52f53b0e378", "comment": "Malware payload", "value": "868258fe4844a4a90cd44d229ef7fda9ddc6b903", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994819, "uuid": "bd1097c9-e7fb-4b05-b8b5-9a01d72530b1", "comment": "Malware payload", "value": "d851c9395127f02099e6f53f4c2c95d2d849b1b2a20c5847a15f62ca0c01f3c5462f428c3e6febd34aaed04abe40eae8", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776994819, "uuid": "80614aaf-9682-465f-b720-aba9c38fa6f9", "value": "T150C08016917EC50E956794D60572550845B0EF412574AE318F40DCC871514906356243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776994819, "uuid": "eb46b114-1332-4894-a932-a5dc75caff64", "value": "3:j+qAHmFEm8nhcDQBfBJpoNIkVViEaKC5SufyM1KvN+Q3LWhXpv:j+q9NqhnfBboNBnaZ5SuH1mQom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776994819, "uuid": "7db3a40b-889a-402c-a64d-9e5a919e8251", "value": 161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776994819, "uuid": "594cc573-e8ae-4f91-801c-3e6b424d90ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776994819, "uuid": "493c2c38-6392-4fae-b7cf-52dbdbc07322", "value": "SHELTER.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "624e8de3-3ffc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777048863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777048863, "uuid": "448ed570-3353-4a51-b0c0-887f5f11cf5e", "comment": "Malware payload", "value": "75696158603fceaf32fcc4039ac3965a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777048863, "uuid": "e56c6b43-5ee1-428c-8661-fae217aac110", "comment": "Malware payload", "value": "fca130283f5ef6cc2c6ed66f6d8066cfb063cced00aa3a22565bd889e240e1cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777048863, "uuid": "49de3bcc-a222-444d-8ae5-a3c25def4978", "comment": "Malware payload", "value": "f4761b9c7ecae7500a3dcc07daadb03976b077e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777048863, "uuid": "1ea023d5-d2eb-45a5-8a00-00d87d1e28dd", "comment": "Malware payload", "value": "729bf403e4ee4b6243342b0d4b8ead8914b6ad17f25a1f920041ff33f9e10e55d599d7fc8fde640640371dcb99d22855", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777048863, "uuid": "495e691e-684a-46ec-ad4d-150a57dca4a7", "value": "T10465D002FF815FABC06FCD30892EC35711E9D98696C1A62A71FC4B9CBA5D35A0BD3548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777048863, "uuid": "1f3185b7-eb01-4795-8fa9-12b2b26d6bf0", "value": "24576:ZYnr5PrLsOf860KhwVfLeyxHbmniDoGk9wXi1MJXfAHCg2T6O0MykyYc:ZIrLyrVTJ4FMyPjOYqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777048863, "uuid": "63568c32-a292-456b-b95a-78226ffaefb3", "value": 1492542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777048863, "uuid": "86d33dcc-fb18-49b3-89de-b5c24c060e1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777048863, "uuid": "c7f37a33-9f80-4fcf-ac46-eddc5b3f4f24", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5cf1c2e-3f85-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1776997893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997893, "uuid": "cf056967-4ebf-4f3c-9c96-b1118e557b44", "comment": "Malware payload (VIPKeylogger)", "value": "2c71c8fe7e0aa3f157b482b3c0d1090c", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997893, "uuid": "8c601648-bdff-49cb-b799-53d5b52a4cbe", "comment": "Malware payload (VIPKeylogger)", "value": "fd24c1153ae53edff933d0c69346ee6105fa06d7b573bd0c5e8ae2ec2105d193", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997893, "uuid": "c050d68b-cd1e-4c04-8291-e99254d6024d", "comment": "Malware payload (VIPKeylogger)", "value": "a9a25ba02210bc7ffbeb73a0110cd49f8c83c89b", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997893, "uuid": "b78870ce-687e-487b-9977-b6cdf083ec9b", "comment": "Malware payload (VIPKeylogger)", "value": "df425f45897976d7adc908c2abc5d7a8e9d5990218d1a14559d4b34a0f98675ed9f9861a34b008395abe441e37a50588", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997893, "uuid": "04e804be-e709-454e-9773-b32ece9cdd4e", "value": "T1399423041EB46AB88C245305C4ED5D2E7AFB2B93C58BE19901A1B0DF4BEBBD47379984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997893, "uuid": "71f334fc-73ea-4e64-b66f-09e81c3dddae", "value": "12288:vdQTV4MEtl5TW2R5XwrWTlHSOfh3UzbUKf:vyTy7AHrWxyOfyzbUKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776997893, "uuid": "526b7891-aaba-4193-a677-b007a1e77ca7", "value": 416229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776997893, "uuid": "76051a14-fff3-4bd2-8eb0-d445de40cc72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997893, "uuid": "952152bf-e8dc-47c9-a970-c26320148769", "value": "COUNTRY.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f785b9-3f9e-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1777008359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008359, "uuid": "af03573e-c020-4e4c-adca-6c609150b2e9", "comment": "Malware payload (Prometei)", "value": "4a36c0b231f4a7b856c46704eea7c8dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008359, "uuid": "ea72c137-48dc-44f2-853a-5ec69b217980", "comment": "Malware payload (Prometei)", "value": "fd7da0de7b1450e909055543803db11eb485a04bcb93c4088f19652e4ceb8d3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008359, "uuid": "5c39510f-abe9-4c6e-aafd-2ba344ad3438", "comment": "Malware payload (Prometei)", "value": "e029a2e85c711ad84c506469fd56dcf72294234a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777008359, "uuid": "fc1a1fbb-5cca-484d-86e1-1a0ab5c581b2", "comment": "Malware payload (Prometei)", "value": "2c8f874c40dbec3622bc385e1f4780d31dc9106f486b48672393bd3306fd3f9fb4735686e89ec8fea002dd76a678405b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008359, "uuid": "86279e87-59a6-4aad-b15e-da9c83a8ec30", "value": "T15AA423B4F9219E9F6DD769B91B24831DE182C172589D4C2313AE94A34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008359, "uuid": "63de8ee7-f269-45b0-879b-5eeebebd9d5b", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsd5:Fs6pyCC/Ya2hpi6T6N4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777008359, "uuid": "cc348e21-6418-4207-ba7f-6bbeb2705512", "value": 449078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777008359, "uuid": "9563f265-dc73-44ed-98c4-33e0770a6f48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777008359, "uuid": "77e24cd8-fa50-4beb-8725-3c303676251d", "value": "fd7da0de7b1450e909055543803db11eb485a04bcb93c4088f19652e4ceb8d3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c4e3e5-3ffb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777048654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777048654, "uuid": "482c193b-d265-401a-8263-d6b6992445b2", "comment": "Malware payload", "value": "6ff975451579559390ceacd98e93e236", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777048654, "uuid": "abf3daa3-7335-48c8-8ea6-06eb06ac6636", "comment": "Malware payload", "value": "fddbd262dfc5972e0221ad1559a5fc990128a420c342a2fd4d541f069e4859d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777048654, "uuid": "bbcf30d2-d988-4638-bdc6-f10939a6fe00", "comment": "Malware payload", "value": "d15f9b9abdc91568a15de6ed3f5e5a40232e5787", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777048654, "uuid": "0135c65c-8d79-4610-b35f-b388a984e834", "comment": "Malware payload", "value": "9d98c361943cf9db3cfd8a867a657d1a0ff400d05c82d01991e500c919e6c3e4bd98357885d64e969b9d55c505e2f1ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777048654, "uuid": "ac876694-30fd-451b-a702-18cb876520a8", "value": "T1750622672D94F9B9DBB6587FB885C14142683C6082E39977369FF6BA1C33E447722230", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777048654, "uuid": "14c13689-562e-4275-948a-1afa85092034", "value": "9daa199727c7fbea33bad18dbcc04f73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777048654, "uuid": "d78a322c-94bb-401e-9d04-bac033281b0f", "value": "49152:KZZZZZZZZZZZZZZdS7cV5qERM0BtvlXkgpfzsSueLyM85mITBps0/h5hIqSpA3x4:JoVE0rugpoleLHCJjs05DI56B6MSo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777048654, "uuid": "a9a4e097-1cb9-4e34-8784-65cba5645562", "value": 3721736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777048654, "uuid": "b0f72c5e-8d56-46f4-84da-3245eca89c47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777048654, "uuid": "267ef3a5-e7f6-4150-be8b-75655f5eda18", "value": "Sectoral_Compliance_Feedback_Chart.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d7e991-3f7d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776994372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994372, "uuid": "c3da3dfb-b1cf-458f-9ea5-f320bdf8b059", "comment": "Malware payload", "value": "a25de33df266f917158556e6f615d824", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994372, "uuid": "06bd3e1c-44ba-4dd5-8660-aabe3d0467bc", "comment": "Malware payload", "value": "fe5a96c3631ccfbc7c6e3d85d0952094602939569d18c3542ca9a660492dd882", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994372, "uuid": "71705c05-501a-4134-a62f-8948555deec1", "comment": "Malware payload", "value": "c2288c6dd871a562175811f90499def7f890a41d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776994372, "uuid": "773c4f34-928f-4a95-9972-3bebee6a0d57", "comment": "Malware payload", "value": "406bffa1060b9f12488512ffdd8d080d96e5947a502dd24f3f268737a177386e99445a8f4be687915255d4b4f905b6b6", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776994372, "uuid": "a0bf0c70-c945-49f5-8bfd-ff9c1cde20e6", "value": "T12DC08016817EC50E956790924573550885B0EB5525759F319B4098887155490660A042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776994372, "uuid": "188099c8-3d7c-4d0a-87e0-338d5cc04558", "value": "3:j+qAHmFEm8nhcDQBfBJpoNIkVViEaKC5SufyM1KvN+kGEmQHhXpv:j+q9NqhnfBboNBnaZ5SuH1mQPEtL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776994372, "uuid": "41b0ac32-e45f-46a7-b220-989af69584f3", "value": 161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776994372, "uuid": "421fcc5d-ce4b-4e4f-8d8a-aaf034e0441f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776994372, "uuid": "6479453e-efec-4bed-864a-6893039770d5", "value": "WONDER.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49596216-3fc0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777023052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023052, "uuid": "c1039e83-f8aa-424a-a82f-a9e0355c60fb", "comment": "Malware payload", "value": "63040fb168022993a146472cd57559ee", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023052, "uuid": "b621b87d-bc8c-45e4-8632-bdfb72e02458", "comment": "Malware payload", "value": "fe64e3f675bf6aef83a392af0ae8f2e343f6339ac5eecb2ea3bf1d704dff93f7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023052, "uuid": "9cd6a90d-eedc-46fe-9131-3a9ebec7a812", "comment": "Malware payload", "value": "b766acefd68faeb865de999e8d75b981f9795ea9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777023052, "uuid": "7cd43e27-59a4-4d6c-8afb-4e4eb93c365e", "comment": "Malware payload", "value": "08777c5529603622eb46a1618773ea30744872ab6fd2ce7219f76dd08fb5bbab578606740cf6b5afc035840977bddb62", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023052, "uuid": "84129946-4fa1-4e47-a7a0-13791e211631", "value": "T1F175D0A173454663DEA88B3106E38370A7F9352152F3865EE31627280F711AD6E6FDEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023052, "uuid": "6ea27af4-cee7-4de1-8a1d-ef202fc31d36", "value": "24576:TD1HGqhZd4FILjPYubEn206uIOw1Tezen95E+l0ITOZNzrB2x8cvt5YMteGvJI:PZYILjP/Eh6l9CSgSBiNzrBXcvt5Tte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777023052, "uuid": "bcaebc43-67e2-4ff4-a88a-eb25c2efca0b", "value": 1559213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777023052, "uuid": "0619f546-ee13-4d41-8831-7c4c2ff6a750", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777023052, "uuid": "35e1b52a-22a1-4ee3-8916-89faa168eed1", "value": "bot.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa104ecf-4009-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777054567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777054567, "uuid": "645b3845-30a8-4e2e-8e7b-16b8d3694d1f", "comment": "Malware payload", "value": "8573ea80c98bead8d30209bef319329b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777054567, "uuid": "a6cc3606-f912-4237-82e6-8096e2935a40", "comment": "Malware payload", "value": "fec7cd5057b0471f05194fc2587c8e843bd457604e50a18fe7896c493dac1bb2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777054567, "uuid": "efd5a663-1c41-40ae-8fe7-7279d036caed", "comment": "Malware payload", "value": "ab0b3067192ba8c24387c19ee9b13170053dd3d0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777054567, "uuid": "02f05a84-e043-428b-973b-b8ab9c47d17e", "comment": "Malware payload", "value": "8f0e7e162834ada88792c04a6355860546438d4e12fbaf7ceaf2c2e9db72fa02eaf9d787a76cad18b49acc5be0d0bfa9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777054567, "uuid": "3301f0f0-7d18-4ea2-879d-eab9f053674f", "value": "T1BD137D6526913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777054567, "uuid": "ef7921a2-4599-4e9d-9f5f-598424ed6efa", "value": "768:bmvXRWNGxVg9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bqlxrcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777054567, "uuid": "5c8196d7-409d-451c-913a-4b1352a1677c", "value": 45511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777054567, "uuid": "cdd0c224-a820-4573-9808-e3f7b1a399ee", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777054567, "uuid": "4b2d14ca-21f1-4d55-a38e-5a92dbfd697f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a8eaec-3f85-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1776997967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997967, "uuid": "fbb54789-a164-4d44-b936-e44c65c709e6", "comment": "Malware payload (VIPKeylogger)", "value": "e8e71279d74edd1d05f4e169d51c0886", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997967, "uuid": "120f9d92-e73b-4592-8363-af16ecd2732a", "comment": "Malware payload (VIPKeylogger)", "value": "ff33bf31ff1c25085eb3ccad95bbef16b3fe1b48f9389d0d8b25ed568d664735", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997967, "uuid": "06d3f687-acfa-4543-b71e-532c88485eb8", "comment": "Malware payload (VIPKeylogger)", "value": "73119eae9c495e89b8ecfc74fb4ba0a7bc8e80c3", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776997967, "uuid": "e94280cc-5861-40e1-87f2-3be68781ba3d", "comment": "Malware payload (VIPKeylogger)", "value": "a11dcb2f9d51523917b4992da9e151f6c991cea18f12ffdbd7c4768ff444051ac7e008484660240b3b5cf4411f30b517", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997967, "uuid": "648e30bb-a0bc-4b0c-a989-c49608508bb2", "value": "T11994236A0F9887DA0B9D8AFCDAC30E265AB2CD62A9C7C4C131FD85812D7E3C52173575", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997967, "uuid": "711f25f2-4c29-4130-89e7-5c18da16e71a", "value": "6144:PEiKZbFdnQHB5j2VAB5BkaiLA0AZMy+sPzcYgz4vR6V7EQDQoN+8UuRXl3JqNA:0Z5lgjX5makoMy+Oza8JCEU9E83l9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776997967, "uuid": "39628fd6-783b-42a7-b9d7-fc0f9e578ff6", "value": 416969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776997967, "uuid": "4882a8f7-1abe-47b5-9dd4-f459e1e54a36", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776997967, "uuid": "2e2bbdc7-9af6-4c91-b1ed-74ef5c882bdb", "value": "stability.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c9758b-3fc3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1777024383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024383, "uuid": "41ae55c2-6821-4f07-b531-905f8d3b900c", "comment": "Malware payload", "value": "17f74444692e96863927ccf03352f3d8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024383, "uuid": "7359f835-209c-4741-96ef-d7b48a83902c", "comment": "Malware payload", "value": "ff7474ff07efbd71ab36c11f337747e520bbfcac30bcdf4603a78a69b3b827d7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024383, "uuid": "4ca723c2-7e9b-4ad9-9811-bd307c20a9a8", "comment": "Malware payload", "value": "84427835548230e7ba97c5a040a5898e9a207d79", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777024383, "uuid": "3fe0fcf2-1804-4421-ac91-01f3666760d3", "comment": "Malware payload", "value": "85b78c2943f871bce7f1127c47ec5b092da5b5076690428e48beddf34500feb2517a5d08ed0def52599f3006ae8a9916", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024383, "uuid": "8691c71b-76d3-47cf-a6ae-9951e38f89ba", "value": "T1F4C39516AB519FB7C81FCD7305A94A0120CCAD5A12D92B6FB2B0FA5CE36B94F09D3C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024383, "uuid": "01169d9b-18e0-41ae-8957-f8c9c143b4e5", "value": "1536:gEmeT8hSTVuVT/yvNp8xiC7yDHh1SqGZ+01t/8NBpKRuBCjLDKR0h:gEiSYP74hdGg7pE3jSR0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777024383, "uuid": "12383867-cb24-488c-a61e-6bd62c53580c", "value": 122096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777024383, "uuid": "750a765b-cd50-4b7e-84fd-f21294538f06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777024383, "uuid": "8d7680b1-109d-461e-8f13-42a89c957cd0", "value": "MIPSEL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c16a86b-3fb9-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1777020157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1777020157, "uuid": "be014d87-4ced-40f3-a050-5772ce9ac6c3", "comment": "Malware payload (ValleyRAT)", "value": "3b21b2fa4dbc78a8652f12a983642738", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1777020157, "uuid": "8c391fc6-a158-4596-b6b3-7f2c7063b827", "comment": "Malware payload (ValleyRAT)", "value": "ff965cbc39961020fda3eda9aeaf15fe142b729dde4ccbe771bd2b07906366dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1777020157, "uuid": "5a3ad669-06fd-4796-899d-8290b360fd8b", "comment": "Malware payload (ValleyRAT)", "value": "e466ea4886aa04dcb031588df4e5dfa86d3917a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1777020157, "uuid": "3d10d0e5-bf38-452b-8394-6ae462b432ce", "comment": "Malware payload (ValleyRAT)", "value": "26d73c2f8ee7dafa128ed00104c89d5c437eef5b800d18ef8bcc4159ac03e27e1f0ece5656d37c42be5dd18435465d3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1777020157, "uuid": "39a9eb11-2aaf-4540-8c6d-28991852aa40", "value": "T10D85BF23B2CBA83EEC590B3705B2A15594FB6E216426BD1787E4B49CCF351601E3E787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1777020157, "uuid": "b55bd9bf-ad31-4924-8c38-ddb4725a0541", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1777020157, "uuid": "8f198498-3e1e-4ab9-9800-60d65f2a3b15", "value": "24576:faE+hTNrCHtLfTfuM7Djr5QpYrao2rupZdHR0aQzE2/d++HFkPIIE8YCFkU1ioM4:v+MRvHmaiL4+HFPIUukqiR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1777020157, "uuid": "b89eea8b-939a-4cf0-b7af-b592d16bb90a", "value": 1823215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1777020157, "uuid": "622e9257-f11c-4f45-8dab-1e4c0ec13edf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1777020157, "uuid": "6cce9465-bb4a-4905-9fd2-85269c5e85f1", "value": "3B21B2FA4DBC78A8652F12A983642738.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }