{ "Event": { "published": true, "date": "2026-08-05", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-08-05", "timestamp": 1785974582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "0fbde8dc-1fe7-4b28-b4d6-4ecb65862446", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90905162-90a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1785916760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916760, "uuid": "9d589c1f-e390-4496-afc1-debfe372c8f2", "comment": "Malware payload (PhantomStealer)", "value": "12a31c2dffc7a9fce76c78242319a870", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916760, "uuid": "31b76695-f0ad-4429-a1ac-432b2ac7031b", "comment": "Malware payload (PhantomStealer)", "value": "00c2d6838257fbec17aef1bd5eb45baa068c915e6f198f846c30155213b662c2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916760, "uuid": "dd242eac-df05-4a1a-a0ce-2ad928e35147", "comment": "Malware payload (PhantomStealer)", "value": "c09df4b0b52b8d5f8638acccbd9e38061082f75e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916760, "uuid": "7d0546d9-dc10-45bc-a5b1-311fe5df2ee3", "comment": "Malware payload (PhantomStealer)", "value": "1d9cca36a32fd043311f21a1a300e9ccf48f43f46890ed4cf04cc92222b6f7404de59594cfbd1544f7503f9e450840a6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916760, "uuid": "b3565da0-4d34-498e-befa-925bcd77f75c", "value": "T1220619911748E4B27A24AB5D9237CE30AA0FB05351C2DF09316DE3087B59D5FA39CEE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916760, "uuid": "f205c487-08e9-450b-ae0b-b7144f59a31d", "value": "98304:Tpb0yZRiv/qIawilQVKZ8K6ozxs2dAmrDLDrqXrwhagYY1ifHrQdyZIc4YdwK1GR:jbiKGilQsWszpAeLXqXrwhagHwfHriTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785916760, "uuid": "b763384f-c7d3-419e-b4eb-db09c2b5703a", "value": 3657082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785916760, "uuid": "4d35ddff-341c-4b1a-9d8a-2075d4cb1f71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916760, "uuid": "acd6930f-c155-4330-9176-0a44fa29fac4", "value": "Specifications_QU050826.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc377fac-908c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785906955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785906955, "uuid": "f0e9afd9-5fc2-46f9-9d93-03d575c0bceb", "comment": "Malware payload (Mirai)", "value": "e18df4996d455853b22c9b5610d1119d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785906955, "uuid": "d98b76cd-9bf0-4ca7-ace7-9ffe73899460", "comment": "Malware payload (Mirai)", "value": "01216768509f2c3d9040289c14f383d7eac6cd8dcf10b436c8c521faa76d7b94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785906955, "uuid": "4e42177c-2222-4935-9839-71a2bb8b58e3", "comment": "Malware payload (Mirai)", "value": "1fb887dc994036e0e84eb97429b07fa37a87f016", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785906955, "uuid": "ecf05bdd-1746-40d3-ba76-467dd0eaaa38", "comment": "Malware payload (Mirai)", "value": "303a06e43d30286c5ea6bdb00e1755d0cd56066c0a8845f59484af4d03173cdd3508090d313f1ad3fd258bc6e3d8c942", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785906955, "uuid": "4828984b-c74b-462f-b6ab-2e9fac70d754", "value": "T1A4C3390675A244FCC156C434C77FE927EA31785E13343A6F6B84BA712E22E751F0AB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785906955, "uuid": "567f9a0e-0eb9-459c-9310-ba9b6efc37d0", "value": "3072:FlDzMVgEj1UVGyxWrBsL4Jrpg3j5CqG4KX:Fl/BiyGEWrBsMJr2VCq8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785906955, "uuid": "98ec38ea-cd3f-40db-8715-42af06c03d1e", "value": 128904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785906955, "uuid": "dac93b4d-87a3-4814-9ff1-8456f8f1d86f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785906955, "uuid": "92750449-d34f-4dfa-8a70-227a6b47f96b", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00bf45e6-90f3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785950878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950878, "uuid": "9f4b8668-69c7-4875-b99f-84d8e2af5b79", "comment": "Malware payload (Mirai)", "value": "9d561b7795e92725f532497a59c308b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950878, "uuid": "5f054bb5-d1a9-4231-8d11-7c48841764e3", "comment": "Malware payload (Mirai)", "value": "01dc4719944a22b0d4fc55112ed7d7366ea82773ffa178bedf472b3d66d8b3b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950878, "uuid": "39881fb8-a0e4-4075-a1cd-8c9979d6af14", "comment": "Malware payload (Mirai)", "value": "cccc11d012e1055ed1b2f60a8631ef1845dcb91c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950878, "uuid": "66a540db-0a4d-4fb7-9f3a-0905f729550a", "comment": "Malware payload (Mirai)", "value": "8fd9e4db8b75415a94521272de33f4c9b41cd6e557baac35d1d1bff558780df6522d2a7a25a68bf9973edb44341d973e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950878, "uuid": "0194c86e-88af-42db-8c40-876ed1e97bd1", "value": "T141231803B98080FCC499C2B4077BB67ED57375BE0239B2EA7BD4FE166986E220E5D505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950878, "uuid": "c290ac3b-5ed1-4ce3-bf8b-ce777e29e311", "value": "768:iTZRxyDuMtbB1yaMg/Iq53toN22bT5W/FWgXmtZ3u0VFDzk:4xKnbB1yaCq53qU2bT5WtMtZ3Nzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785950878, "uuid": "b7e063c4-5517-485e-9e33-da91957ba82e", "value": 46752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785950878, "uuid": "466e3052-fd7f-4b6f-b311-c1894b6965d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950878, "uuid": "5faa7508-54ee-4518-b7eb-676f2800d464", "value": "01dc4719944a22b0d4fc55112ed7d7366ea82773ffa178bedf472b3d66d8b3b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b6129a-90a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1785916869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916869, "uuid": "e10fe647-3c7e-4c83-b59f-90bac251f084", "comment": "Malware payload (GuLoader)", "value": "e1f5f3bd3d2d06ec9c7070ef87868c9a", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916869, "uuid": "21fd6959-3e06-4c4d-8b75-882b0d785169", "comment": "Malware payload (GuLoader)", "value": "034079b6594e0a5bb3850326cb7d3bfb25ba8f5a8221a7294cc5607edcfea93e", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916869, "uuid": "e574c750-6f4f-4f5f-a2f4-3b28abfb3f85", "comment": "Malware payload (GuLoader)", "value": "29782fddeec94f97bc3d40b379679c5e4f52ebf5", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916869, "uuid": "3a1cacba-3ccf-4bce-94e7-be29423e275f", "comment": "Malware payload (GuLoader)", "value": "41c9109bc52324141658688641cfcf562be0b25dd47d1d917800327c035a98266df1bc439fdd87ef432fd2984552ad66", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916869, "uuid": "892ae72f-da72-44df-af25-64b2d99084f6", "value": "T1B3453B20DD2406694E1B17ADFCA60B62CEBC861D522794F5F6DE030D62064FCE3BE66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916869, "uuid": "2c90d023-380c-40a4-988e-e3f1ae252f99", "value": "24576:gtmFBr6Jt9dq8raf7aAlrZJtQhu80guyJ21kvr:omFBr6Jt9dq8raf7aAlrZJtQhu80guyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785916869, "uuid": "7d89b904-291b-407d-bb04-1fc9ac71b78a", "value": 1174714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785916869, "uuid": "0f5e86d7-8cda-4ee1-9221-111cbd6b7e77", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916869, "uuid": "3dda7951-ee0d-4262-8299-8bd6665d065e", "value": "Payment Advice 05082026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce892aab-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785917723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917723, "uuid": "f1872243-530d-48db-9011-31fc9f73bc0a", "comment": "Malware payload (PureLogsStealer)", "value": "d694add0e359ccf88cd783a8fbfda282", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917723, "uuid": "e47a701f-f401-41f7-9e47-0e2ba043a471", "comment": "Malware payload (PureLogsStealer)", "value": "03fb65c5f63b5cb6b36f083152c98321905d300b0653a863932a6574d016de26", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917723, "uuid": "e998db0e-fee7-4e54-8d86-3f245fb01860", "comment": "Malware payload (PureLogsStealer)", "value": "4fae361742a7e9fffb1b2faec6b3f9b8c5f7839b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917723, "uuid": "2deba3f7-c24f-4534-9c09-bc03bbd66db9", "comment": "Malware payload (PureLogsStealer)", "value": "b09428f7644d9dd9b4199746fa5e6b8c496b655a35b46b5ac78bd8f6cb3f65b82fb0c43d7263fa80ecebd08d9566f9c5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917723, "uuid": "d39a3cd0-de93-4d2e-91be-984a4cbb03b8", "value": "T14FD54F7A8A3B291765F818ACAD4752C12FD52C58D063D8B790AC5B2320DB9EDEDD3037", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917723, "uuid": "7a7f65c0-affe-46e2-b767-7d42b4eff9f7", "value": "24576:CeZQW6KLpBEILToyKz2tv6n3heGle06jRdZJ4AW6n4OSn5OOCHvfa/y5srmLlUy7:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917723, "uuid": "d3f006ea-9cbe-4032-9110-0e419357f931", "value": 2867576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917723, "uuid": "d7cef624-c4dd-43d3-9c28-fc96c436ebca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917723, "uuid": "5a399363-8c04-4865-9fd0-c349a4c8f715", "value": "AccountStatement_48202617552.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97363035-909c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785913765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913765, "uuid": "66da1f7e-e29f-403c-9152-f3b18eb928c3", "comment": "Malware payload (Mirai)", "value": "737836fff599e2cbafb730afe1a8f0ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913765, "uuid": "d7660035-3ad0-4501-a1a1-2ec1ea45bdfa", "comment": "Malware payload (Mirai)", "value": "0426d6a2175e79cdae14597f6a69284c0e9f8ba932aaa413197d951771426c03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913765, "uuid": "a7d731af-9d0b-4d84-a582-23c9927b4d92", "comment": "Malware payload (Mirai)", "value": "ed778bd3d3fcec0ebd3fed693bc26386e42e6e02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913765, "uuid": "53844f48-05b1-483c-836e-605a38207700", "comment": "Malware payload (Mirai)", "value": "1be5b640db39fd66603437350c3c92623614229d9431e446253621624599dc440d4d2dcd1416190c0bb4eaa43cc8eb39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913765, "uuid": "d83588c6-8a41-473f-957c-1569efce7227", "value": "T110A3C71E2E209F7CF2A9823587F74E70979D23D127E2C684D1ACD5002E7434EA95F7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913765, "uuid": "c5e1a56b-40d5-475c-8915-da71f4b157b2", "value": "1536:sUbSIBc5MT5n1BSi8Jg0A887gEXVCr2ZYSKjZO5J6v0E7aBzjDDcn:nLT5n1BSiMI7JXVOFdP0E7atcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785913765, "uuid": "b3cb3894-d10d-425b-8892-5ee3acbd061a", "value": 105152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785913765, "uuid": "5fdbc30f-83c4-4f54-b15a-0b6efb6e8c02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913765, "uuid": "30dac602-f207-472a-8d12-25d41ac7c8f3", "value": "Le1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d2ff623-9108-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785960053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785960053, "uuid": "e8aead89-53a2-4546-8cfe-9c6e31e15b52", "comment": "Malware payload", "value": "f5b764ff33d05d98548bac8e19e9a565", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785960053, "uuid": "925e0c24-8a5f-4a7a-bfd9-0eb7e328b307", "comment": "Malware payload", "value": "042c70369a491770cd5795b024d67a3ea2bd851f32dc47bfd96440c57d0498e6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785960053, "uuid": "86dc5af1-38a5-4733-8364-1719be1e8561", "comment": "Malware payload", "value": "511c45502b01144efe3b76db73eb45400268dd58", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785960053, "uuid": "94eb003d-7574-4d70-a8a3-b0310fcb8440", "comment": "Malware payload", "value": "62b0b3dd70972906126789fa4ce28566b9615a33b934d832d9b83cb83e9d274bde579c16dab51f211918d3ca625c148a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785960053, "uuid": "fd006d21-8394-4ccc-9ac2-4fe4f37222e1", "value": "T127236D651A857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCB3CF28C5AA9D910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785960053, "uuid": "fd344d8e-8e95-4ca8-b4d9-eca4afb9bc4d", "value": "768:SZXRWNGxV39GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:SzlxGcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785960053, "uuid": "c67ea93d-5669-45c9-bb75-e1db06b9ff5d", "value": 50071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785960053, "uuid": "88df3fa7-fca5-4aec-ab92-6e86223c19ab", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785960053, "uuid": "7243da4c-747a-484f-a3e8-02b03661f741", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3ca48f-909c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785913751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913751, "uuid": "349efe11-a173-46fd-a6f7-d0bdd6257875", "comment": "Malware payload (Mirai)", "value": "81aa698060c0486e9f96d6cfa3296847", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913751, "uuid": "b9405050-ea13-4b4a-8977-fdca77268474", "comment": "Malware payload (Mirai)", "value": "0461f91f0a48757234668f5b908b2c25d9c43035288ea40a0c68c90339a47710", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913751, "uuid": "e3e5c940-633e-42c4-ac16-6ab107d8a250", "comment": "Malware payload (Mirai)", "value": "d73c74871e89069ee9b4dadaf6d0dd3b63fa1949", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913751, "uuid": "65b1aee0-0d24-4cfb-9446-85927ea979c8", "comment": "Malware payload (Mirai)", "value": "b08c0048e4f35290a9fa70196bbcdf99dafec58aa478b6feacf6087cd728f22156c220b4dca3871c5a578165332ea8f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913751, "uuid": "b81afac2-71bb-433d-8ece-fc2ea0781959", "value": "T16C142A83B905DEF6F40EAB7204D30B257231BB660A531A32B31779799E3A2C4346BF45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913751, "uuid": "04217353-1b36-416e-9a43-b49eef8d5259", "value": "3072:Sv2o47RMQwkXyZ4O6nnge8zG+ofaJBwxL/rNeFFrzv6BG7oxXkm2CLf5QwD:c/4weyZ16nngxG++LQFFrzv6BG7oxXkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785913751, "uuid": "19607ba4-9206-4449-bdbb-5fa34713dce6", "value": 191618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785913751, "uuid": "676808e4-f280-4c5f-8488-0aa0c049b43f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913751, "uuid": "100c797d-8803-42df-81e0-e23f3e6d9073", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d78008a-90a6-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785917829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917829, "uuid": "7df52a43-6690-493a-8f00-0a96b8f833cc", "comment": "Malware payload (ConnectWise)", "value": "8d8c0cd35a6e8ebd0065772953ed75fe", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917829, "uuid": "3556b00c-009c-4a4e-bc4d-177fbdcd0927", "comment": "Malware payload (ConnectWise)", "value": "0479d02c1da620602459275de6ffc89e56fbb4db2a84969d56a2544f83f9322b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917829, "uuid": "ee9cb0d5-38f9-46e4-9ce5-b3e4e05f8e9f", "comment": "Malware payload (ConnectWise)", "value": "960bce45bddd5adc7a76d70b86ce13ae0033c48f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917829, "uuid": "269f259a-99bf-4bfd-8fe4-1c922c4dec55", "comment": "Malware payload (ConnectWise)", "value": "dfb4be83e608c7898190483ea43795b2fe5ce55fa7476b65a73a95b5c5a642ff6eb80ed06093aecc7dddff2983e9ba98", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917829, "uuid": "d96d66aa-476b-464b-b2c7-377522919595", "value": "T11552363DEDB1FDC8035FB1E0AA883F4151891BA3A779472CE8DAC4D54854E88EF3A558", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917829, "uuid": "aae69d11-28e6-4159-a817-4b4130adc030", "value": "384:Gs3CX8KhRUkSMPIoWvZC8Rw6GvtglLeVBRHLB6HJlDAMMAh6R1K:Gs39gRURMPIXATPLB6HJtA/e62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917829, "uuid": "8d181e8e-db99-470f-af46-804b7b54de61", "value": 14307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917829, "uuid": "54508138-973a-46db-83db-095e6dd9201f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917829, "uuid": "2c8e070c-c8e2-4c63-86ad-dbacd2a835ba", "value": "spacetek (3).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158b3394-9069-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785891643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785891643, "uuid": "71238d95-dabe-4d59-89bc-4ab71b7786c7", "comment": "Malware payload (Mirai)", "value": "50ddff0b1f7eeb59e02d8529abef038a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785891643, "uuid": "17fe8460-5f9a-4a6e-95ae-6be691c4d9c4", "comment": "Malware payload (Mirai)", "value": "053076456278fcab8a1820126d590986170a08754eb301dbaff9b8184bedc2fb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785891643, "uuid": "feb30d2f-762d-4e24-a110-f86de2eed923", "comment": "Malware payload (Mirai)", "value": "140aea5ae9b428f585992d9d7eec25cfaea620f8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785891643, "uuid": "25619413-d09f-4860-915e-843f1639d2ee", "comment": "Malware payload (Mirai)", "value": "db7b41a1db2a7276bf16aef7c8f413d3ce5d46f40caf29f1c7660cfb96e5665a358d914294b35a244c4ec511ce3ded09", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785891643, "uuid": "503556e6-4b16-4fd6-a1a2-4686f3039c29", "value": "T12C014CD98550AD1090699A5966E75290F410C3CF0A9A0BB87FDC593DFB88914B026F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785891643, "uuid": "de9a3476-b793-4f53-9387-d8cc3b18a447", "value": "24:kXCKysE2hi0ziQvZoha1M1pN6gP1ffntk57N7:e9Qp+Mse16gP1ffnO57N7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785891643, "uuid": "32afdb6b-7239-446d-9670-535c010f7587", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785891643, "uuid": "25fb3a53-7c32-4fde-ab7a-2bf997b9a79e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785891643, "uuid": "cefa405e-75f6-4044-ba9e-6db6337d667e", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8cb953-90ce-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785935218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785935218, "uuid": "21b10148-1697-4d3c-a950-7b61f225d788", "comment": "Malware payload (Mirai)", "value": "a348c0b82aaef44886588d77de7cfafb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785935218, "uuid": "00ea5e0c-41aa-4af9-8df8-3b2fda630faa", "comment": "Malware payload (Mirai)", "value": "054e7e233444263351f4e6f3d458452bb706d7b1b386b90d97b17ad921b4d129", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785935218, "uuid": "a8919c14-aa7b-4920-b173-7bee39dc96c9", "comment": "Malware payload (Mirai)", "value": "547b29a74941857c75be95f00c87838993b740ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785935218, "uuid": "aa6d1e43-f525-45ee-ada8-be6573d57f54", "comment": "Malware payload (Mirai)", "value": "8b2952aea48f8de7496125dab05f08f8dbf8b2401f1f799f331c91d9d99150eaee65ac9053cc49055d22754754e492f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785935218, "uuid": "62960ca0-20f5-4de6-ab2a-d7b695499ae8", "value": "T1C1261997B8918683C0E4367ABCBD81C433672EB99B9712576D05FE3D3ABE1990E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785935218, "uuid": "17406aee-da6f-4870-ad50-c37654535a69", "value": "49152:Kkp3DjDc+m0NbKKQqGOwYOxVmxllglPU1F1:dp33w+tNbKKbGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785935218, "uuid": "6bec38c8-244a-408b-958e-6b33f27b99cf", "value": 4521984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785935218, "uuid": "3502d485-d214-41a2-8c3a-3ae6d48b546b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785935218, "uuid": "6d952f7e-26e1-4b58-90af-1c03e723f997", "value": "android_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221f6e6f-910e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785962531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785962531, "uuid": "a4d83f86-9b1d-43ed-8bd7-ba026488bee9", "comment": "Malware payload", "value": "be9bc966e9e7feb9a2d56869683cd71c", "object_relation": "md5", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785962531, "uuid": "335f2067-f0c2-4a1d-95af-449b2fe4012c", "comment": "Malware payload", "value": "05f9271f2618d599d2e263d8f4aa761a77ed1178369ba59403a72b412ceb10bc", "object_relation": "sha256", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785962531, "uuid": "24748648-7b30-4a78-92d1-03f3ed691964", "comment": "Malware payload", "value": "ea3902ee3b17552b713b95f4d7450ccaf338849f", "object_relation": "sha1", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785962531, "uuid": "6e90d25b-e52e-43ad-9585-f50e11a25ba1", "comment": "Malware payload", "value": "3f3d0b81402a151d31c975f30c04f44de95e872c757288813d2e4ff92dac8d0372af577b1c34ca9092ca1f7d884e1436", "object_relation": "sha3-384", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785962531, "uuid": "c46ee3b5-0384-467d-a25a-274619646090", "value": "T11BD52395B9F21AB4D837C7B68F93F02CB02A3B5597B18D5BF68CA8500E53104993737A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785962531, "uuid": "d0022315-9991-4c61-a85b-94f2e9558265", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785962531, "uuid": "c93f8856-b7ea-4ca6-a41a-afac4f84025b", "value": "49152:Vbz6aLOg/gk/oLWlHhBr4y/NZiKYKrvh62KUAVh9PxuL99npM0W:VWfg/f0cB1XbvVKzVNurnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785962531, "uuid": "cc612b74-d7b8-470d-80c9-84850f1fec9d", "value": 2924032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785962531, "uuid": "393ba51e-6e32-4f60-96b6-a0737f19dc38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785962531, "uuid": "0fb76b58-0e2d-4242-b901-f4310243fe32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d206b1-90cc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785934462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934462, "uuid": "075d4452-bf60-4820-bc60-021c73196e22", "comment": "Malware payload", "value": "3f6e537d2fb816653194dc954afd4bf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934462, "uuid": "1c9032d6-057d-409c-9905-517037538f58", "comment": "Malware payload", "value": "06502a3400a2a5c97da7bb4562a004ed638bdf12438978c40fadd6dad66ed227", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934462, "uuid": "fb394b8f-eff7-4417-a632-46349c4ba996", "comment": "Malware payload", "value": "1f0c0d9e65720d0156fa5a2f7b560ae4b8cd0243", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934462, "uuid": "44a6a825-1b41-434e-875f-c73554281509", "comment": "Malware payload", "value": "7d204f7f1a64cfc3cf4a02c56dbb95fbd1915b32bb138dfb8be528f913105308a4186d959817aa3b8396040b9f3760a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934462, "uuid": "3db6fc7b-1d9e-4ee8-acbc-21c323f8b73f", "value": "T12EE5239DBA963671E032C3FB43A361FDB12D7B418BA59D4D3AD85B206D124287D3B309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934462, "uuid": "e35fa4c9-f11d-4390-af7b-7d4e6705564e", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934462, "uuid": "350bec0e-22ed-4654-aa83-00c8e8af352a", "value": "49152:4ASbLReq4DkUcU65BHiIClj22Rai6O2JGA0AuIPURcl2j1:9SXRe2Uc151iIY2Bix2JG2cuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785934462, "uuid": "4da4376d-2f55-4aec-aec6-ccba794a469f", "value": 3060736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785934462, "uuid": "f800335d-be2d-490d-aa7c-e1010918f8d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934462, "uuid": "ca4ef994-1dc3-4fe3-b1e6-94f88cef0cbd", "value": "gM9anpOuZNKX8zHj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b7615f-90dd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785941565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785941565, "uuid": "b4f254a4-16fa-4706-9505-9130f907e29d", "comment": "Malware payload", "value": "d123da2b9b9b996ba3b79ffd0414b9c9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785941565, "uuid": "e4fed1b1-96f9-41f1-a5ef-b555100f2abc", "comment": "Malware payload", "value": "06eb3a1ba16a1fc9a22379c9b20cbb657b0a7e58d53ed0c6d9ed6ec5bb865f5e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785941565, "uuid": "02a0da1f-dc9e-409e-a797-6d617c4e2a11", "comment": "Malware payload", "value": "6b88f6ddb5898037dd45bea020383b09f55faf61", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785941565, "uuid": "ec057b91-eb84-4254-895c-8f099b747121", "comment": "Malware payload", "value": "ca8c3bcb5ff50a4da6465b6eeafb9b1bd134baaedb170f796f60e1d49a7402a37b9ad0eb1c09d72e0857ebb5d6bba931", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785941565, "uuid": "5a500507-9cda-4607-a0de-031e0f0f4554", "value": "T1BCC27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785941565, "uuid": "857281e4-a04a-47a3-810d-401b2657a70d", "value": "768:h8vCB+25j6es8Rmo9FYpMSUpi+20qUpi+20YQX:h8l25JVd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785941565, "uuid": "0f7fb2cb-6350-4d26-9adf-efe76343e5a8", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785941565, "uuid": "f5ea2513-603a-4f7e-98a0-0d50ebcfa820", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785941565, "uuid": "81c77f52-fe56-4af5-973f-9da1857b6609", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7822a4-90a6-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785917825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917825, "uuid": "e0cbca24-f18a-41a3-afae-38ea71264a70", "comment": "Malware payload (XWorm)", "value": "ba62a1ba30511c91ee7e11930ae1e91b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917825, "uuid": "af0affd2-6abf-4668-a8da-7dcdb43fa1db", "comment": "Malware payload (XWorm)", "value": "077b2384cd5392b0cdb2be3505b2a314e1553194d9f2295fb38bb757abb786b1", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917825, "uuid": "3e238735-3e5f-419f-8108-41ea346ce81c", "comment": "Malware payload (XWorm)", "value": "c252409f6eb94e91415e1cc5961c0404d2dfacf9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917825, "uuid": "7e4b07d1-a1c8-49be-9c5e-c8efdcec7014", "comment": "Malware payload (XWorm)", "value": "d4fcab5e46a72939a3ac32984ea534d4f6fe3e0b870b0d698931531dbccc883ecc4ff7b83b1438c4d7ac55ebb97d5310", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917825, "uuid": "8ca01f45-8794-4fa7-88b0-8641c700d217", "value": "T179253DCD100644BF28443646EA49CAD8FECDBAB2D56D538F5861E9E04853C0AFBB3D9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917825, "uuid": "180c6005-5fc0-42be-a47c-b9377ad911ab", "value": "768:Es1pH8RQOddlq6VWMfYZs46oW3TpEk6d2/5b1gtnN6cKEs6c7f6+63N3OqA1JF7r:RnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917825, "uuid": "48f61443-ccb4-4a8f-a68f-a7128e836856", "value": 981883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917825, "uuid": "3da8c83c-4e70-4b7c-bf95-a7c9ddb2bd8c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917825, "uuid": "a2322b21-841d-4beb-bda3-da618ca57d15", "value": "Orden de compra_039374_IMG.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922fe526-90d8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785939526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939526, "uuid": "8b344e01-0e87-44bd-a853-0bcf1599b7ec", "comment": "Malware payload", "value": "f84dde71b1d650a7b7d55fd6317c9bef", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939526, "uuid": "11a0b86a-4644-4683-9187-1d6eebf4d7e0", "comment": "Malware payload", "value": "07cbd18476d66547ec9b707f76ca9726bed43a3825def6862337c832cd1736b9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939526, "uuid": "4a05ec34-079b-46c2-bc23-804d0cf00c7c", "comment": "Malware payload", "value": "562272df465e106f89cc1d7abf501eeec954fab0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939526, "uuid": "fbceb07e-5f79-4378-8a99-debd91fdc0cf", "comment": "Malware payload", "value": "efdbaa57184ed8e3eb8c461ede68f7f978d48da91012d5d9891badce868e7c9997626b79e8db72c3fd04f571e56c7f52", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939526, "uuid": "53ae7ee4-dc33-4dcc-97b4-8b0ab6d8000a", "value": "T1F03164FF02119B161901CE0BB3B5154E6204C99F2E97F7F8ED8C2D6A93CA21C316EA57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939526, "uuid": "433527b4-6d7e-4659-b4ba-d0dc94ba6431", "value": "24:+YoBvzgBKAZRxtEnLJMeF3rMeFxLFN1Fjxsm1:+YocKAn6JfhrfvZ71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785939526, "uuid": "84673426-9f3c-41a9-8c50-37c2e181de14", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785939526, "uuid": "b1d58b10-04a7-4aac-8fae-388f9cd06500", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939526, "uuid": "487718b7-1fdc-406a-914d-c003a3157b27", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "406782ae-9104-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785958287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785958287, "uuid": "de812da9-e75e-4124-a658-fcaf93b6308d", "comment": "Malware payload", "value": "9119f485acf3d6db58d91fb87d386291", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785958287, "uuid": "f3ebea62-9f7d-493d-8b6f-c6f4416b6fb8", "comment": "Malware payload", "value": "07cf1a068aa2b72f96636f917f0be99743fae229d05a7728c9b009d6889a7f93", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785958287, "uuid": "c2ade441-ed7b-413e-9cbc-ddbe0a9b9436", "comment": "Malware payload", "value": "a6521ed78cb510221f0505160c267d6abfba9696", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785958287, "uuid": "68ce1c71-62ac-4088-9798-6ed4466b66e3", "comment": "Malware payload", "value": "ba8722c0bfab1cd119da7c901a16659ff56811e1a56360cfc4a22f62950c4debe0d0d8138167d3b7e5f0ea089cc234f0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785958287, "uuid": "0465fb76-36cc-44a6-aa91-6597ca165d14", "value": "T134235C6516857C24AE98C8361C7E2F0CB9AD43E6324452EE7FCB3CF68C4A6ADD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785958287, "uuid": "a6a18a5b-1cee-464c-b4ea-74252c77c8f8", "value": "768:o5+h6+9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Q+h6rcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785958287, "uuid": "eecde32a-a119-42d3-87c3-166de1655aab", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785958287, "uuid": "10998618-3fb2-4de1-8f3e-52402d8b791a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785958287, "uuid": "54f826e9-59b3-4b70-9259-b4739ad96577", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60e8120-90cc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785934459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934459, "uuid": "b44ec520-69b8-4229-871d-1091785208f2", "comment": "Malware payload", "value": "8b830ece1d84d99960f3eb35902c99be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934459, "uuid": "4f86d63b-8d0e-496a-b927-d98cee817c36", "comment": "Malware payload", "value": "089062de86630a783993b9a7f98e99f698331c85ff90dbd80b4aa425ade8f010", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934459, "uuid": "cf9e9e96-f6c8-4e0a-8bfc-7695943235ca", "comment": "Malware payload", "value": "85f69077b8ae017c68d421355c255469e9e21a91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934459, "uuid": "003b6a7d-70c4-44f6-a720-0d1777e3e252", "comment": "Malware payload", "value": "a9677c247b6f7b299703150ee811bce907d4d45d78826fd2dada6109e66620c66f411f148c21c92f0c72b46e14b1440e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934459, "uuid": "38f74e96-cac4-4108-b5f2-f37630ba05e9", "value": "T17DD5239ABCF619B4D833C7B69EC3F4BDB16A330546728C5B39CD28008D529942D7A739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934459, "uuid": "56f05b3f-6bdb-4601-9cad-2edf2093930f", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934459, "uuid": "ee211331-382a-4ce2-aaf8-bf03521a8171", "value": "49152:I46mlr6zs3FsVpnynH5u1A/pJ3CpgWd7C9qFnCJ3OWLGSCaPLhVt4iX0/+inJW:rlrL3iVpn+hJTWxEJ3OkCQVthqnJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785934459, "uuid": "e59280e6-9501-4010-bc88-6c26026dbf9d", "value": 2995200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785934459, "uuid": "e9b36f6b-05c2-4078-b2c9-79db53661a40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934459, "uuid": "70409c8c-8729-42e5-b1ae-8adaf7e57aa1", "value": "9z7BGnRGpgs8cZv7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928716cc-90a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785917193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917193, "uuid": "b90a4b09-111f-4d10-8ce9-c06df90cddcf", "comment": "Malware payload (RemcosRAT)", "value": "e930b736781d11e6959150d9e042fc30", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917193, "uuid": "c97d541f-e07c-4d95-9f31-b93ccbec23cc", "comment": "Malware payload (RemcosRAT)", "value": "0905b5f0eb7cda08fce5510efb18077376104f26d746f966905d4de109cc3fc6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917193, "uuid": "b92c1b77-658d-469a-8376-2109b84e4981", "comment": "Malware payload (RemcosRAT)", "value": "0f5e5010d3c158f6b0599aeaa6e7542d8c7319f0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917193, "uuid": "0818a0dd-969b-46e0-952c-98d4555fe7ea", "comment": "Malware payload (RemcosRAT)", "value": "6fe60b4554b40cf98cbd57f5077fb9ee35d2950cbc3459207a43d73d1feb651ced92ac784a5b3a5049f7ad304b5eb6df", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917193, "uuid": "360a0711-0eb1-40f8-8e27-39e539a1c0a1", "value": "T11835CBDF6BE33A4C2408B71A89F9BD9C1446CC910852A07ABFB41BDAC51D7416F8D7A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917193, "uuid": "7d87ea02-ccbc-4f83-93cd-2071bfec620c", "value": "3072:cm4bkFIl9wXJWlUmJWvTrtUtdvx6VXn6B+KBhks0OTF:xEWbrQ2648kc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917193, "uuid": "a2be9bdd-9876-44bb-8665-6999d5b539bc", "value": 1059215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917193, "uuid": "e8bf310f-464d-439e-84bc-1cc1fbb604ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917193, "uuid": "0a5eda76-3ff3-4136-a7ce-fa4036a69a30", "value": "Purchase Order PO K 01774_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99a901c-908e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785907917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785907917, "uuid": "be4b66c8-62c5-4cea-8a3a-6354ea325bb2", "comment": "Malware payload", "value": "849cdfdd3b585706243a3b89682ce9b7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785907917, "uuid": "4fb38177-ad83-4ce0-bd5d-625aa519e7dd", "comment": "Malware payload", "value": "09150c0c08bd34c1c0cc573a6dcb7ed1ee2201879ff701753d531860317693db", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785907917, "uuid": "440718ff-049e-46dd-9bf7-9da35e78e379", "comment": "Malware payload", "value": "8d7bb37ae411f9433c78f92a1d911329deef3ad5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785907917, "uuid": "98347877-b44b-4c0e-823d-51a54921f99f", "comment": "Malware payload", "value": "3fcbf391142202ab70cf90b32834fb386e7f31248f8d084ca546edd9d86394771acd0ba4960b06c2ab57a6bd305b4481", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785907917, "uuid": "907eb979-9226-481b-a9b0-fc05695c5a5d", "value": "T18E74AFC43371C59D006AD0BCB61717BE748B7A30204695687BADFDD7BEA80F99AE0271", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785907917, "uuid": "341306d4-336f-4cba-a058-ae6b44719c76", "value": "6144:BEoIBVP7t37KRTYAubfJkpnoFGLWK5vK2UtOnbLTz+DMYVyU3VmMb:BvIBTWTxofiFr5i29igYVvmMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785907917, "uuid": "19ebaa19-34a2-4958-a074-bd7955f6d1d9", "value": 345916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785907917, "uuid": "499a31dc-242f-4ced-a6dc-da3308e41f98", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785907917, "uuid": "0a701118-de07-416a-b67a-405f1e0ccc41", "value": "Zahlungsbeleg 20260804.PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0461195f-90f3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785950885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950885, "uuid": "d8154306-75a7-4b75-b8cf-0d552a4e22cf", "comment": "Malware payload", "value": "8333c17a2a78e8cc339dbbd90c676a38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950885, "uuid": "3c11af9a-43ba-43fb-83dd-a5d5ddb0a4c2", "comment": "Malware payload", "value": "094d8fb7297e96f9a2e0a594f51ea9e3b938eaf6a96bcd3a86170898b8da67e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950885, "uuid": "317b55ff-ad2d-42f6-a593-d14696a774f8", "comment": "Malware payload", "value": "24cae4f96a7b78277297cb720aaee85dd2f63b78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950885, "uuid": "64cea8ab-4959-4d8c-b9f8-7e95e0e88124", "comment": "Malware payload", "value": "cbf6fe7bc375dd3b050f561822b251ceff713ed9be1c6d782ff8f95c184b1adba586e089772e808f9abe25db1076fc3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950885, "uuid": "b60e0dac-17af-46f5-9052-629a70ac3a95", "value": "T17057CF7792067CEDE9B98CB4D01025816DA878875778E3C7BAC470E666EB6D08D3DB30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950885, "uuid": "06c2c13f-17d8-4b0a-a29c-54410f4d9d16", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQh:cqYUQuVDt0TZEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785950885, "uuid": "c141ea9c-e1bc-426c-9c3a-b591dda3f456", "value": 28180480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785950885, "uuid": "d70ec72c-ae98-49ca-8a1f-57dc97b96639", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950885, "uuid": "e505eef9-aa5e-43c1-9c7a-ea7f1bab74da", "value": "094d8fb7297e96f9a2e0a594f51ea9e3b938eaf6a96bcd3a86170898b8da67e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240ee2de-90de-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785941918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785941918, "uuid": "821055d2-5dc3-4d1e-9fed-66c40f374637", "comment": "Malware payload (SalatStealer)", "value": "2ff3e2a96a20772249ffc827a06aeedf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785941918, "uuid": "ac924441-a061-4cd1-8c6a-f5799e6d7eea", "comment": "Malware payload (SalatStealer)", "value": "09a5ac4d28d4da76d8bb7ade1cb1707ab8c89b4cfec85b50e5de172cfb408ff4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785941918, "uuid": "44d9cf9a-b214-4cc8-97b9-1f20d3fbadad", "comment": "Malware payload (SalatStealer)", "value": "9f24ce3e3ba051bf33a69e45d97f139d2fe591e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785941918, "uuid": "e64d0ca4-e45f-4b51-aead-4a6705a5d99d", "comment": "Malware payload (SalatStealer)", "value": "4f88a9736498ae961da2ef31ec9a499ca2acbc487dcd38182c5eaa16c287a771be38be10792e02fd0198b4a40bb5eb9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785941918, "uuid": "0172129b-49b4-4d32-8079-2962a931d1d2", "value": "T1A4C65C11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6BF877691186A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785941918, "uuid": "7e506d0e-f4ad-4d95-bac1-92c3e9d05250", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785941918, "uuid": "ff974cd9-4852-4a57-a0a5-517e728356f2", "value": "98304:aGsqTIVri2C3jGdD4/Lowr4i3HVd7EqO/:fTx3jUDstrTeqO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785941918, "uuid": "1c26c998-a7ff-414b-bd47-de0207c04229", "value": 12570112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785941918, "uuid": "635d10ed-2bb5-48af-a6f5-01172c0a83cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785941918, "uuid": "9a5fb8e9-fbac-46e9-937d-7035d84c739e", "value": "90343ace902ceacf427956a7ce2986dd0e8d3caaf7a7e5e3e0d5534f6c65043b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f38a6e47-90d3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785937542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937542, "uuid": "6240bc2a-ffaa-4dfa-afdb-33f444685714", "comment": "Malware payload", "value": "2317dfc356f832a38b8a594d4444760f", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937542, "uuid": "a7155542-c49f-40be-a686-dfd7d5d9a269", "comment": "Malware payload", "value": "0a94b36daa940e3fca91536da93dd53186b7c9a5af35c95c626b31e57047be83", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937542, "uuid": "ff40c105-385c-40d0-9d8c-8ac12eaefb10", "comment": "Malware payload", "value": "fc8d59efaf41ee147b1181f1b9756fd5fa785160", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937542, "uuid": "b8181b87-e8c7-44bf-9d6e-331a2bd97ef5", "comment": "Malware payload", "value": "082012122431971f67aa58873c17add04ac0df90a5467e13b5807a1899e587a8fcb8a7be5febf4b1cf2f9b216f7b9d5a", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937542, "uuid": "945ddfde-344b-41dc-9422-ce9ce9154db4", "value": "T16F51382967E40105F9F34BBBE9FEF40278B0BD99A401D9895186910C44B1649EDFBF3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937542, "uuid": "03bff127-b466-4393-b2ed-e0e7851a620d", "value": "24:8nMNjmJd6XkW/w24uDXn67D65FOhwNeDNdjAGcevcwYL4o0CW:84iJd8TnHshwe56oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785937542, "uuid": "6484741f-6e9f-4497-a6a2-3e2ccb702352", "value": 2660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785937542, "uuid": "97dc0263-c317-40fc-bce1-ef31ee3de59c", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937542, "uuid": "ae16f4ec-2801-4dd9-bb41-672a5c37e48e", "value": "DSC_660683145590.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf6906b-907b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785899492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785899492, "uuid": "ff8e28db-c63a-4bbd-9227-c30cd04c3664", "comment": "Malware payload (Mirai)", "value": "6865f288f369477f5b51466d1c2f3e6a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785899492, "uuid": "29830085-4ad5-4f53-a7b5-e4730fd90922", "comment": "Malware payload (Mirai)", "value": "0a9c86f0f73ef504afc9215b8032b4f10e356cc6d8bb20eff97413ae517faafc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785899492, "uuid": "044a62f8-5ab9-4292-8329-c4ab75f1ccac", "comment": "Malware payload (Mirai)", "value": "1208a1b612e279f45563c907afbad6330c44aa24", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785899492, "uuid": "e3f37654-857c-446b-aca8-86e3ffdc5466", "comment": "Malware payload (Mirai)", "value": "374679e1c2f01e570fc14fded8246a383d5723694d17fe7500bf45cf03213776d63ed114a27913403643d75caa16ac67", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785899492, "uuid": "93606c7d-ddd9-44fd-8731-9c1102641a01", "value": "T191019EED946644313F0E943B32291C507641082F24B95EDD128EDD638E0CFA9235EA33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785899492, "uuid": "cc12caec-faa9-41c9-8883-38af23b15fa3", "value": "12:liXI0aDNjWr5jWijW2HjN/OpG5rNaQFTERE5YEmYXmY6uYYiH:4MNjWr5jWijW2HjN/OqsGBYDYXmYRYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785899492, "uuid": "0096c958-f39c-4f94-b004-924e72cf2ae1", "value": 672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785899492, "uuid": "76ac77de-b008-44eb-b3f6-e767a299acc8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785899492, "uuid": "d99adcbc-f099-4ef6-89f5-e054655181a6", "value": "renzo.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e93e754a-90db-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785940961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785940961, "uuid": "f99d1100-e2be-4632-b90b-95845f8a9366", "comment": "Malware payload", "value": "4a37563682fe2051d58ecf9c7f742721", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785940961, "uuid": "675ef316-7013-404d-9dd6-e87ed698abd9", "comment": "Malware payload", "value": "0b1d8b33e227cfe6f2684a582309a1ae46d83269548a9216d57bc0d797002021", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785940961, "uuid": "ebc03ccb-ea1e-489c-875d-34582e66f688", "comment": "Malware payload", "value": "912c703a115920c8e9241d367f2a6c5b8d99370e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785940961, "uuid": "d5915fcf-1db3-44e2-9846-0cc58ab6a192", "comment": "Malware payload", "value": "e09af2d7beba3d7381e359ca785db511acc629263df29a64fbfd6bd9b8cbe6924c3e2e33cd2ec55137f665395829439d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785940961, "uuid": "c8d3d3bd-2b67-4c1a-b3e4-0ef3140f1a81", "value": "T130C27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1224D42AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785940961, "uuid": "21a55ea8-fd5b-40a6-81c4-b7d2bd9025e7", "value": "768:f8vCB+25j6es8RT9FYpMSUpi+20qUpi+20YQX:f8l25JVd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785940961, "uuid": "f50d5c6d-3bec-4fbb-9e2c-7248953951d0", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785940961, "uuid": "234691e9-7805-4249-9db6-6c8687583848", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785940961, "uuid": "9ede0dc2-e251-4482-8e62-a3817110d06f", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f91cc8dd-90d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1785939269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939269, "uuid": "8583e81c-dc74-4e9d-802d-a2fb45891f5e", "comment": "Malware payload (Joker)", "value": "41865714f0d7f52d38e1fba70b5201f4", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939269, "uuid": "a10430ca-187d-4760-9860-bb403f3f5878", "comment": "Malware payload (Joker)", "value": "0b7d3ac956e321e606878b66cebef3871ddfc2117572a8666fb1c29a669f6569", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939269, "uuid": "4c62fe60-ca0c-4f7e-883a-6e6ec5bb31ce", "comment": "Malware payload (Joker)", "value": "5690d0430059b01b26dd9c55e59c9bf67f43db46", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939269, "uuid": "d3b8b89e-3db1-4cce-a14f-7095e6347167", "comment": "Malware payload (Joker)", "value": "f46f0bc7fcde20bde4cd6c7140e465319180ab2bfca4438c9855ac3083f2df9015d478ace2b2e73be3491ab988fb1ff0", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939269, "uuid": "c12f17e4-b609-4199-97b9-96c58b597064", "value": "T1B6870149F61CD42BDEC9B0BC8D8B07A3B5627C151614C18B2822B60DFDB37D4AB65BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939269, "uuid": "f5d4728d-df87-4845-b024-07d930241227", "value": "393216:DPLgXLDQa7uGNycQxXKQUnovOh2WHd6oikuuazblvBczSOCulojVfbu6WeM0+nrx:rLULGpxXRQ12bSLSblJcblai/cFv4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785939269, "uuid": "a3302bfa-5d23-4e16-b735-b4ee9b11f434", "value": 36108177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785939269, "uuid": "c421c86a-f92a-408a-9a3f-2cee6b9f7ed7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939269, "uuid": "05dceb5a-70d1-4cbb-bdaf-b3f6e3faf376", "value": "Fast+Messages_1.4.5.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1766b5cf-90cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785934596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934596, "uuid": "fa5e7fb9-abc9-430c-b5b8-44e7d6bbc487", "comment": "Malware payload (AgentTesla)", "value": "d9a50cd4685b0db5153d0f184b65e93b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934596, "uuid": "9fd84ede-334a-4d60-a2d9-86c20f6c03bc", "comment": "Malware payload (AgentTesla)", "value": "0c58015112a8d5923fe679a46075d2def811fc6da1e0742861e47c600b978250", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934596, "uuid": "0a9d0bba-5eff-42cb-a757-79a3299d38c4", "comment": "Malware payload (AgentTesla)", "value": "0a725e6f5fbff7ebfc77e6fb1c2b3e0a637d30a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934596, "uuid": "a3bd624e-3cc6-4018-aba8-d9ba6fe8324d", "comment": "Malware payload (AgentTesla)", "value": "64bda904488b66a38993cec88efdd3070d905b2370ac77c6b8bf6a6f8bb7e2fe50593326346567ee8273286826f448a8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934596, "uuid": "2202ae11-dd54-4e87-9505-dc8ff425bd95", "value": "T1A7352CD261E284D1BE8312D6DCF743D9CB66035ED86882D8F738A7E220954989767C3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934596, "uuid": "8f5766ec-acc2-4616-aae8-88d0750be836", "value": "768:2Ar7w/cQmN7nlMzD7/z77Q87L7p/77g7J7PsbIR777nXk7KPdTn7377CpLG7MpE3:u1JDVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785934596, "uuid": "b4af1bd1-a320-4070-bb8f-2c8fda9396bc", "value": 1078413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785934596, "uuid": "c5784d17-1618-4252-ba13-3610fa021afe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934596, "uuid": "781c1b5f-8630-4785-bc3d-13e13bb9464e", "value": "New Order INVOICE # 2882020.PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f98b548-9100-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785956621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956621, "uuid": "0a2d0574-a9c4-4010-9f3e-d9f27df70610", "comment": "Malware payload (Mirai)", "value": "52fdffa0c5cc27407193596c97323fa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956621, "uuid": "b0639965-d3ae-4465-a29a-c50fb86fdda3", "comment": "Malware payload (Mirai)", "value": "0d1f63bde30aa049cc88ce9c54859b69a3a7b0b10403680414e0655d39eda347", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956621, "uuid": "647045d8-7dfb-4a26-b291-d6e32095cc45", "comment": "Malware payload (Mirai)", "value": "73855a0b59724c19cde8854b285be9bcf4f47e4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956621, "uuid": "b325a520-c26c-414e-8124-08e3eb2f3e93", "comment": "Malware payload (Mirai)", "value": "1f76e1892095aa453ad786f35a49a90b72842f01eff29cf1bb92a2a7a6b3f663bb4de69d83f9b33fbe7445733f0d894a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956621, "uuid": "47304ab3-8780-4d93-9dc7-ed0309a7fc77", "value": "T106148F01FB081913D5935DB45B3B0766E379DC8318B8F019190EBB568733EF69A87B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956621, "uuid": "8e69b856-7bf0-4980-bbdb-88e8a1988628", "value": "6144:ENtZ4Y0VrY0f4UOc3HEAIFidNQdl1sJ62s:aqwU7Oiwas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785956621, "uuid": "3edfa86f-0302-4bab-b83c-6c3d721c2e15", "value": 198016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785956621, "uuid": "ef15b85e-0b16-4a79-a3b0-5628704d09ed", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956621, "uuid": "9ce901b5-c1be-4f12-a927-43c01faf3573", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd516d3-90ce-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785935222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785935222, "uuid": "ff2473a6-641b-46d9-af33-f5b84f23bb55", "comment": "Malware payload (Mirai)", "value": "562ef8d8e0483db1b4ed143e5b6d9120", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785935222, "uuid": "56511469-4025-47f2-98b7-2f126c8a33b4", "comment": "Malware payload (Mirai)", "value": "0d4bcf3868dcad3409492dc3b8d01439eacd99e49ca746fbcf019dc32ae82a65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785935222, "uuid": "58fd575e-d4ae-4952-bde1-234690df6931", "comment": "Malware payload (Mirai)", "value": "c17edb44e4ce989b1cb37c9d8d99fb6038d7d008", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785935222, "uuid": "dbd04eeb-28e3-45a5-9a2d-5489250fdb3e", "comment": "Malware payload (Mirai)", "value": "057fdeab4f244caf5c1959b1950003522f7e8473cb21c170c2f479ad1574c76bd9611ff3d9cc869f6fd6c6c7ed839869", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785935222, "uuid": "4b04bf40-1ef7-4228-be79-031867e5d83d", "value": "T1C2261A57B8918A83C0E4367ABCBDC1C432636EB99B9722575D04FE3D3ABE1990E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785935222, "uuid": "72c61918-92e1-40c5-b4fd-f03820547792", "value": "24576:1IoRE7XpiyRH6ISoROLkg8QAWra6n5B1k3yfYXgFwc2A1VP7+no7F0JqA/+S1e7e:bsT2NUFY0VNy8Twa2j9FDQ6ukdU1F1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785935222, "uuid": "de27f83c-cd6d-43da-a379-bac0d836cc6e", "value": 4587520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785935222, "uuid": "779d6e18-9c99-4601-9e65-5440a64f4476", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785935222, "uuid": "c2d7d79f-74ba-493e-b914-b5680798bed7", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb68f25-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785917557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917557, "uuid": "123b76a1-a3b4-44aa-931f-4681d51ac9fd", "comment": "Malware payload (Formbook)", "value": "d1ddb0fae6312e0f95511b0b25a4b652", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917557, "uuid": "0469d8bb-35fd-4f0a-8d23-0528597bc5c4", "comment": "Malware payload (Formbook)", "value": "0dca7ae3d3c398246e3d38082b60a4b74d71258e1c874e62bcee9d4207f74e6a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917557, "uuid": "1f2b6ff6-93eb-4258-bb39-4b454c84590e", "comment": "Malware payload (Formbook)", "value": "590b07cdf7b2adab30a57f38088045e98aa84f56", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917557, "uuid": "86b84745-0b3d-413f-b7ed-242406bc2dc3", "comment": "Malware payload (Formbook)", "value": "b0e8c1820a80ddaec2c4181de0f18cdeb7490394399f06e07cab3c5be239a3a2bb97f4b0b7eb30cc7d1b4743ebc51088", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917557, "uuid": "add9fa9d-f1b6-4b17-87bb-c0926d8d071d", "value": "T1E525FCDB9FB6D69D06287E6DD83CBE9D248BCD9004D4AA5BEDB8414BF30E64501C0B1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917557, "uuid": "12bbdb15-55df-4d4f-bfc3-61abf170a8ef", "value": "12288:eiDu97RH3j/rVGgEg3b3RexyjpTQVwvY96I7itwB2pB9PVJJdsyDwjPP4J7ilrMD:7QkhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917557, "uuid": "45836512-3b3f-432c-a590-8c921d60a111", "value": 1019230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917557, "uuid": "31109a4f-976a-4fa5-8fef-3f3f3c05dcd4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917557, "uuid": "9fad6ff6-60a2-440f-bb2a-cf326aab5bd5", "value": "Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0cd8c2-90a3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785916863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916863, "uuid": "7b0046ee-4c5b-45da-a805-a6c230f3c104", "comment": "Malware payload", "value": "de295f6d6f8c61359b07a765576385ab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916863, "uuid": "4e62f3ee-78ef-47b7-a9e1-6cb922b1e0ab", "comment": "Malware payload", "value": "0de58962455846db613216dcdd9b881f06a4fef7f812ddf9d73a70cf76299b43", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916863, "uuid": "53b01e46-e617-4477-8695-6b5f227973f8", "comment": "Malware payload", "value": "42a5d350904c1421bc2ebae70d0d47434da1048d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916863, "uuid": "d3ade963-cc80-427e-bbab-54e83bce875c", "comment": "Malware payload", "value": "36cb1167a1e03e9b78fcd338c12b2649f1ad3af55d4cbfe09ba64b03c3c765241985e221cb7517f7d116489ae7824f3b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916863, "uuid": "739566ba-ca6b-452d-b8ea-26b3595a4090", "value": "T178351BF186DCEF68C26F0AC1E855315EF7E79EA8644A0F4AF00713553DA468C85E4E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916863, "uuid": "5864f441-333f-4e5e-916b-18414088993f", "value": "96:Y0umGhe58hHVtQN6eeG6ehtt1LXtBtNeXGmumG8o8V+XttVjrGQtc5ttRGXhOsXY:4RrpLqAAeD54iDHfUFB0moB7Xulw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785916863, "uuid": "2b6faee5-3e5f-41aa-959d-782e108e297b", "value": 1066593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785916863, "uuid": "50f6e7ac-e5a9-4c21-b79a-c693e387f3fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916863, "uuid": "a42b636c-f373-41cf-8fe7-15c9560663cf", "value": "Document_202605000733.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c668880a-906a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785892369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892369, "uuid": "fb60f3e8-71e2-4a77-879f-468305f3e2dc", "comment": "Malware payload (Mirai)", "value": "48554c3a4f4c2d0d88f1edfe848fab18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892369, "uuid": "66891a7f-e8cf-4de2-822f-0334799bac60", "comment": "Malware payload (Mirai)", "value": "0eda0c619807b5d9f641b253338fbc9574a31d7573b979d4dc63dec16bc29399", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892369, "uuid": "78c6ccf4-7f92-4424-af98-08db2634de83", "comment": "Malware payload (Mirai)", "value": "5eb24958eb9b79442a2e09eafa64347c5c7937cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892369, "uuid": "e313a589-bc33-48f7-bf3b-358bc6c401d2", "comment": "Malware payload (Mirai)", "value": "57a5fd13b378eb913b701300d41050d09655eab49042fa34c9778a018406a1512e29764ff73612bb89482e435ab03876", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785892369, "uuid": "67a2ae79-2d9f-40a3-a14c-0d0681d4ea98", "value": "T1CA03E827F6618C2FC44BD2B19BDFA6219623B8792331600F9394FF615E4D5C4EE9A243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785892369, "uuid": "280b37eb-b492-4840-b025-e12116251632", "value": "768:BgE/rbqhuPDSH9+7ZI1KgBolcb6mVKuLbfwOSsau7:i0rbq2+d+211oAVnTwOSsau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785892369, "uuid": "7bfd784b-d31c-4aa5-863d-e0aa8a58f8fc", "value": 38368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785892369, "uuid": "c50c9eff-3c0f-44e6-af71-2707be7a1e7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785892369, "uuid": "6858736e-7f56-4241-8a1a-636b69ab497c", "value": "main.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3693dc-9094-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785910367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910367, "uuid": "a31bee7e-ad32-4c36-85bb-280ded1efe2f", "comment": "Malware payload (Mirai)", "value": "a98ac4d125016573885d3c9d2362ea89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910367, "uuid": "cb31612a-94dd-45b3-8a54-e8bcfa146166", "comment": "Malware payload (Mirai)", "value": "11b507f0b674fba53129913b2d829616b9f950fa3a4a6d357a78ea13ed4785ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910367, "uuid": "6153069a-f0e6-449f-b44f-7d863bbd6897", "comment": "Malware payload (Mirai)", "value": "b3616178c72546c81ad763f6fe839f691550160c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910367, "uuid": "22b65b80-f2c7-4264-b3f1-d22ec82bfbe5", "comment": "Malware payload (Mirai)", "value": "7b0e530f72743735dd9b3752a0562f40e98e9730b508b0e805dd81ae92e864986d24fa889b7d3676d863796ec474ea83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910367, "uuid": "ecb5dc74-9560-43df-9d22-ece0d89d2ab2", "value": "T1BB148E00FB184953D1831EB45B7B0776E379D88358BAF00A190E7B5617339BB96C7B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910367, "uuid": "8c1656d4-6a7f-46a0-bf4b-eb4a997da7ca", "value": "6144:/GnJr0yQgY0jlUsHekKAIhiQHQdYXCc5ru:/+NrUeai3Uu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785910367, "uuid": "45b71c54-ac2c-4895-bc33-163361e0d6b5", "value": 198024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785910367, "uuid": "7cb9e9ff-78be-4e8c-94a9-366cfa50b25f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910367, "uuid": "b75bf3dd-6592-42f4-be24-c44ce26d560c", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a17634-909f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785915207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915207, "uuid": "0f1f2c10-455c-4c36-b4ef-25c991f1aa33", "comment": "Malware payload", "value": "2d6cd66eef703ac33fc34b4de8ec596b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915207, "uuid": "ea5b446d-918e-4a42-b6ad-6e78da35af8b", "comment": "Malware payload", "value": "12c01bc666634a74c6d75ef80ee39a2f859e6e50896658a01817518b5a78712f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915207, "uuid": "7421ae11-dfb4-4472-95c1-248965c68655", "comment": "Malware payload", "value": "a907fe413d5a74fa7e88e20f0682a0d4d0f63716", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915207, "uuid": "7f811e09-7e8c-49c2-960c-38355c036ec0", "comment": "Malware payload", "value": "ec30be112ccbd54caea6f90dd03248aa70465c7cd12e0073326eb7dc6ad965ed3c7bc6cd90cd91e2470dbed16bbed6c3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915207, "uuid": "13229f3d-46f2-4445-b2a5-1418222c0393", "value": "T1DDD132096A5142A1C631AB758DE32B4BF61F047B5117024075ACD285FFB0AAED7FDE8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915207, "uuid": "d8fb39a7-238c-4de6-ac52-02f1db0cb831", "value": "96:J00CE0Mmb51faCB0p8UenvVHuc22aI1v7eTje/weY4Kmb5W:Kqm51fzy8UevVOjnIZ7eHe/wezKm5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785915207, "uuid": "5415ab92-7eed-44e8-91d5-85c463ba1ed0", "value": 6730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785915207, "uuid": "515f7365-77bf-45a9-ab94-d5e88880926e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915207, "uuid": "5fd579a7-21f7-472c-acf6-cf91c7077103", "value": "index.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5dea4c5-90e8-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785946512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785946512, "uuid": "cf43567b-cbed-45b7-93a4-0cb4202a2f09", "comment": "Malware payload (WannaCry)", "value": "22912c42a6594d196de2280e7112aad9", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785946512, "uuid": "83e16719-4173-437f-8540-6cf59192dd85", "comment": "Malware payload (WannaCry)", "value": "1320ba4c289d844b5d724fa5af97d129bc8d103c48011952df911ec0d089acee", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785946512, "uuid": "169f4cc6-bb2d-4c66-995e-ad338e7cf139", "comment": "Malware payload (WannaCry)", "value": "552aab9707e349f3b80ac68140f3eeec1858660a", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785946512, "uuid": "3b5e0bdb-e3a5-4cb1-809b-b30631d54605", "comment": "Malware payload (WannaCry)", "value": "ba669153800cd155553fed45f612c4898ed5fac00b22cdf905e00566487d65f5d7794b5299c1d1350e9d5d2f0514c670", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785946512, "uuid": "d88a326c-6d27-48f3-8a09-5279a328aec0", "value": "T1373601929CAC917DE9960F306CEE2A4D9E213635473DE7CD8DE4AB4F4A844817BB413C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785946512, "uuid": "284f15bc-b5d3-4748-ad69-8feea9a95efd", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785946512, "uuid": "7a1ca181-dce8-441d-8047-0198720199c4", "value": "24576:jbLg1bLgdri3dmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz66W8uME7A4kqAH1pb:jnYnQMSPbcBVQej/1INRzR8yAH1plh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785946512, "uuid": "4efcb057-f905-4d93-a613-913efaaa37b1", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785946512, "uuid": "d273de3e-fef6-4c60-9cb3-9236394c8c58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785946512, "uuid": "fc36511e-796e-4990-ba66-de38a33ee9f8", "value": "1320ba4c289d844b5d724fa5af97d129bc8d103c48011952df911ec0d089acee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a87ca31-9078-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785898228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785898228, "uuid": "8e9b1521-6258-410d-a61f-ef0c9920d4af", "comment": "Malware payload (Mirai)", "value": "8cc953fc3fd9bd40ff0a4fd6dd21b41b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785898228, "uuid": "537d9c34-6621-4327-af99-01eef1e81f33", "comment": "Malware payload (Mirai)", "value": "135cefead339d5e0813e38049da8666efefef7c7b64c6ed22f5fec62b676ced1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785898228, "uuid": "e47cf313-1450-4425-b0a4-577382ae0d4b", "comment": "Malware payload (Mirai)", "value": "b4bc5e859101507ec3af8b556def0aa817246179", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785898228, "uuid": "0c46b76d-2bfd-478e-a6a6-233fd736d221", "comment": "Malware payload (Mirai)", "value": "6f2ae1270e513774624184ed91098318a26cc6a650703a2c490f76ee52ebd65eca0f49eb1175d001c0da6aaeabd25b2d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785898228, "uuid": "c2dbc5db-24bf-433b-a75b-3a1565ecce23", "value": "T1BD0429C7FD00DDBAF809E33748130809B130BBA254925A777257356FED3A295197BE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785898228, "uuid": "dec93e90-282d-4522-bd44-e442d1d4c3b6", "value": "3072:T1ThsmVqwyJ3XjRcirf200yvcKd34FSkGD52RVRf4grVpjbiNLEy5cKNKB:Uwgx4yvjd34F7GD8V4g2LLvNKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785898228, "uuid": "7d9cc8cd-859e-49b1-b861-00d7c5018749", "value": 182244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785898228, "uuid": "8c98ee31-7a36-4407-9a96-edd64191acc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785898228, "uuid": "f37a39d3-263d-47c4-9112-bc43bef4b796", "value": "sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f217a25-90a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785917160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917160, "uuid": "48a8dee2-d2d2-4757-a89e-55a84b18d438", "comment": "Malware payload (RemcosRAT)", "value": "c0d5a32844f754435b56cb0a2e8aa1bf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917160, "uuid": "4c34fdfb-dbe4-42f8-a369-0c6a12594850", "comment": "Malware payload (RemcosRAT)", "value": "135dfe4eebd3a5547a95a33841bf88e80f6577ee5650fe1679ba066d12befdce", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917160, "uuid": "7e63c0bf-b9ed-422d-86e4-7c18d45371fb", "comment": "Malware payload (RemcosRAT)", "value": "a47bb2027fa6713ece9f41c4eee5cf5754e6e77f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917160, "uuid": "e98243c5-2f8d-466e-a898-34d5b232dc9f", "comment": "Malware payload (RemcosRAT)", "value": "dc603a9a586b270f705be99fa6b5f421879095382e9d556ad4ac08eea3329f1c0abdb11933eded241101c4878a869572", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917160, "uuid": "0c3e861e-65b4-433b-8872-67682de71d83", "value": "T1012519DBB371035C184872CACEBC6EDD2864FE92D110E66AFDB83787D60C659A181F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917160, "uuid": "e3b945c5-44eb-41dc-bd85-1b3c873b98b4", "value": "1536:nlM8aIg1XOxin21mfw4m/3OzzYDCfbfM7oZKdPOnZTArJQcQ6u3LNdpqeWiT:xlG+1mrm/eXYDebGoZKdeZsrLk3ZqeNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917160, "uuid": "06307248-881c-44c1-9839-e211a522e812", "value": 1037614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917160, "uuid": "cf3ef104-2238-46f1-bd40-e54794319ddb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917160, "uuid": "6b9ee093-6691-4099-b842-4fea262585d8", "value": "Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae292d23-90ff-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785956323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956323, "uuid": "5df493e9-db03-4bef-abcf-ea108d322c26", "comment": "Malware payload (Mirai)", "value": "66bc5f6f80ec09b620e1c74d2bab7371", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956323, "uuid": "3ca73d62-2689-4e07-8f9d-03a316eec501", "comment": "Malware payload (Mirai)", "value": "138a68f4a0a764908fa2ae4aa869bfb73cbffadd9cef1a766753ade00404d52e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956323, "uuid": "dfb64f67-0ebc-4555-90d2-2a25c3cb221b", "comment": "Malware payload (Mirai)", "value": "4deb158229165f6d05b677c6aa9ee07eb707fc5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956323, "uuid": "1986649b-732d-4c96-b966-eb54030379da", "comment": "Malware payload (Mirai)", "value": "2d998d914ca28d177100c97c791e90d9d24ebc8abe4329ab52cfba253bfc83b3e8cb1a36d3c2261411c78418f009b6f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956323, "uuid": "a7354c69-4892-4567-93c2-00f9b9ddaf4b", "value": "T172530206D5C147A4D29FD0B90C6A74262CC0FA1B5BDC4BE627B4AC9F24762943F1E786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956323, "uuid": "760c7e46-e63d-4cd1-9d68-3e7f1dd12576", "value": "1536:dN6O5kE995+Cm4dwrU7l4YfhyP2+wMnouy8DMH:dJaE9eCVdwrUuYfhXnMoutDMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785956323, "uuid": "9538e7ca-0f5c-4d41-9e51-49dc975ef7b5", "value": 61344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785956323, "uuid": "ed885852-9883-4a48-a148-2a878fc13e39", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956323, "uuid": "bb8b52b8-2057-4d63-805a-ddc3764e5a06", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5e9a9c-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785917718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917718, "uuid": "dea594df-3e52-46a2-8855-f787a0750455", "comment": "Malware payload (XWorm)", "value": "afc84ae8d80bf1faa066f774a22444e4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917718, "uuid": "19b5c719-e97b-4794-be59-de13fa381104", "comment": "Malware payload (XWorm)", "value": "140a109c7022212c165f1430b664141a32c869c88d8ace639a534f4e5d1c791f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917718, "uuid": "9be0f3ee-6fed-44d4-a315-9dccda054c52", "comment": "Malware payload (XWorm)", "value": "7ab9fee621763d63197bad8771413af04caab228", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917718, "uuid": "98e55b5b-9110-433a-94ac-8e55ed94c846", "comment": "Malware payload (XWorm)", "value": "05045432e6c3c5a0c90b07b069a854a68b23911c85baccd9064dac9611481fcbc6b3249afe8f3e9297dac18dcdf491a7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917718, "uuid": "7290dbd3-e457-4205-a664-e51701e9c040", "value": "T1752584B94F7B976DD12E11708D5E525EBE1EB60E09EC730A7E4B89D69A70810E200CFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917718, "uuid": "1b2d508e-3842-4076-bca0-563a978f74bf", "value": "192:1b2S6mAX4zunAaHIaJIyuYOe45zBoXRO54Mikp0F1e5aE:1b23QT5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917718, "uuid": "e8988603-98a1-4cbf-bf2d-980e5005e2a8", "value": 1025173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917718, "uuid": "e2987edd-a05a-41a3-8d27-3f9753db90b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917718, "uuid": "9cf4c94f-b1e2-48e4-9130-729f355a9eb1", "value": "Claim File.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80b3a98-9089-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785905740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905740, "uuid": "b9f3a599-4665-45a4-b8ae-78771e893059", "comment": "Malware payload (Mirai)", "value": "896f209c764a9cd5c0b2d0c603799942", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905740, "uuid": "30329100-451e-482f-91be-40f2811cf221", "comment": "Malware payload (Mirai)", "value": "1420ddde63ae9886a5f8159f5262c8853469c0b0f07544ed851fe7aa1c195c28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905740, "uuid": "4f469e05-a9c0-4a33-860a-4a1c89d4d42f", "comment": "Malware payload (Mirai)", "value": "4dd815dbb8008107311d1398408ca3e4679ea8bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905740, "uuid": "0991952a-8068-48a9-8f7b-5c845fe5779f", "comment": "Malware payload (Mirai)", "value": "184f86673e93906996ea0db3782aa471b5a43ca7992832001113142a0452f21c7e393ad001dd76b8f674db5c215334c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905740, "uuid": "f502fcaf-8c2d-4063-a66f-ecd336bcc008", "value": "T17CC37DC2B10D7EAED5D32D7DC10A13176E1C9A51DC83510190B6FE131ABB6E72E26ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905740, "uuid": "7fac9a2f-09f7-4f31-8f15-9dfd217ca311", "value": "3072:KOUOLQxrl4P0GaiFXEUQTOPafpSRveeRwSQLLjyoqK:KJO0S0GR1QaPksveeuSQXvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785905740, "uuid": "598910a9-6d28-4079-8af0-da5d580d2e13", "value": 125304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785905740, "uuid": "bf56ef21-f4ee-4df9-b3ef-f9eff393c3c0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905740, "uuid": "ab9c5d57-f497-40d7-b210-0ca724a30133", "value": "putita.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a124f93b-9094-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785910345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910345, "uuid": "c7f10cb6-e87c-4bb1-9a80-077e54550907", "comment": "Malware payload", "value": "1b29ed97b34a22469b5e9967da212741", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910345, "uuid": "12f88710-44c0-4940-8347-bd03a5bc097e", "comment": "Malware payload", "value": "15605da96dafe76fa0e9d44d9c682f6f56d083df6b7124d5c39a5577e8a34a78", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910345, "uuid": "25c9abcb-6cc9-4a19-8b8c-54ede1283eb7", "comment": "Malware payload", "value": "339a6e2b723cfb9edf201c73aed18759f83058c4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910345, "uuid": "67d58016-7039-4fa9-a80f-97e701900506", "comment": "Malware payload", "value": "16b9f333ce436aa8ea2409809e351fe462343feb38f78e946a3b3f223420ab154e072b26bcb08bb34c6a7f4ff7069222", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910345, "uuid": "1c2a90e1-e318-4b30-8d92-bfe7deefbd59", "value": "T103236C6516857C14AE98C4365D7F2F0CBDAD43E6314492DE7FCA3CF28C4AAADA20871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910345, "uuid": "8147d2e2-2de9-4276-83e8-bcb794d37f85", "value": "768:9r9NyXsZztCi9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:FHusZycr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785910345, "uuid": "5e3353b0-670a-4d49-adab-b583a7290a07", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785910345, "uuid": "038103f5-c45e-44a6-9b2a-567c3896be92", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910345, "uuid": "592b6f9c-4cfd-4dc4-98b8-d265dd830169", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb6d9d3-90cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785935468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785935468, "uuid": "7d94b54f-d801-46df-b232-5deb664d1f7b", "comment": "Malware payload (Mirai)", "value": "9e63906d011406e533987413dc42bbb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785935468, "uuid": "e799e36d-3466-46d1-a321-a330cb267b0f", "comment": "Malware payload (Mirai)", "value": "15b950d6b732fba9021b829331a2277c1d88609b60b4238a34fcbfea676f465d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785935468, "uuid": "4e829d18-10f2-4938-ad19-b49871d567c7", "comment": "Malware payload (Mirai)", "value": "da01c1df1317e192a1a9099f684f91a94a47565f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785935468, "uuid": "73a7eb86-19f8-4ba8-a2fe-ecff568bbf76", "comment": "Malware payload (Mirai)", "value": "2ad3f4bd8e4e6a6f74bc4731b38bb08ae7f9845af2849d78dc6a067692a14a3934710cc95b2b4d87ee888c2132e26b58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785935468, "uuid": "fdd8f789-17af-4d9c-8017-128d6d470f49", "value": "T15F159E81E2F1EACFE118DEB41129F9354E66863232A371C4B16ED26316B31947DEDB70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785935468, "uuid": "493a1978-f7b6-4bc9-9627-e07e99df4723", "value": "12288:Xj20IILF0GguO2Mq5o/2GhWXjM3XTe/+7AItFnJ3VYzvKFrVaxL7a98G8pcRrM6:y0tLF0GjlQWX4H6uHnJ3IRkes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785935468, "uuid": "0f06c592-f1b0-48be-965e-1688f12295f4", "value": 891044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785935468, "uuid": "131b9389-7590-4210-81e6-ad76fc97edab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785935468, "uuid": "3301a5b9-dd41-4970-bbea-e7c9ed23dc27", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c5ffa4f-90fd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785955381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785955381, "uuid": "623fc1b8-37ce-40bc-b5cf-9afae25d8b24", "comment": "Malware payload", "value": "ccd14b31feda17c5c52d9a42c253b6c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785955381, "uuid": "d89fc14e-530b-424e-9301-bc6666811fc2", "comment": "Malware payload", "value": "163194d22f93028f5142645d44fc4a763084df5348cf3ed50d7e660071fff7c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785955381, "uuid": "996c3614-ec7b-412e-8d30-a8c2522f3f26", "comment": "Malware payload", "value": "645abc88d41c0d809a58263b32f12b9ca437424c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785955381, "uuid": "6919afc0-b918-4747-8811-7ec87741554a", "comment": "Malware payload", "value": "13e55c138dc9a5b4c74b44f8dff8eb044d6e4a2ff2a08bc5eb7e50c5f32aa597cb0875769891768b8ab4a9ae691a8a65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785955381, "uuid": "088d2745-41b5-4091-9fe2-65d7f4a47c34", "value": "T159B501D5E5360CE8D14EC7FCC8AA9E520C19FC95EE4004CEB422954178EA3B9CB6DE67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785955381, "uuid": "3a194a0c-1bd4-4226-8f76-ae0aa6405145", "value": "90f4e5e00fb28b9b6d4b74b6d8933725", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785955381, "uuid": "b98a4b29-981a-4f6b-afa1-8438b7ac8fcf", "value": "49152:fqJoQYXJGa+2b42HVfx7cQgJmriR0zKiXJhuGgxeCXz:fqJoQsJGaj4237cruKcJhYxeCXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785955381, "uuid": "f3548a45-3a82-4780-b64a-4c362236c22e", "value": 2468524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785955381, "uuid": "366d8fc6-0adc-472a-8a81-2d8adf9cd381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785955381, "uuid": "3f5de1fa-3359-441f-93e3-b1bacbde19c3", "value": "wso.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0451cfd6-90fd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785955179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785955179, "uuid": "7c0d122c-0de6-4b86-a8d0-da0b32c55963", "comment": "Malware payload", "value": "e8365a748f31ddd5794b9a85ae20678e", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785955179, "uuid": "c228b4fd-116f-461e-99e2-237edae40267", "comment": "Malware payload", "value": "16957f43d2ba08cd5fc05f969632f59bc82b1d5b3b2cad20aab822bf5f135ec6", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785955179, "uuid": "50886fcf-2915-4076-8598-fa9e6b4ffdd8", "comment": "Malware payload", "value": "ab99258c5f99f022ebca0e234e3bddec7d17becd", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785955179, "uuid": "7dd6e8fc-6db4-4496-adc3-87a03da486a4", "comment": "Malware payload", "value": "5da8e3608369d086d036b890ad05c9b04cf1d6f8505f7768e2c4f51e39ae3569d44c509d001df21c237718692290445e", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785955179, "uuid": "db16d12f-f8bc-4ccd-8f9b-1822817e8efa", "value": "T145366A17AD9148FAC0E9E731C8B74205BA74B84D4B3123D72EA1AEB82F723D16E75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785955179, "uuid": "889c362d-3ae7-4f59-b4ab-cf011ced6d36", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785955179, "uuid": "75f5ecad-4a68-488f-ad7a-9184fe0c239d", "value": "49152:anGjC/eZTLaD9Vf0FLtFIU0WDPYBikgNt3gF6EbAtYZ:apUjL8/gNJA5btZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785955179, "uuid": "a9634598-100b-4ef3-be74-0c88d10a7f6a", "value": 4875608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785955179, "uuid": "cf04ce11-beb8-4ec2-907f-f1614b1c1f10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785955179, "uuid": "46f3cb69-92ae-4c9c-9d68-44169b5f4235", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad29a9c7-9088-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785905212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905212, "uuid": "3c3b2db4-5920-43d9-8089-46d84b48999e", "comment": "Malware payload (CoinMiner)", "value": "0e572c17df84cf406697ee63c8cc7700", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905212, "uuid": "21510550-51fa-434e-ae31-2eb771e9ad40", "comment": "Malware payload (CoinMiner)", "value": "16e0903c601fc36cb81393990e53ea2476b1c74aae72b2b90303f98e5c3e98f9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905212, "uuid": "885c6a06-1fd9-4bbb-a66d-375d7e688ad3", "comment": "Malware payload (CoinMiner)", "value": "6b39e55ea82b9cb168292033d4fc8984830ccc7d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905212, "uuid": "3a745ecd-9020-4ec2-b506-2367d804bb81", "comment": "Malware payload (CoinMiner)", "value": "5740b52b968f601967e6569df3f69d2f00f3e4c666cb43bd602a339edd003961c313886cb32dc9f22ee42e201e3cde35", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905212, "uuid": "efd3bd28-583b-4e85-886e-222e8eaeeb8f", "value": "T14E22081F7E450131E3A149B056B54A4F617D5633678BB3EBF733E5890EAA2458400BAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905212, "uuid": "811a0ea5-e618-4c7a-abec-2e6f812353cb", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905212, "uuid": "77232836-62ff-4f86-9e16-d2bd5fe22043", "value": "96:RxdcBoWYz/9PYz/qYhVKB3dSZKDrVx+ZQBzdcNQzYPFJxGE9mZ2FFhxC7tCEmcf2:RMBolW9KBpx+eBqBPFJxTEZmFhSmcBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785905212, "uuid": "77496586-12e7-431b-bdc1-8727157f144b", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785905212, "uuid": "fd7583cb-70aa-43df-8201-ebfddb3ec1ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905212, "uuid": "e480bb38-56c8-4dc6-88bc-0d366a28c0c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8badc644-90a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1785917181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917181, "uuid": "531af605-3c00-4d51-bdca-140e74ef94ab", "comment": "Malware payload (LxBaseRAT)", "value": "6975488fc954b996fdcda352518098df", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917181, "uuid": "73b9db83-1326-4c4a-9a7a-a39535cd7761", "comment": "Malware payload (LxBaseRAT)", "value": "170a5e08fbd3aa9f22df08c932ab0198c8ba21a9f73fc8fe30747c545bb0e02d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917181, "uuid": "6583965c-f412-4322-9190-d32a62473c73", "comment": "Malware payload (LxBaseRAT)", "value": "a317fab44f2d83d826d640c6cbe652d9dc2f91cf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917181, "uuid": "ec6313cd-303a-45c8-a035-33840ffae5dd", "comment": "Malware payload (LxBaseRAT)", "value": "11236f8a154a60ada227c72dcc3b7fe346bb8a83f178199d78673fc6256373e2bbf6cfdab8dbb07e3ffd8af0d8eaefc2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917181, "uuid": "8845dbf7-890b-4cdc-9ba4-3e7b14201f24", "value": "T14A05AFC00B2D7D3D88B8739AA19B3ACB15D52A368159CFD37784AE08DB1FC4A497127D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917181, "uuid": "2c2a9f10-b09e-4468-91ee-ac5f36fe7bd7", "value": "12288:bHLtF26X3aNgmkjv2EdpW7B3Dyuvpo3lWmBeZHBQ/oae2FV6iV57VDhrGULklF+a:Bq1gzTGz9RUN6Co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917181, "uuid": "a0d8e1f9-c9ff-4092-8c57-53a5ada30f84", "value": 822338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917181, "uuid": "ff3971f2-87d2-4837-b5f2-46263c2c2bb8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917181, "uuid": "9bd99b19-6b82-48e9-aea6-7b5d0d61a17c", "value": "Q4-2026 PURCHASE_ORDERS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1d51b8-9094-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785910226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910226, "uuid": "4ce65925-a50a-4ef8-8460-d8f1832bdfaa", "comment": "Malware payload (AgentTesla)", "value": "b31a609b19f45ae6a9e3df69f800980c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910226, "uuid": "fb65f772-ff91-4abc-8e23-2c7818c8af95", "comment": "Malware payload (AgentTesla)", "value": "172d548ee4c9c3ef936eec9191fb1a37e61eb17a6c393a295664c06cc5afe465", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910226, "uuid": "36e1d25b-007b-4c38-8b7c-8cf8d12ccc74", "comment": "Malware payload (AgentTesla)", "value": "8b029bce39280a0af4865f02dc2af2bbcb3d522f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910226, "uuid": "a75032e8-f28b-4cb6-96d3-167c8b6aa660", "comment": "Malware payload (AgentTesla)", "value": "00adb4247680e984ff7b662f5ad1b48deb0d85b282f7c4b8f92b3c5e718d34f7895372b3e24321993541063504498ec5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910226, "uuid": "0987b9a3-433f-4710-9f33-08ec0ab337f9", "value": "T1D2D5E7812B4490B377247BBD923BCE315A0EA003A4C5EF19716EE608365DD5FA35CEE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910226, "uuid": "5d5cea90-0ca2-411a-8251-620baa64f18e", "value": "49152:jc1EUIOcUuAOlcKbBmJ8nnCu9BuqJH12A56vUfiTBhUOhCGeH3+2r84WucPGlqtC:I1NI/hcKbg8nn5BuqJUg6jHUiCGeH3+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785910226, "uuid": "ff2c8b5b-89e4-4b4e-ac71-05899768659e", "value": 2961466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785910226, "uuid": "a4de2828-4a75-4dff-9a35-67cf2428f129", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910226, "uuid": "39799c67-2804-44e6-8a1a-4601591a47f1", "value": "yierxuhe.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8d0f09-90ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785933321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785933321, "uuid": "6f3f15ea-9c4c-44b6-9f71-8eb5a2657e9e", "comment": "Malware payload (Mirai)", "value": "4f590da1b3eee02fd40756baba78b9cc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785933321, "uuid": "2d7c1cde-73ff-437a-a20e-22ce968bc856", "comment": "Malware payload (Mirai)", "value": "1756584f0dc1dea20d16a8dd5c5c2c56277fabfa4633c7e478882e932cc71886", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785933321, "uuid": "5d186200-a0eb-49c7-b01f-1c2c351d402d", "comment": "Malware payload (Mirai)", "value": "0543fc906e9aebc2e5a8f282bd853571350fba18", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785933321, "uuid": "d3ebe8ff-dc32-4df7-b4e5-1e1613621d1e", "comment": "Malware payload (Mirai)", "value": "2f11692f61ab7ec57f70b95162ec4e1b9f41e94b813fcc1ef0ab479f821456507d0b6f1d014458290846e13231f1e27e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785933321, "uuid": "56497306-0fd7-4f4f-8157-a3c31e433bdd", "value": "T18D41A3DAA261C2B7580ADE56FB5430E5D49842C3E6A7CFFCF13C48664069398F5A2F90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785933321, "uuid": "4730b9aa-ab5c-4286-83bb-17bae0a20774", "value": "24:4OJapIXq+HBkrNITNIFKPTKPWs2vf2veG:laR+hk1KPTKPWs2vf2veG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785933321, "uuid": "4bed7508-54b2-4f72-814c-2f527db73545", "value": 1936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785933321, "uuid": "70de007d-6de9-42af-992f-61348cde3f3d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785933321, "uuid": "3b7dfb5a-3bec-4daa-af43-bd0191173211", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5895d2ba-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785917525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917525, "uuid": "d83a2f5a-c1d9-4075-81ae-a1eed6ea36b5", "comment": "Malware payload (Formbook)", "value": "d4a45f9865e85ff74948b9fbc108f165", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917525, "uuid": "8332a072-69a3-414b-9e08-c0ea6397a254", "comment": "Malware payload (Formbook)", "value": "1773b3e23c2ff6610b46d83968c9d49ff774a5aee8d06f10e24b91651771f300", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917525, "uuid": "519d005d-4a49-4f73-9825-cdf2957231cd", "comment": "Malware payload (Formbook)", "value": "29746af44274a05b41249e1af2f99c2b6122f485", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917525, "uuid": "c79ff1a4-85cd-4721-8975-7b8e2f35558a", "comment": "Malware payload (Formbook)", "value": "eb66be8f361bb80c794c19f4060259ee3636275ca52f050e2b1ca6daf6d19b2cbe83694078904fa7dfcef33fae9e75b9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917525, "uuid": "92c8fee4-a0f5-42e2-86fc-f72e900d9400", "value": "T150E5F8F223CF258B9732395EE81E65A4099F9126524345F0F0EE9EC2521F89F213DE5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917525, "uuid": "a190c59e-6af7-45a0-857e-d1fa3c13bb5c", "value": "24576:ERxUQezjMvBhGXGKRH5oVEhyFy+BTC5DBbIimFpwxqHxQjTdQMg5AOH9ZYpoXr+A:CKzjMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917525, "uuid": "0697a24d-35c5-4492-bd7a-80b8084905e7", "value": 3223276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917525, "uuid": "9dea6c6c-a929-424e-af0a-192ca7b07112", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917525, "uuid": "93cb8005-25d9-44ab-a42f-00fdf36d3759", "value": "PO 050184.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9b54be-90b0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785922177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785922177, "uuid": "77bae8d9-7279-4499-aa5a-af7a7be36dba", "comment": "Malware payload (Phorpiex)", "value": "eec3646ea312d5a7c28f3b9bce2e0225", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785922177, "uuid": "7f6c7f57-08c4-40db-8472-5dfe92bcd113", "comment": "Malware payload (Phorpiex)", "value": "17843590f5ff6f7ce4f7036981fdddfc1057c2ecc34e81eba174c045f1e17e70", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785922177, "uuid": "87dfe7ba-721a-44a9-b7ab-c32ce195d736", "comment": "Malware payload (Phorpiex)", "value": "cb9a07f694f27ee5539021b0d37d9e9ba26dff7b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785922177, "uuid": "6352872c-31d4-4103-9641-4849a0a6d079", "comment": "Malware payload (Phorpiex)", "value": "dcaebe6b8322271e4585b06a080cfaa78f660314d125e8d157ca0d168100335acb676c6a555ea0f4536e973dba35c385", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785922177, "uuid": "adc9d988-fd60-445a-bc27-a0bd641ed070", "value": "T10A824B0FB9414326D0E11070A276467BDA79A8B6378414DBF7E48AED0A686D1FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785922177, "uuid": "22f05c34-7e79-4d9e-86a8-4200b0ea9ff4", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785922177, "uuid": "ba6aaefd-0cfc-43ad-b511-c40769fc942a", "value": "384:JX6I8vVaF61eYUQQlmLu94gXMc4lmxav8U9cCl:JXPAUQQt928a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785922177, "uuid": "7ad2256a-1f39-4ea9-a6b0-c0406368fe47", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785922177, "uuid": "acbde30f-e465-49af-9856-463d50a6e293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785922177, "uuid": "94309027-07ae-4bb7-9aa9-b75324b0e79e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa2e187-90e3-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785944380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785944380, "uuid": "985fd961-5153-4079-b771-5e3e9f3adc56", "comment": "Malware payload (CoinMiner)", "value": "61e7c7daf4dc8eaaa00c92ed25122bfa", "object_relation": "md5", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785944380, "uuid": "bc25d85c-b398-45f2-a502-a73ff491a5a7", "comment": "Malware payload (CoinMiner)", "value": "180c22cd81e8468ba9aac26b316f2b80584db4ef4f800ab3d412700c2152a1f0", "object_relation": "sha256", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785944380, "uuid": "53952848-89d2-4a94-be54-df93ce756262", "comment": "Malware payload (CoinMiner)", "value": "e7529bf78a5507a50ddd99dc1b930d5bbef6521a", "object_relation": "sha1", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785944380, "uuid": "9ee86dc2-a5dc-4efd-8535-22a2ce5fa250", "comment": "Malware payload (CoinMiner)", "value": "63e2bd1741641dcae0e33d056f5a5174d5ad86b9b5266fe1adfd5e2b716f199f185212f450d418bd9e621bb3de4b32da", "object_relation": "sha3-384", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785944380, "uuid": "df062a84-5fc9-4780-8ca6-c6e8ba1b873b", "value": "T1EE3633D6AEE210B9C496C3F50A02B07EB07EBB604366BC467ACD39549D1EF19153E3C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785944380, "uuid": "bff1d804-2546-41c6-925f-41c959801a0c", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785944380, "uuid": "0aced4bd-fd1e-4f8e-9532-19a20a901488", "value": "98304:sDOl4hQZFtw7M+RuV/x4BHvqv87SCbJzuHArg1twP771:wOlScw0Vx4tW8GsJzugDP31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785944380, "uuid": "867da3d4-7822-4a98-87cc-40fea002cf23", "value": 5226496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785944380, "uuid": "71496b4d-711d-446f-84a8-df1012d5e1a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785944380, "uuid": "ffa3f17a-55aa-4f44-8481-2cc0621097ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc4710d-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917537, "uuid": "9748c10c-0c00-43e3-8434-70311bfbd75e", "comment": "Malware payload (AgentTesla)", "value": "c6605d86bf81a47f95915eb347648b62", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917537, "uuid": "56da0ff6-7ea9-4422-a3bd-9c238954d9f1", "comment": "Malware payload (AgentTesla)", "value": "18fddcf08bcfa108776f316b823669a82836e4c20526b3fc0a0e5433b63ef689", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917537, "uuid": "7abc99d3-8c5f-426b-91fa-16592b701cb5", "comment": "Malware payload (AgentTesla)", "value": "69bd31c25d230b672ca2dad2990634b4602a7596", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917537, "uuid": "f93f08f3-0574-4dd4-9991-be759163b54f", "comment": "Malware payload (AgentTesla)", "value": "1101296f38cbe9e6d21846558fb7cfb50ccc254814543e1ae7e339767adca7fa23e14d56b5692979f20ec76d2e945e4a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917537, "uuid": "72960f4f-0a71-4996-bd78-6ce6db805fc2", "value": "T12835F1B12D894C19C3079650FC15D77EA532E42E85CCAB5E7AEDCF50286732960BE82F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917537, "uuid": "484feac4-ebd4-4f5a-8f8e-8e68dc90d7a0", "value": "384:VY4Os98Y3qK7nf98OWRsmyqZXCK8M8vcY3LcXnD4/n2aw+jMjG+ZwGs/FZu:j6Kj7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917537, "uuid": "071b9f81-10f1-49c5-80e8-ca39417ce0ef", "value": 1096527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917537, "uuid": "bbd348e2-2b7a-432d-8f77-146f3cf92e35", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917537, "uuid": "957ff382-1865-48bc-a82f-6cd6471cb113", "value": "PurchaseOrder-37851.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c3bbea-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1785917710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917710, "uuid": "2286bfcf-a137-4bef-a561-ec6ca67766c6", "comment": "Malware payload (LxBaseRAT)", "value": "f176459c6177b82d980f7c1df335e16d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917710, "uuid": "72a3b921-3909-4690-b568-7c22f13e0a7e", "comment": "Malware payload (LxBaseRAT)", "value": "1905aec89ddae7777882af792d908088013bad8a16e993567cd20573527895d9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917710, "uuid": "8a4bfc0d-737f-4470-86dc-058526515755", "comment": "Malware payload (LxBaseRAT)", "value": "74f0cac22c0696d4c8bbfebf78e5cbc46fa2c17e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917710, "uuid": "e5e19779-be0b-4f12-8493-4f889e4f6380", "comment": "Malware payload (LxBaseRAT)", "value": "d739e44d79f0e9137172954347a0b9bf5ae02ea3053982a5378c16200fe9a90f73b73402500a94deec8bff2c331705fd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917710, "uuid": "a83b20e3-6b60-4b55-ace5-15c115856fb4", "value": "T12CF4AE0FC19BDC6F5BB270855E17ABAAADE4085857A94674E908DC217080CFE5FB80F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917710, "uuid": "c214f3bb-fa3e-4272-83de-6ff3950082dd", "value": "12288:Dc22oL5lwGelOy3mcqp1T0Bijm2X/s8kvDlmkINAfc1b/p/WSpr8YqhE46SSQEme:DcBcvaDqp1TxfyIRB8YXtmRje2DXwdgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917710, "uuid": "40488650-09e9-4b39-adb6-88b52d0a68f2", "value": 782151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917710, "uuid": "2f278337-244e-4d2a-97fc-a19349b0b9b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917710, "uuid": "b012b797-b532-4112-b0e5-d8bab9b7f064", "value": "Q4-Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f13e8a-90de-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785942156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785942156, "uuid": "54691a5d-0e03-4308-8264-c7192b9f6923", "comment": "Malware payload", "value": "6f5b1a96aa08d02986b01e2091679af4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785942156, "uuid": "88661015-b12d-43bd-914b-eea36720f66d", "comment": "Malware payload", "value": "197d802ca74c65714303c36b2a10aa57f7181e9eb3b8e4bfc1a41d052274cf2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785942156, "uuid": "2f9cb205-0ea4-4af7-8a2d-d34df5e4f9fd", "comment": "Malware payload", "value": "329d7c4799a78dab2939acb86a0bb59df5a7de5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785942156, "uuid": "89bbbca3-c2b0-41a0-91b0-78957b717c87", "comment": "Malware payload", "value": "cbabf61e30104f5f8690e1c0f21f56340073896ae9b35e9810f8b8f389d2939b05e6a1426d1d06ce6eb667554b6986f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785942156, "uuid": "b4cded9c-a2d2-4d4f-92b2-6f415d7f54d9", "value": "T1F2C623EA56D993B4C0535640798A83D670C1BA0D41FD4C2A79DB2D026B18CBF264EFFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785942156, "uuid": "73b01e52-3d9d-4b0d-ac26-fe0dda0371c8", "value": "f6d2f93e23a78f55fa491af29e7addac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785942156, "uuid": "5deb112b-3c26-4ed8-bdce-28ac78ebcf2b", "value": "196608:mk+ufYFmKUKcL+Mhcjo/wIYaLK+mkFFlQuja8sv0sm3VNqeyu8UgFCgPe+u:FQAKUzqMaj0uakkFFlQ2aXm3VwTIB+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785942156, "uuid": "3db853d0-44e5-4a38-8ca7-e94be487ca09", "value": 11674000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785942156, "uuid": "d95e0533-1a0a-4e61-9457-e1940a9cfd40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785942156, "uuid": "9730d0f8-5cca-4315-bef1-baae5884b0d1", "value": "197d802ca74c65714303c36b2a10aa57f7181e9eb3b8e4bfc1a41d052274cf2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e06a22-90dc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785941222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785941222, "uuid": "af9ce760-18ab-4b57-bcce-b6f0b1b7d9ba", "comment": "Malware payload (AgentTesla)", "value": "8edd021f2e05859fc87c40cbae832c1a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785941222, "uuid": "0246fd60-e783-4446-8adc-6cb1af2cc5cf", "comment": "Malware payload (AgentTesla)", "value": "1ace1637c592ae3779104f804ba54b1de737fee1dfca4948dd908b6243363a99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785941222, "uuid": "fa78dcd5-b53e-4c16-a8fa-2040bc601e5a", "comment": "Malware payload (AgentTesla)", "value": "4733f70c0d80db1a0e5e86444317591ef0933ca7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785941222, "uuid": "453231c6-3c20-4cad-92b4-d7dacdc94281", "comment": "Malware payload (AgentTesla)", "value": "f40507a195820f2b27fc702abe8d21d0597b74159b0ef18b1741968ddde5ea55352b2e668851e140bad3e9178c0659c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785941222, "uuid": "42528f42-c309-4253-8a7c-9a45aff52f17", "value": "T139D508812785C1B3B724AFED613ACE31AA0EA01314C2DF44756CE709762DD5FB358AE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785941222, "uuid": "7b7130b8-2f1f-4f41-8f70-0a27b79052ce", "value": "49152:KDl/i8ZgTEladAv7pLc6wO8FoFlGLOiFiG+rpZALXakX9UAvbSyxoXC:KRi8GTQadO7pLc6CCFlGLO6iZrpZADrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785941222, "uuid": "a4b0ed93-d901-4590-87ae-aed85e7af880", "value": 2961466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785941222, "uuid": "5a4c2c59-ee5a-48cf-baab-e1f2460da993", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785941222, "uuid": "2af48eed-92c2-422c-9121-3dbf1abdcd3f", "value": "Architectural_Floor_Plans.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4bc783-90a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1785916892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916892, "uuid": "19fb0fcf-c4b8-4819-8777-f0458f58cf28", "comment": "Malware payload (LxBaseRAT)", "value": "9320c29db2ee3a84415f4f8b808fdac9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916892, "uuid": "6ea00bf6-ac5d-4290-a73b-17339f768512", "comment": "Malware payload (LxBaseRAT)", "value": "1ae749b9819f08931159384cb5dc68a7631dd51228b2eb4dd549c7df3050d5c6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916892, "uuid": "6866589a-f805-4a08-a406-82998fb1aa4f", "comment": "Malware payload (LxBaseRAT)", "value": "a6554b90f558290521fb2a29dda2c05d404aecd4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916892, "uuid": "90191f18-8ab6-4952-8010-3fe50ca0f47e", "comment": "Malware payload (LxBaseRAT)", "value": "56570bc3b10bc986e9cc970f63a90e3f2798c62c409a4e620ae2656d12b6e75d7ac7c69d3070f722da2731512cacaf17", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916892, "uuid": "ebaff59b-c7f9-43e3-85e1-24f08b0a122c", "value": "T1A4058D4A7FC3AE3C5175CFAD9119F371F0CE7DA0C2045417A726E2AC16A208AE97961F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916892, "uuid": "41a58b2f-0b2c-428c-b630-e16bf1482cd5", "value": "12288:PHGg6crrNn2hPO1IF+AK+gOMsW4vOlJolTcWxSbHOzYHmp1xFLqDo2cwaOhWFoP6:PmgxJ2AAn9VqBTtQ/g/WFK0m9av", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785916892, "uuid": "4e6c8f0c-92b4-4d16-a63f-efa401e796d1", "value": 817928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785916892, "uuid": "506c974d-f76f-421f-ab7b-74a26fe15768", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916892, "uuid": "7c5b0d73-9b6b-44cd-b177-683a95b20ebd", "value": "\u0110\u1eb6T H\u00c0NG _GI\u00c1 M\u1edaI.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9249af96-90a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785916763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916763, "uuid": "cee8f7d7-8ec8-4501-9011-13a030b25fa1", "comment": "Malware payload (AgentTesla)", "value": "0768fdd4e05aa270c908cbc9cb5431e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916763, "uuid": "1e63440f-96fe-48f3-85e4-02b13492aa41", "comment": "Malware payload (AgentTesla)", "value": "1be0f85720768bb578c1a8f60b7b8955b7ee85349b2cff0ff28ddd5f6243de64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916763, "uuid": "16d9356e-6e40-4dde-875f-de6b89803170", "comment": "Malware payload (AgentTesla)", "value": "0ee27e3aa2a63a92b4615679d5863d134ae8b0d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916763, "uuid": "9fa8d667-e0ab-4864-9880-778d58f3e144", "comment": "Malware payload (AgentTesla)", "value": "8387502e9db0c84c0d059eef211a7b92ff8fc54d75fa2d836ee488614fb61f19e0991d086c68febbbbd03ec8ffe9ff37", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916763, "uuid": "a296ebba-23bf-4474-af4b-ecd40892134c", "value": "T1B9259ED33FE04612D4021A62EC3D982AB37732396D54AA453F3D3FEC145EA7678499B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916763, "uuid": "da4631fb-920b-4584-b1fd-aa1c9b0b9c08", "value": "384:rp0gHgubtSDp5bDxHRX5DSbHGDStp5rRoRGH2opcEERDpeRERg5DxDpDXcRH2RGY:ul0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785916763, "uuid": "046119f3-87c1-41cc-9ec4-1b33d4bd4792", "value": 1038964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785916763, "uuid": "c34b2840-5425-4557-a4d5-e8588ef3d22e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916763, "uuid": "025057ad-7aad-47a9-bfb0-11b4a5ec667a", "value": "RFQ-GN0948.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d6c676-910b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785961524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785961524, "uuid": "97120e4b-796b-4557-a146-f7605c09706d", "comment": "Malware payload (Mirai)", "value": "0d2c569f48e816116420d1c7ea2e339f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785961524, "uuid": "2a52f8df-bbaa-4836-bf3a-4cda61000acd", "comment": "Malware payload (Mirai)", "value": "1d73e05dc57be92556585d06299e706a7dbf66203d5770f8dfdd433481b87ac9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785961524, "uuid": "c7b55d1d-271f-4b10-9a23-9d17cb4dff4b", "comment": "Malware payload (Mirai)", "value": "d0280ac3e12e9629b28aabeec21c5fe2337b4e1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785961524, "uuid": "d9137306-7a76-42cd-a9cc-ec3334daa41a", "comment": "Malware payload (Mirai)", "value": "6d82c32a7d69096c1af1248ecd49ab9c8b7571cd018b66330b1572b54bdcbdc35a86f9faffe7f7061c6affa35238361f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785961524, "uuid": "21e2f0ce-3f7a-4fae-b3ce-47a036f24d52", "value": "T16C4302A1C711F87FD3E0883E6CD13D91A3EE193E3C2FE57518529594E3C484D66A8179", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785961524, "uuid": "abf41c3f-6332-4d2e-ae96-0c0ef7c73ff2", "value": "1536:toFXjDxb0jv6N6VkM7qTpl+x7/vWwSOQU:CFe6NK4ll+x/vr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785961524, "uuid": "e662e963-f66a-4ea8-82b5-9dfe0af1b78d", "value": 55536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785961524, "uuid": "46648610-584a-4071-9680-56f52f0c9158", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785961524, "uuid": "5eb562e1-1b79-4134-b067-348257b1f3a8", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc5f6be-908c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785906874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785906874, "uuid": "79a3d1f7-6449-4287-b126-bdc1e9762ee2", "comment": "Malware payload (Mirai)", "value": "dd75412c1d66b40789f07eee37cacccd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785906874, "uuid": "9eae814e-034c-4c09-b23d-c1d73a7cb568", "comment": "Malware payload (Mirai)", "value": "1dec6b33e187fcf1b388ebb504a58fab2ad30d2f15f62d235029ccba72766b03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785906874, "uuid": "f7fc5126-b309-44d2-8429-86f1f353fb2b", "comment": "Malware payload (Mirai)", "value": "33ce27205921c73c8ac944829a1829198e08b642", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785906874, "uuid": "719c6cc4-4116-4de0-b61d-dc280f91dc76", "comment": "Malware payload (Mirai)", "value": "732b9b8b1aeb0d1fc9deab9b31057b14c8149220326fbe08f3d0f858b1877375cc93dbd984ad509f9bfb0826c28b8e09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785906874, "uuid": "e6076502-3de9-452a-93e1-91dd814ac477", "value": "T1B75301EE014A6528C9B23CB2B8105D50F56EF059DA254F4806D4B3AFCCBBEAD36E0F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785906874, "uuid": "00db6bd4-c51e-4826-9b2e-1b699492a164", "value": "1536:r7G1hcFf21hun5WzDTz2EXpyHpVeF9g0gp6su21d:r72iysn5WXTtpyHp4FW0Cxu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785906874, "uuid": "9fc001da-dabb-42e2-b5b9-ff7806640443", "value": 63956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785906874, "uuid": "e7af213c-b168-41e6-ad62-c86f4ee3306e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785906874, "uuid": "f988f70c-e054-48e7-b092-7fc2e71e73e4", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32399759-908b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785906294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785906294, "uuid": "16a9adbd-a08c-4097-95c3-197e0fa234d4", "comment": "Malware payload (Phorpiex)", "value": "20d3461c6fa4e369c23252a471aaccf9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785906294, "uuid": "e17ed7e9-da07-476f-90c4-5a3a88665593", "comment": "Malware payload (Phorpiex)", "value": "1e5fb0977788c891046b9e28491497586fa98ee8f693fb1bb97fa34bce92e09c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785906294, "uuid": "9f0d1f12-18d9-42f1-98f3-00a02c8aa5fd", "comment": "Malware payload (Phorpiex)", "value": "40a6727dd2e6d2a2108deba298fc710f0b460ce4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785906294, "uuid": "160d86f1-7824-45f1-b0f0-90da11603c2a", "comment": "Malware payload (Phorpiex)", "value": "09206cc6c584805e4ffaaff87092229bc417e53b3a1586477eb1fd916ee52fbc58ce46f759e23fe48175c28bb5123d68", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785906294, "uuid": "4cdf6b5c-aa4b-4cd3-962f-a8110a75fd60", "value": "T114824B0FB9414316D0E11070A276567BDA79A8B6378414DBF7E48AED0B686D1FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785906294, "uuid": "24b71347-aafc-45bb-b76d-f07423fdc361", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785906294, "uuid": "3defdc48-01a5-4215-a3a5-cc1e9667f0dd", "value": "384:4T6I8vVaF61SYUQQlmLu94gXTc4lmxav8U9c3l:4TPkUQQt9z8a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785906294, "uuid": "ae7bab15-5791-48b0-9f76-f61232ff3188", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785906294, "uuid": "d8086d29-8281-4166-a842-ad9407b0f6bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785906294, "uuid": "9ef25b16-3d3a-4a21-9e2a-ffac3c9dead1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e88556-90a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917143, "uuid": "347b1308-e68c-496d-99c5-0fb1503bfb1f", "comment": "Malware payload (AgentTesla)", "value": "a697412ee75341f29bcd94974f7d7ff4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917143, "uuid": "bfc63dfe-4486-453a-b058-e67f5531c1c7", "comment": "Malware payload (AgentTesla)", "value": "1ec9722d269c5640ab1f5070dba5250c7b7caac6aa61075e3511588a9a92a085", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917143, "uuid": "70e74c72-ae23-4fba-8a69-c9e40912cbd9", "comment": "Malware payload (AgentTesla)", "value": "0320810f3bd20f56c3ebb6f7b9bf8d2cd2e3510b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917143, "uuid": "609d6243-d42b-43ac-b049-5c236c1bfa6d", "comment": "Malware payload (AgentTesla)", "value": "0385d9d1088801d072f93beb097a501b344daa10d527c8afad8e10448204dffb226b7204ce928a05675213888f50d270", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917143, "uuid": "78b1c546-b023-4281-822b-a4bfcc735302", "value": "T113D5E6C12B8491737720BB9D663BCE35990EA00369C5DF41326DE718362DE4FA398ED6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917143, "uuid": "39b26c6b-bab7-4e62-89f9-2e70753ed4e1", "value": "49152:n35Q0mvlnWR7e+WKuc2HnljWOzqs2psiinIZ4W5ke3IDeisLEBeBDn:AvoA+WU2HnljWO2zpsiinIqW5ke3IsLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917143, "uuid": "84bd3a6b-ca53-4fac-9f66-ca30b85c6b85", "value": 2961466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917143, "uuid": "76b84763-bee2-4ad4-ad0b-ae7b2f15951d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917143, "uuid": "c139f81a-cb0f-4996-8c92-36ab96a6bf49", "value": "RFQ # TSL23-5453.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0677b193-90f3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785950888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950888, "uuid": "8c78943a-eb4f-458b-8085-5c6412427ae4", "comment": "Malware payload", "value": "4be2b5631558ac55c2f6825f5215fd9d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950888, "uuid": "f50e8e09-995a-44e2-82ff-4e3dc227bacb", "comment": "Malware payload", "value": "1eedd6221c6bf274973b179e82533e0ddd0e7ac0ff19ba290ece6ebd859d7466", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950888, "uuid": "5c6461df-ef78-4f77-a3da-b22fce919326", "comment": "Malware payload", "value": "794916e83e22f97c2fcddd2ff0b5a941332bb0d4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950888, "uuid": "9b595288-fc1f-48dd-9b2e-8028c8772341", "comment": "Malware payload", "value": "da32f1106975f302528885e6af4ef664f6dc7ad057adc4b83ec3c03c1abbda434be98e687af324029694b94a7c1a3a6a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950888, "uuid": "b341abd7-f1af-4e6e-aacb-4fcf9e695585", "value": "T1E1314C9E44085A391226CBCEB3663788E00DD1EF3C5BD7E4DC581EEC82482DCB666B85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950888, "uuid": "405a010d-efce-4d1f-9d08-9adf3e1335f5", "value": "24:BUBNTEx+AY9OaQ9DiLk9na/YGQJ2Ffuy2M:SBOxHYvaaFQJefu9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785950888, "uuid": "71e41f29-752e-4789-bdd3-c57904f7c5c1", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785950888, "uuid": "e176a13e-2024-43c8-bb82-364afbf299ab", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950888, "uuid": "f312b3c5-3350-4d65-8733-af708121d290", "value": "1eedd6221c6bf274973b179e82533e0ddd0e7ac0ff19ba290ece6ebd859d7466", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dccdfe0d-9088-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785905291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905291, "uuid": "1e799415-12be-44f8-a4f8-d8b4f69b41a2", "comment": "Malware payload", "value": "cdeb89119f50f1e074f6c652deb67480", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905291, "uuid": "b70c9017-d95f-4dc3-8529-b3dcdd7fbd71", "comment": "Malware payload", "value": "1fb5fbf014b4bbbcff71375eabce3cd7b1e68d06f12fcfede5d6b6831d05d1d2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905291, "uuid": "861588d4-b666-44e5-b2fe-40cd272eba2b", "comment": "Malware payload", "value": "f75596c2dba00be92b36c703ca237f0e3cbce1de", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905291, "uuid": "782a664f-2a18-4bac-b3d8-92a9dae715ee", "comment": "Malware payload", "value": "ef36e2804ad439c360d1d80d4291b83f532213c93a714f402be4209b32fbeab045349083299945647f361cfd914b9062", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905291, "uuid": "8b6a865b-f8aa-499e-b732-bfe3f8bea993", "value": "T183C4095B75D98FA0C49F5BB8B09048983B34B63B88DDFB5F0A8449B4EC57750C6CE0A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905291, "uuid": "253ef213-0e88-4c5f-8fd3-6c119b070684", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905291, "uuid": "fa66d3d9-7a10-4fff-bd06-feae62630109", "value": "6144:3gRWgpzB4fFTMD2aYNcjw0WlEEJklEywMj7GEu/6dTUb3PFo4kZY:zTc23ceMGOjir/6dso4kZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785905291, "uuid": "5e0eddd2-36b5-4c8a-abdb-d0ba1296df77", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785905291, "uuid": "dd00677b-e672-434a-8c9a-c2181c07758c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905291, "uuid": "5c3fa637-4db5-4168-b81c-55ec0546d6ca", "value": "payload_decoded.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9fe6c0-90d1-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785936616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936616, "uuid": "560bedca-56ed-4869-ab87-e58d372b5110", "comment": "Malware payload (ConnectWise)", "value": "d7312c3aaacad42943e2b2cd4a8ded7f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936616, "uuid": "d08cbd1d-a453-489e-8ae1-06eb7f176593", "comment": "Malware payload (ConnectWise)", "value": "1fca03a7c77ad940b8f88e98640c2fca70f9e555780bcaaa3c8561f888e7e01a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936616, "uuid": "4fff88af-9a77-4d06-8bb4-14864a5d42ba", "comment": "Malware payload (ConnectWise)", "value": "5779815c35b028ebc4e7aa8b2bb2d1b8965741b0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936616, "uuid": "6a7a2818-4d36-4927-a23b-8e63f559ba8e", "comment": "Malware payload (ConnectWise)", "value": "4ccf36a67224d02a34467b1682e361c79006253259c460304bfe3c5a6f5e175656a9f5a6cd6676d47bc071433d899666", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936616, "uuid": "78671efc-a941-480d-ab8b-c78fb1ae08e2", "value": "T1D2C623116BF89678F1F22A35E876A0B1A5367C119E23D12E2324791E2C75EC0C9B3777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936616, "uuid": "86f1aa49-85fd-46fd-a4aa-a1c3a5a400a4", "value": "196608:PHxcp9ym3nltDUJVBHxcp9ym3THxcp9ym3GHxcp9ym3rHxcp9ym3MHxcp9ym3:ZGplpCGp9GpUGp1GpqGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785936616, "uuid": "06c9fd14-9356-4c0a-a4f7-a4b3f1f33a49", "value": 11685888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785936616, "uuid": "c6e915e6-1632-4ba4-80bd-722d15765c66", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936616, "uuid": "5a1c1f4d-1838-4a66-8e1d-123351f03eff", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f9c690-909c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785913768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913768, "uuid": "40c61899-c382-4f6d-a721-c19723d3131a", "comment": "Malware payload (Mirai)", "value": "971a13ebbe8754fcd9a104a045ba689f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913768, "uuid": "92570f65-1ea6-4c21-8b8c-070382b82e2f", "comment": "Malware payload (Mirai)", "value": "2070b0b03ed9e0e3ade00d5fe0749f9221d20b994a95fb39860d71e050293512", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913768, "uuid": "857dd65b-ad12-4d4b-a8f6-1902d2b2b09d", "comment": "Malware payload (Mirai)", "value": "e3ca7e6a1bf6c312342a6209410936d13e8f3d32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913768, "uuid": "15e30a79-7a05-49c1-94d0-73a7512c1a3c", "comment": "Malware payload (Mirai)", "value": "7ec77f25c16a6ee4cc81c302b3639b0ad49970501cc83add66f642a091c8a473f2425d14dfba70624220160bbcdd2a5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913768, "uuid": "340b6610-a96c-4b50-8b70-3f1eb570ac29", "value": "T13083182ABD41AF15D0C536BAFF5E524933532BB8E3EE7112DE146B2427CA91B0F3A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913768, "uuid": "31003406-bd1d-49db-9961-db732e5042d6", "value": "1536:MjnZdJFb5iX6gVNuGrjRe9RqSDvTRBKhYU/QB82mZ0g5dlEvig1N0jb:6dJJ5snjQBKhR/QB82mHazN0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785913768, "uuid": "a667aa5f-9b98-4894-8076-fbdff231c04d", "value": 85724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785913768, "uuid": "d77b43b5-c717-4c41-9402-c872ea8a7c86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913768, "uuid": "0b575970-c8d0-498f-aeb8-23482b9e8369", "value": "I45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f833fde-9074-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785896384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785896384, "uuid": "f098a4ec-13f0-45c5-8810-d9ceb09f0f7c", "comment": "Malware payload (Mirai)", "value": "c1bd9b2e7d6c48633c6dc7d211f768c9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785896384, "uuid": "e1ca9a7b-0afc-4498-adf7-70b85b2c28e2", "comment": "Malware payload (Mirai)", "value": "2272cf84ed710394a08d70054cf2f54e96fd65af399e5addfcfdffe284266a56", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785896384, "uuid": "28f27c38-2c34-46ad-8c9c-cb35cb5174a4", "comment": "Malware payload (Mirai)", "value": "939e7866ea439680b944b28f362712f042ca6e69", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785896384, "uuid": "4b4c292c-3c8e-4fa7-9770-52a6f46da8f9", "comment": "Malware payload (Mirai)", "value": "b0295ba84e99008e4189f7c7442d34a2d1c4642525d122513a45a3afe3108855bf081ce04a63eb2fc50c1936b79427dd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785896384, "uuid": "61cf2651-c4ba-4076-ae0d-df60abc56cd4", "value": "T141C08CC706117B2080E96C2C7296802E828B862035E00F4EF8BA0612AE8A968F830B01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785896384, "uuid": "7e2ba98f-0789-4fdc-a168-9294de1584c7", "value": "3:O22exARiZejeIVA3FOdJ2GL9rSaZejeIMuBFS/TWUKT6VVI9LJdvvvF:O25LO92GLNSkOMsTT6IZJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785896384, "uuid": "16b61760-75f1-4ed5-b875-d93d545c237b", "value": 162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785896384, "uuid": "92529b92-f836-42eb-8cf6-1815364ac812", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785896384, "uuid": "a5e15468-ac2f-4383-8370-b9a7eb979a55", "value": "lterouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7c5faa-90d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785939164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939164, "uuid": "19818aac-b9c5-43ca-8a1b-2981672a57b4", "comment": "Malware payload (Mirai)", "value": "4fc531c042f2af248c79020158d4fc4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939164, "uuid": "7bf4a0f0-e5b8-40ae-9e0c-0a3fd860a67b", "comment": "Malware payload (Mirai)", "value": "23c9540df000ae1e50dd5977c24b1f8b96f3d8c858696bdd26d2f2e0a9ce4730", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939164, "uuid": "93482d36-c47d-4e5e-8e23-5f2425659f1f", "comment": "Malware payload (Mirai)", "value": "6bf13719c96f67c7a3bb56bf5419bb8cd3a0b806", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939164, "uuid": "c354f2a1-df66-4efd-ae26-9a13042151ab", "comment": "Malware payload (Mirai)", "value": "0dc4edf7b745fcc42574e14b792300e169b4bdd8f92ef4b42a7ecb21f548e9ed8c903ceeb602a9a3013c9e60cb052cbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939164, "uuid": "7ceeb608-ed5f-405e-8274-5103e2ea409a", "value": "T10A538D73CC396E54D24945B5B8308E781B63E48482471FFB269AC67A9047DACF6093F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939164, "uuid": "b6f3ca54-426b-4a52-9745-1a88c5b8321b", "value": "1536:FaJwtgMYFft6AaVaK0XEgFGIdFCen5wI91a:FKGYpt6lV90BhdFNWM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785939164, "uuid": "70bb2a6f-54b3-488d-b892-9a50f3952f94", "value": 60848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785939164, "uuid": "108b6e29-cb1a-4329-9077-680dc6ae38d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939164, "uuid": "364d3024-5b07-4e8e-a908-be78c11879a6", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e375ecdb-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917758, "uuid": "a0725d2f-6b5e-4e35-a7cd-34914221f03b", "comment": "Malware payload (AgentTesla)", "value": "881fd075505ef1404eedddc7217ab41d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917758, "uuid": "d1b35793-9db7-4bc3-9723-8d6bbfb14dd9", "comment": "Malware payload (AgentTesla)", "value": "243702bc07e2c666ad7fef0457748b7b1bcad27dc9733fd24f44456382e50a67", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917758, "uuid": "e2a2f621-7863-4708-b242-95d635eacdde", "comment": "Malware payload (AgentTesla)", "value": "87742246268ffd9dfd315718f0ca2c7a3b03e691", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917758, "uuid": "8d70bd28-b51e-4f27-8d38-1890fd79dd79", "comment": "Malware payload (AgentTesla)", "value": "663661c96e1b9a6536a6405b05a0dded92a13a98b9b27f769075f0cfa8f46b1dcf835b116a9e69a0869e90e4930529ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917758, "uuid": "5f0615d0-6d77-456b-ad9c-e1ae282c2f99", "value": "T1FBE5F7812BC8D1727B20BB9D923BDE349A0FE00315C6DF50765EE608361DD8F6768AD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917758, "uuid": "b0261146-f8cd-4ac8-bd98-d92c58263d67", "value": "49152:+/ZvR7H89Cl2cl76wCrdVEBR0p2v80XCkPdKmFjEzZkWwYtmYZvXPBqS5TYBO3ra:+/ZvVcQ7l76w+VMR0Y00XCkPdKW6ZzhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917758, "uuid": "90786f16-587e-42df-9bfa-1eb9e2775135", "value": 3041778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917758, "uuid": "2191766b-50e8-4ef2-870a-baff980f783f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917758, "uuid": "6c32412f-cce2-440f-9903-730b1b33ff7d", "value": "Documentos de embarque \u2013 BL e PL.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6382287f-90f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785950615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950615, "uuid": "054ce3ed-991b-4abe-b1ff-a31d8f819c0d", "comment": "Malware payload (Mirai)", "value": "181850be4db460984cf71a49f8a9cc33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950615, "uuid": "8e18da2e-7821-4a33-aae5-73721b8f8862", "comment": "Malware payload (Mirai)", "value": "25478a9071197f02413da108ed6a4a18fcb343c0fce7bed73aef5993cc3c0ba4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950615, "uuid": "5fa99945-0bd0-4627-8b5f-77e0fd6f02ac", "comment": "Malware payload (Mirai)", "value": "b7436699c0668ed8044bec6e896735c79b51e2c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950615, "uuid": "a5b5c02b-7736-4562-97d9-f18eef8ff375", "comment": "Malware payload (Mirai)", "value": "938a4f5214b0d87efcb76313cb93fb09dcc5b67c2c478552ffa9336d6f5b3a7d4a728aa7c4bbe2f4e48b7f7a2771d98c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950615, "uuid": "d231c9f8-4c81-40ce-a8c0-af7c55cfafe4", "value": "T180043B49BE642BFBC06FCE700529830621DD944FA2F6B779A678DD4CB99A2481CF3C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950615, "uuid": "2853be60-458d-4b7c-95f8-84b6a392ab7c", "value": "3072:Kq4/qEQUzNxSp2ktX029SGEaP9KQJn1Dy2+Cj6na0FGA+H1DB:d4/vzNAp2ktXX9SGEaP9KQJn1Dy2sna5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785950615, "uuid": "995e908e-acfa-4255-b2e9-55b276c9b9ce", "value": 180924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785950615, "uuid": "704f7dba-3b14-4f45-bb52-b5476dd67961", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950615, "uuid": "7a276a09-d331-442c-a415-83e11e1fbb33", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c71d52f2-9089-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785905685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905685, "uuid": "e2effa7e-7669-4039-a83b-83cbeb68a72f", "comment": "Malware payload (Phorpiex)", "value": "d7f93ae530fae6639fe63cd77ecbb7d3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905685, "uuid": "4f6aeace-0828-4513-aa48-1b0a67852736", "comment": "Malware payload (Phorpiex)", "value": "272ad0be207b03c49e9ddd59d3319d70b855ca61643a8e3e8b44f0465061126f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905685, "uuid": "a154560c-4b8f-4c33-9af4-6d9763ff92d1", "comment": "Malware payload (Phorpiex)", "value": "c488d12c4c8975c6746292120725d192ddadeaa0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905685, "uuid": "397069c1-8058-4f85-8be8-dffaf50c64a4", "comment": "Malware payload (Phorpiex)", "value": "11fc40dba126e083a68875c5cbe6f2d6fa9bba7f3cecc14eada464642117db909fcff04bccb448f99d57e91f2807ac4c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905685, "uuid": "4444d97d-04d6-4baa-bdbb-1c78baafa915", "value": "T179624C0BA4818036EBF14474927F526645FEACB623C5F9CBF7E068894AB46E1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905685, "uuid": "040bdbb9-06d9-45d6-91be-0bfc9cc70e22", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905685, "uuid": "767f1f5e-8618-4df0-bacc-841254d533c4", "value": "192:AWvsGnjXgjk8LcRI+IdJDMBIfeF5oIV1BKUSfEzQ8d1gJxTmv8U9cthJ9ik:AiScqpferoFE1yav8U9czX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785905685, "uuid": "ffb44116-6238-49a7-a828-1e04661c224d", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785905685, "uuid": "7d243589-efad-4503-b8be-1c29505c2be5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905685, "uuid": "98334f40-b9fd-4748-b9b6-3f5b715b5dbc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61636e42-9101-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785957054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957054, "uuid": "1209a1e3-19c0-40c6-8fa0-b73cfedc0cf3", "comment": "Malware payload (Mirai)", "value": "795c0f145f5b733b39e758bae7de9a12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957054, "uuid": "2838d384-823c-4220-bc99-653ef6d337bf", "comment": "Malware payload (Mirai)", "value": "274c944a3fb5fa52fce567d2d10b330838c9584762e8f4ccfc09a2b6d54b12d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957054, "uuid": "fa5dc178-c343-4d34-9874-a8cb8d2f5c11", "comment": "Malware payload (Mirai)", "value": "53bec35bc43d23135e878e9128d697f74369e528", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957054, "uuid": "d7556223-f8b9-4a1c-96ec-1d89dff844b6", "comment": "Malware payload (Mirai)", "value": "6e2ab4ea8471435234e96b5c0ba629b225bcbcd2df224d6776eb87d9f6da16309ad8b46aa6b6de559d6948e8dfe266c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957054, "uuid": "d3a2a561-a454-480c-a46e-5a34b3614c22", "value": "T1FB43F1B263898E40C4BA1676E42501A1CB5D7FD2E6483D7EB831C19C77D34BE3EB5582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957054, "uuid": "9780622e-9cba-4f6b-91b9-3a3c3fa8e56b", "value": "768:F3ufMePGdkQ/nOyJP+c5/2858MC0lxXPmsU9mXrpSo07/HiZdDfS/P3U03wfTS:hufMeudkt+H5/286SxX++g7/HSdO+fTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785957054, "uuid": "21760e21-5cfe-47d1-b036-7067b1753598", "value": 55788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785957054, "uuid": "2102001b-fd3c-415c-9f88-ec5c8729f4f6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957054, "uuid": "98018fe8-8e9e-4ec8-87c7-c710107b0eee", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ed29ca-90a1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785915776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915776, "uuid": "11110bd1-09f6-4e4f-88a8-fa913cd08459", "comment": "Malware payload", "value": "1c301cf396b2bf57458e057b24e50213", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915776, "uuid": "ed825952-4588-4d22-8bb2-d3ee33b09f74", "comment": "Malware payload", "value": "27d657176b8217b7ac3cf5e38f49b8ff064dcd9fc25759e351ae014b015d35c7", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915776, "uuid": "5888403b-e11e-432b-9d65-4fd4d5503153", "comment": "Malware payload", "value": "6f646db834cf1d9fe8f9cf11b1d5666f77eaff06", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915776, "uuid": "3e6bfa99-216e-4356-9b62-f480f241377d", "comment": "Malware payload", "value": "57cc586b3970af9a99eb67fb76c174e40069253c3fe21c9978a88d749bedd85725c34652d7e5576d95b5c09fc5d55a25", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915776, "uuid": "2e304625-25d0-4295-8476-762c65f6d06a", "value": "T18035122BFF0C8035F68361F8E21AEB446482355F488574867DAB69BC2F5BB2D97406CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915776, "uuid": "ef8e8716-729a-4258-9310-e5904c90bf9d", "value": "24576:gPGPHupaKWEzGZqOALOLs+W9Tz5DHPQTJsvyOP+pBXwW:ARfpLdXNHPwJr17wW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785915776, "uuid": "466e8947-652d-4e35-ae6d-91a86b624b95", "value": 1143760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785915776, "uuid": "6cc655b6-5737-4d63-98c8-4f71070138ef", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915776, "uuid": "8dd7e3af-97b7-4ff2-97eb-d569ef4a8a39", "value": "CensoLocalCed11_2026.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96792ffc-909c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785913763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913763, "uuid": "add80767-7122-4074-bcec-ceefd58e6e56", "comment": "Malware payload (Mirai)", "value": "ea99fc6d6630dbae40daaf6fa99ac988", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913763, "uuid": "7466f1e3-d388-4fe7-a416-a0fe9ae98ab2", "comment": "Malware payload (Mirai)", "value": "27e0a532f57eaceadfbce3ce0154fe314a33fb15a8f6b2bbcec1a1ddbcd2884f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913763, "uuid": "cdab1f3c-8812-4c18-8eed-750caec82b0b", "comment": "Malware payload (Mirai)", "value": "45f0f304cef305767546e6b5df6f5a91627e3da2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913763, "uuid": "0f5f2067-8449-4304-b729-4677d4e12602", "comment": "Malware payload (Mirai)", "value": "d4c3c70fa85ac06fddacce7d370db5d28850979815047818115344041f1181d839602add12fc797e2b0031dd96f64e1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913763, "uuid": "bd42d089-0e8e-4536-a905-0c977a5ca9bf", "value": "T17D733A16B8459F1BC2C2667BFF5E8388332727A8D3EA3103DA156F61379F51A0E2B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913763, "uuid": "47fb89ee-df46-4db1-95aa-92e708deacb0", "value": "1536:bD+nwGmeVUjmf8UI2mmRiLU8XupyXe8G1X36tvXIYyeZcQ5F7EonZLdi:fIwGmkumf3IuQLV+YXe8mXq1Xmgz5F7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785913763, "uuid": "c232705c-37ce-43e7-a757-83af0345ad44", "value": 75244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785913763, "uuid": "4520a9f0-161e-4f97-9a95-29bedca05d18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913763, "uuid": "ca3a372a-3026-4161-ba4e-bae9bc3913a0", "value": "kvJM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65cf36c7-90c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1785932150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785932150, "uuid": "8b4e4b83-7020-4538-9065-5edf70b6a916", "comment": "Malware payload (PhantomStealer)", "value": "ea38b7ce3db67ad4398028718af6b0e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785932150, "uuid": "5cd71ddc-e986-42d1-8c1d-3189af1f0c9d", "comment": "Malware payload (PhantomStealer)", "value": "28359d2d8054f8650bfdb99aa395ef2bba62846005e3f4748b2aca8f173f8bcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785932150, "uuid": "d4381b07-3d15-42e7-97af-cc52d2445fd8", "comment": "Malware payload (PhantomStealer)", "value": "0990c8cfa97a5ad7e1a0cba45cb51456df39fdaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785932150, "uuid": "564951b2-593d-4bb0-ae15-7eb3e2832f59", "comment": "Malware payload (PhantomStealer)", "value": "23f285019de4b27f169a09d630edcd63da1810585c39e2c06939dfb22e78847eec23a362d02bb07d65e54f846236a443", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785932150, "uuid": "e008e681-6e51-44c0-b1a0-12aedebd9f44", "value": "T15506C381274491337321AB9C5336DAB2D92E12A314C6DB0A717DE2197F7CD0BE358AF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785932150, "uuid": "d7d52dad-6d1d-4709-bbb1-432be60af862", "value": "98304:YpQRiM1arm2HEBz9lg8U1vIcF/nqaH04XwIEqg7oaCg3nrB1Hx5fEo:YpQE/2TgNvtM4vEqgxVd1R5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785932150, "uuid": "c61feeef-8d1f-43b6-a345-bed94e9b896e", "value": 3954650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785932150, "uuid": "f6ecac79-3e10-4078-953e-80f3b46e3b08", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785932150, "uuid": "24458f8a-82ea-45d3-80d4-44310756ec66", "value": "RFQ Q26-1149.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b279ba-9072-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785895695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895695, "uuid": "75112760-db9f-41db-abe1-ceb353047228", "comment": "Malware payload", "value": "a0489fc28cfb85f9d9c91dadd6fc2ca2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895695, "uuid": "97eb4543-945a-4cb2-bc9f-9d575806da60", "comment": "Malware payload", "value": "28b4e8084fd3eb35aa0fcf362c87c43b7b380379643c209b40015e744f5df425", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895695, "uuid": "5b311255-11b0-482e-b254-ada2d0cd07ea", "comment": "Malware payload", "value": "d4db10357add1bd38a8ac0a7491946c8a3b4fa57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895695, "uuid": "9d871a4f-f693-4e7c-b4fa-a8036e774f30", "comment": "Malware payload", "value": "e01c8925eb655506fb52f3c5bedc97fa13a1ad6bf03345f21071aa74b222882c6fe17385e616fa1d1b9dabe7e368f119", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785895695, "uuid": "8048b361-4c38-4549-b624-dcf3c4e03fc3", "value": "T1D8B31263B9C01F9366B3AB65E801A00B53627D9490072F3DC669FF2D5193E9C09EE4D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785895695, "uuid": "4479ed9f-6836-4ccd-b1ab-4949bfb38d92", "value": "3072:jGhGc30ZXifdC0e4ZJ+SZKeiIZZuKzDxWcxV7Z:K4c8XifdCB4D+UFJZZLDVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785895695, "uuid": "844833bc-6077-4263-bf7f-96435b305a1d", "value": 117796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785895695, "uuid": "118b145a-257d-4ae7-970e-fca11b396066", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785895695, "uuid": "652a1dea-d760-4d1a-a021-f860d3a5e723", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2bdd958-90e3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785944359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785944359, "uuid": "db92a215-de8b-494a-b81d-2d413558bd46", "comment": "Malware payload", "value": "11613bb8fb6dc08333ff9f809ac1010e", "object_relation": "md5", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785944359, "uuid": "04660892-7397-432d-9f2e-481a7302b3e5", "comment": "Malware payload", "value": "293f9be68f97b014973a66f8630b1aabfef01605d0005456afcec7270383f20c", "object_relation": "sha256", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785944359, "uuid": "899cff5b-2c33-4a16-bf2c-dfab88ecedc0", "comment": "Malware payload", "value": "353505feef691c789da0535e42d8a86f993d36e9", "object_relation": "sha1", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785944359, "uuid": "b514bcbe-9a29-4176-8a39-be325e185d61", "comment": "Malware payload", "value": "26daf9b0eac4665ff244914c3fb1d3c86c20044b2ffd4d6985471e69095a8c0d84f5fafb45decb8de0e997bc86eaedf1", "object_relation": "sha3-384", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785944359, "uuid": "12417567-b2ea-4ecf-a5ea-08bf6c376e4e", "value": "T11FD5238A69F71970DC7BC7B0DF42F51DB46A37948B628E0F76CD68908E624189D323B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785944359, "uuid": "c4780cb6-49a1-4e2f-9fbd-704d8a0b33fc", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785944359, "uuid": "0351c31f-5120-4b27-997a-698999a7f279", "value": "49152:FYm2Y30O8v8ya5DEVgfaM+U5QHPJQgx2qdobnC/Wd4AoeI+O5:FY7O8vouVqaNvHPJQgxXozO7A1I/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785944359, "uuid": "ebbb907c-69a3-4b5a-8c4b-0f86f522131b", "value": 2935296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785944359, "uuid": "68b3ed75-98c7-462f-b27a-d0d2eedab438", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785944359, "uuid": "a7194f06-daa5-4a79-b3cf-269f7b1728a4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07dae3f8-90f3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785950890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950890, "uuid": "9e87de05-6d18-4557-abf0-e5e75a7266bf", "comment": "Malware payload", "value": "e2965c97cc9be1c328e1bb318c489af2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950890, "uuid": "41a5170e-ff73-4cfd-a9ff-4d15747bad8b", "comment": "Malware payload", "value": "2a39d592018600e4b3db2caed6cdaa8c651d3dacbebf8ac1f0960e493843c435", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950890, "uuid": "ab5b9085-904e-4c1d-932a-f60df5689b88", "comment": "Malware payload", "value": "2287549c75fea293b780698d7692dfeb9c008759", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950890, "uuid": "89ef1db3-7174-48d4-89e2-aab2300515c9", "comment": "Malware payload", "value": "ebfc3969f336919cf3a0e367684a3a5fcaa423a6533826c365dbc721f46bc04cb74a2cabea94e6e9e77a460890f84c6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950890, "uuid": "29b2685c-85d4-4175-81ce-fe05c02de0fb", "value": "T19B765B73905624D8E1ADC974D5151213BEA8388B573863CBBBC076F51BBABE49E78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950890, "uuid": "b5d2be86-5446-48b1-9879-8af289157896", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQE:cqYUQuVDt0TZEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785950890, "uuid": "5e3a4a1b-aff8-49dd-b5bc-98e2602623e3", "value": 7569408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785950890, "uuid": "2bd82d09-ea62-475c-91f0-d285940fa3cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950890, "uuid": "7a885db8-bd85-43ab-bd65-7ef9c5d82fbb", "value": "2a39d592018600e4b3db2caed6cdaa8c651d3dacbebf8ac1f0960e493843c435", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c0029b-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1785917549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917549, "uuid": "4676275f-d115-465f-9156-cf20c870f093", "comment": "Malware payload (PhantomStealer)", "value": "0f488ea8c4e787da1f58ce597feefca9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917549, "uuid": "c5e4d442-8032-4f05-93f0-5a8b9ed81d5e", "comment": "Malware payload (PhantomStealer)", "value": "2a55457095a8ef73f426e69a7845ff9bc1a4d304a97ea8119b78bb435c0d62e4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917549, "uuid": "c5d06488-9c85-4da3-a650-b1338f1023e1", "comment": "Malware payload (PhantomStealer)", "value": "9acdc4f73a8278ea6229f24d096f5fb1bed36ac8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917549, "uuid": "003eed24-7ca7-445e-9abd-e6bafb4f4bc9", "comment": "Malware payload (PhantomStealer)", "value": "60084996d5edba2883cf117d8cacc6c81c55f495a0db6ad2b5f573a8c8c3ce8470e26c7b46576e1ef27bafd43fcffaa9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917549, "uuid": "5e02f353-d637-4078-aca8-e342b7efaced", "value": "T128F5E792274491737720ABAD563ACE32990FA01359C6DF48316DE308366DD4FA36CEE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917549, "uuid": "041efbe7-e79d-4ffd-9b66-4758e7e738c6", "value": "98304:a3hcMWNIJaPk7c6+iTLWU1zwJUjfOHC6Pw14pnsdVBClxsdRYoy8Wql9VT4S:cn4sc+PWU1wJUjfOHC64EnKPw+3YV8Wa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917549, "uuid": "984751b8-a2d2-4042-ab4f-a8d159b51c63", "value": 3574960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917549, "uuid": "6f821950-ff16-4a58-a055-1f1f0d4550cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917549, "uuid": "fcb43a2c-347c-4017-9ac9-1d5e80542f6e", "value": "Quotation sheet and details.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d3b094c-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1785917560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917560, "uuid": "2afe3589-1c38-4480-b735-1d20f62a0fc1", "comment": "Malware payload (PhantomStealer)", "value": "1a5e7288df7d7cb53718d59d2fa73847", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917560, "uuid": "58829501-3c6c-48fd-860e-26bcc4c47b18", "comment": "Malware payload (PhantomStealer)", "value": "2a5973551755b9107ea9180b613a9894e10aad9da007dad086c8645e4dedf5c7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917560, "uuid": "eb59f5c9-194d-429e-b7b1-67767ffd9584", "comment": "Malware payload (PhantomStealer)", "value": "9fa12ac68a7d3629a601d384518eb0126cccf678", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917560, "uuid": "49e0dd96-8c48-4447-be74-f086c6505876", "comment": "Malware payload (PhantomStealer)", "value": "d155d8651dcb3f57291c106ca8b4d3424170ec814dad891578e39f227411d002e37b08d9bf24f06c3a068183d9d7767b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917560, "uuid": "84b57784-4b42-416c-999c-ce58520ab773", "value": "T15925E8CF6371091C748A7A0FC8386E9E7A96CF830510BCBABDA45947C51C74253B9B6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917560, "uuid": "71b7fc52-1b45-43e4-b631-8624d8b2ff4f", "value": "3072:00G2SbL23vFgSNr9dl7uUwoN0J+P/CDDjSbKK24Iob1Yi5u1Sg5udsSeS+wT5bIe:8+KUlkTplUqZB5KS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917560, "uuid": "bcf6030a-8f64-4a01-a41e-5f90f588b35f", "value": 1027849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917560, "uuid": "9ea3b446-2031-4f04-94c5-367625cde245", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917560, "uuid": "0b700fc8-4f41-4f38-9546-018bbea2d0d2", "value": "Quotation Requirement - KAIZEN-2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f71167-90df-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785942373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785942373, "uuid": "c117d57b-2b28-484a-a49e-b6335c2c1cec", "comment": "Malware payload", "value": "96d7a88397c9bf338d5e9e05bbb0d888", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785942373, "uuid": "af24b3cc-51f6-4f89-882a-768d5e3a1b10", "comment": "Malware payload", "value": "2a6d0a017c2e584f2c9272581b4f17ee71917cc215dbd042bd260ce26a39e10b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785942373, "uuid": "a9856902-854a-4dca-95c0-8debf1e7140c", "comment": "Malware payload", "value": "5762ba7dc931c113da080bbf49a88f37e00ea1c1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785942373, "uuid": "74846fa2-d71f-476f-8a55-849cdc8fc4a6", "comment": "Malware payload", "value": "c9e28dd8b5a2bd07ea6f6b6f9f1432888a57871e9e94de22e757a385aa86c0295343dc3818c5a61073cc8e07dd7ee847", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785942373, "uuid": "738b13d1-0429-4942-b158-c5915a5d83bf", "value": "T1F74398B7777679BFCC34D99A690490C5920ECB5F2AA024C818CF61CEB1DB0A799479F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785942373, "uuid": "8b8148bf-ebe0-4686-98ba-a083658c520f", "value": "768:JGyJefAyaeb374zjsneKQbKIbgbgnbg6bzbfbZbzbw9WbBWbxbc:UyJqAyaeb374kkKcUgbgq/zZ/wwBuxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785942373, "uuid": "541765c4-8e49-4eec-a45e-6c912ea3f138", "value": 58792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785942373, "uuid": "a79a85d7-ef71-4cc1-9517-905db068f859", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785942373, "uuid": "94cc3dea-516f-4f25-a830-33e5472fe1c4", "value": "Payment Advice...6321.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68340f19-90d9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785939885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939885, "uuid": "c80226a3-ece6-44e8-bc43-229a2fa1337e", "comment": "Malware payload (Mirai)", "value": "b02e178ecf7de81dd8653a2eb2adc11f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939885, "uuid": "351c39f2-d5d4-4503-9bc4-345c6eccaa05", "comment": "Malware payload (Mirai)", "value": "2ae7dc16ca036cb5c2c7ce2cd8099edb07d96b8846188c92eb39a7feba2fec08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939885, "uuid": "16709f6b-02e5-46f3-96a0-73a38fa646a1", "comment": "Malware payload (Mirai)", "value": "ea9170467efb19648bbe4514097a5ebe6a734ca5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939885, "uuid": "b5791386-8a00-4cbb-8c04-8ba6f7f82513", "comment": "Malware payload (Mirai)", "value": "ac972b009f0759f81ee2e20adca142aadd7b96474e79b4cf94b362463e5570087d8421d2dc6e467d89784f712226fac8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939885, "uuid": "f6e1a4d8-763d-4e52-81fe-2cb3a1f0bee7", "value": "T1BA456B88E3D3E0F5F25394B0034EEFA6093155367053FAE6F7896A6770733925A5A238", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939885, "uuid": "c53a7875-02d8-4cdf-9958-ec642cf60613", "value": "24576:HD3hOyfRpl5ahvUh9zRfXA44gqxyKQZ1GYas1RLnKNFa:HD3hpR35ahvUh14aKKLKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785939885, "uuid": "24f532f5-84ec-4c2c-bed4-67c4194175d6", "value": 1206876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785939885, "uuid": "fd20b6d6-5f96-4d65-8cd2-cb4a6f4b5a7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939885, "uuid": "f26f67d9-1e08-4932-a8f3-85e053eea986", "value": "bot.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ad2d32-9095-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785910917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910917, "uuid": "9f4f812e-8506-46ab-90bd-7025f182f59b", "comment": "Malware payload (CoinMiner)", "value": "20fb0679299ab6a9bea99297507bd3b4", "object_relation": "md5", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910917, "uuid": "e16b2197-597b-4c4d-ba42-2c47cb090dcb", "comment": "Malware payload (CoinMiner)", "value": "2e129809cc3f8c407dfed6d69cd9df85e0c37398c3eaac04b7e14950502fdc9c", "object_relation": "sha256", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910917, "uuid": "c4321a96-8121-4a27-9992-1767d21f5301", "comment": "Malware payload (CoinMiner)", "value": "32e62fa492f1073b059b94b8e9e2d0780907017b", "object_relation": "sha1", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910917, "uuid": "ffa61b47-e6a9-4409-8868-18ef6671736f", "comment": "Malware payload (CoinMiner)", "value": "b62df1b0263c1678e9a710124d1a66ecfc6367e09f73ee5d4777c613ba11de97af03e5316e4ff5e855c6730339c4f42b", "object_relation": "sha3-384", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910917, "uuid": "7fb68590-fa62-4129-b36c-691915ce4cc8", "value": "T13C3633D23EC64575D4A6C7388183306EB2FEBB5B89A47C163ECD1909CE66E14A43E7C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910917, "uuid": "ff18ba52-fd72-4436-b832-e77a5a97ba28", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910917, "uuid": "263f7d9b-4de7-44eb-9895-138257dbdee7", "value": "98304:Hn/bLZe7BlbuTyDtZYd1rG846YC2UAVSIOfklzNIFGAS1xlRLcMa:H2BlDorL4zTUkdbIFS15y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785910917, "uuid": "a1bf3750-eb2d-439d-bda6-59690373282b", "value": 5244928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785910917, "uuid": "0e2b9dab-fba2-44bd-89a8-fccb1337a61b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910917, "uuid": "2db04a62-a3f9-4392-bad2-e6ed3938f42c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210ca676-909e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785914425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914425, "uuid": "59427733-965b-45d3-bee8-5c5538b02b70", "comment": "Malware payload", "value": "3ef632fc0d98a6c9191c21984e0c1a0d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914425, "uuid": "6ea0ad7d-7d58-43c7-b748-ba65eb99f663", "comment": "Malware payload", "value": "2e8f70beaffb086850e0d10d48fe67a360889d871809161a239d8a0051fd0600", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914425, "uuid": "7261da8d-1905-492a-bd64-00d1719c584f", "comment": "Malware payload", "value": "51b869bea440da5c8ba9ef48af103dc37b1edae6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914425, "uuid": "6c69f414-1155-4e9e-91bd-0ef4c113977a", "comment": "Malware payload", "value": "96ca03cbbaf9ae8cf08b02d786344004a375c966c7c189fb8c48322bb875bac2bc6d74f107251988161297be5915c1ea", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914425, "uuid": "afbdc6a9-1656-4791-bc42-1e3b7b743685", "value": "T1E6C27D956A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914425, "uuid": "eb4791ce-c467-4416-a6b8-51ecff8ff2d7", "value": "768:88vCB+25j6es8RI9FYpMSUpi+20qUpi+20YQX:88l25Jed2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785914425, "uuid": "7d2b5678-9ad6-4d37-b7ea-18b7c8c356b8", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785914425, "uuid": "02918928-3304-4901-ad58-72583f366fb0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914425, "uuid": "2327d657-d794-4d67-9249-0b149ecc0b5a", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77cb9c11-9086-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustDesk)", "timestamp": 1785904263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785904263, "uuid": "9f52775a-d47f-49b8-91f8-db657716ff45", "comment": "Malware payload (RustDesk)", "value": "c182064d535d3815dcce754a941f3b67", "object_relation": "md5", "Tag": [ { "name": "rustdesk", "colour": "#17A0F4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785904263, "uuid": "19b9c4fc-e7ae-4c0a-93b0-ca126a554404", "comment": "Malware payload (RustDesk)", "value": "2ed35b0465fc3de72b0757e84daac278619edc30e651e6257073dceae5085332", "object_relation": "sha256", "Tag": [ { "name": "rustdesk", "colour": "#17A0F4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785904263, "uuid": "37614d0e-ebeb-46d4-b692-2ee45cf85602", "comment": "Malware payload (RustDesk)", "value": "cd7f44c93d97c0ee49a5641e8e84063946d12bb3", "object_relation": "sha1", "Tag": [ { "name": "rustdesk", "colour": "#17A0F4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785904263, "uuid": "c0dc72df-e34b-459d-8695-f547d6f2e6ab", "comment": "Malware payload (RustDesk)", "value": "caa6639adc1aa8ae2e470e07807da589a8b080e82bf7093acc351d8681ea678165b941c41568e539067b614b4fa38cb6", "object_relation": "sha3-384", "Tag": [ { "name": "rustdesk", "colour": "#17A0F4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785904263, "uuid": "24c166eb-8faf-4023-9430-0d3d9cb48486", "value": "T1E8373390F252197EF91B5030C5024B72E62ABCF55BB55DE701A4B3212E7EAF01F3AB49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785904263, "uuid": "fbf8cbf6-6b66-4743-89e2-205a53ff460f", "value": "1728f5830d9188240379efd54db72133", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785904263, "uuid": "c62554d6-0aa6-4837-b7eb-eeeaf79b9b5b", "value": "393216:fH0oc223i/cTWHjvYyQyKXpOilBPHMddZ10YvXAwtgSAfb3W8P2DFdKK56ZwOKkj:fHTOnyEyAXhrPsddwY7m9b3W8GMK4ZwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785904263, "uuid": "071bf2f7-4923-42f9-a1a2-40d067fcc2e7", "value": 24147080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785904263, "uuid": "df58f3e0-9d1d-4139-bc70-f1377c714e74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785904263, "uuid": "456efe7e-a81a-4319-ab52-12e8752b242e", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1965aa4e-90cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785934599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934599, "uuid": "f50c52e6-0450-4380-af71-53131e76cca1", "comment": "Malware payload (RemcosRAT)", "value": "276c4fcfe9480ebe25c77eaa4f4f1e7a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934599, "uuid": "a370c2a5-b873-45da-bc15-a3dea0580d43", "comment": "Malware payload (RemcosRAT)", "value": "2f123fe5d768abe06cbf9a74e865787c65eacb2f63a541fde3edc6807952c4f1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934599, "uuid": "e29eff4c-669f-4be0-9de1-a1d9808871e9", "comment": "Malware payload (RemcosRAT)", "value": "85fb770c16ddba71706e3acb6b7fd6b49afa3963", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934599, "uuid": "a031729e-c1ac-45d5-9fad-9079aeaaf62d", "comment": "Malware payload (RemcosRAT)", "value": "fd5f2ad55ed11e88d1f0355f0b03c76b91862d88c48e5379f32874f839f609b8b516a10505b725ba3c2e5b0ffe311a89", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934599, "uuid": "cb181a81-0f71-42a0-95c1-ef4d6462bee9", "value": "T1AE25DADF6BF33A8C2408B71E89F9AD9C1442CCA50452A07AAFB417DAC51D7416F8D7A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934599, "uuid": "de79537d-c1b9-4280-a9c4-ec7e084366fd", "value": "1536:rbD5ozaw8WoW+hc42oky1ygOA2InHScH31hUCtxefLK:rbD2zOWoWt4bky1RlpH3ptxeTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785934599, "uuid": "de0fac05-fe33-42e5-979e-14e317315ea9", "value": 1057953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785934599, "uuid": "548de00e-59e3-474b-a2a0-50ba243c9596", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934599, "uuid": "29afd4ba-d302-4edd-88a1-274ce59ec883", "value": "Vessel's Particulars_mv Yaropolk.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aefa8ab1-90fb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785954607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954607, "uuid": "f1196d67-2156-4f24-8103-e00d76b2b332", "comment": "Malware payload", "value": "7cfd4caa84b72bbc75edba3a574dc04d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954607, "uuid": "00e7a18e-36a7-4506-9951-b9a5801d2e88", "comment": "Malware payload", "value": "2f2ec51142bb83273f2613ee5a871fc3b783cedf35d9bf67a35f66f08bea4c29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954607, "uuid": "fdd6e925-ccd2-4a59-9ded-a9dbf80867f4", "comment": "Malware payload", "value": "21c05138ea68e7e38f3738121018ce22544d9d03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954607, "uuid": "ba19a8a5-0f22-48fe-b2b0-f26d0a3ecba8", "comment": "Malware payload", "value": "110fc95816cbc6cc0308d13ee4cd59545c3639a9dafc74ea7c6df162c4c88a2dbe6fddf8b412b7100bcc4bb0610dd0e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954607, "uuid": "dc7ea369-1092-45b8-b074-7c7a5de238ef", "value": "T182765B73905624D8E1ADC974D5152213BEA8384B573863DBBBC076F11BBABE49E78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954607, "uuid": "c16e8f2a-688b-42ea-a642-75b24aeb8595", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQE:cqYUQuVDt0TZEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954607, "uuid": "97568f4e-9e79-4392-95e6-4ed2627635e2", "value": 7274496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954607, "uuid": "6676c44a-f3b5-455b-978d-61a467a42112", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954607, "uuid": "e79d93b7-7767-4396-8807-f4a619b0924a", "value": "2f2ec51142bb83273f2613ee5a871fc3b783cedf35d9bf67a35f66f08bea4c29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1eb835b-906a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785892361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892361, "uuid": "020dd01d-184d-40dc-b8d3-1b104fc93baa", "comment": "Malware payload (Mirai)", "value": "9fb74a718a3b9ae9e97b5ef8bec2a587", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892361, "uuid": "93ff468b-8aaf-47dd-9ed5-fbf4afebac27", "comment": "Malware payload (Mirai)", "value": "2fa9fb858fac4b501006e2f787e0af1ebd591be08ad08f86eb97348329bca3c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892361, "uuid": "68252bf6-5e25-4d29-88dc-b18aa97e2c12", "comment": "Malware payload (Mirai)", "value": "7b07e674b9651e6a98181fb3135405629c2ac7b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892361, "uuid": "9601c606-13d9-4581-a9b0-81b87e1dfbab", "comment": "Malware payload (Mirai)", "value": "5ac3956296663b2fc8a5463c663d649668120bafbe8bee16c51b22aae37340d7837c14f6efe0d999d82c2830135eece9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785892361, "uuid": "875c9a49-847c-46f7-9a03-fd8202489ddb", "value": "T142031A42E651DB06C59272BAFB8E014E37176F68F7EE32359E306FE013825E70939925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785892361, "uuid": "27646658-d503-494f-acd5-80f3c806e1e4", "value": "768:x5nOr0lyUZ0AbzaFj2cR9D7mRQ4MSiPiyyvFyj7YrTfaKVE/T/:x5nOr0lz0AbzySc72tM9iyyvgnYrKT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785892361, "uuid": "b7c9f61b-ae61-4043-9c52-ae55aab466bb", "value": 40440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785892361, "uuid": "3fd75a43-8c17-4e18-9908-119ab9d80f54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785892361, "uuid": "b0fc66b8-246f-4ba8-bebc-c554b85023c5", "value": "main.armv5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5770f0-90cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785934983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934983, "uuid": "e3983438-2ad1-4fa5-a7d0-757aa66f2d87", "comment": "Malware payload (Mirai)", "value": "3a137e614d3837ecd436b98150aeb113", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934983, "uuid": "29425e85-abfc-4595-9e40-aec622ff49ee", "comment": "Malware payload (Mirai)", "value": "30828f29e9d0731874539410962cf8fce8c015447338d52a7af7215ec53c8a49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934983, "uuid": "1b2b18fd-9cec-471d-baf4-21a7112e9a29", "comment": "Malware payload (Mirai)", "value": "d21395d8371d005d00781568236135e9c91eee87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934983, "uuid": "71dc78e2-fb5d-44cf-8e0b-1592ec88da39", "comment": "Malware payload (Mirai)", "value": "6a5307bc836c87f8ecbd98d11f9c20c3e20a8cb290976277c258ab62937b9e5abe7ba654d03cf8ca2d93173816694fd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934983, "uuid": "523f1c10-ba85-43df-a0cf-df2f95fe63cf", "value": "T1D2357C05EFD01FDFC0AFCD30862D9A0B18ED9DA722C6B66570BC8D69739A2490ED7854", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934983, "uuid": "e884b6b5-7c3d-4ec5-b9ca-87bef79f4c09", "value": "12288:jn9/X8EKVQ7xxWMCvwaAfhgdZ3HSe+AsrZKcyQdlnbRjJwkwwv9frPkz/NDl/zC9:GgpV2LDrjwykEAneDegrKe39hm9ys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785934983, "uuid": "bbbce53d-279f-4091-b510-2ad3b6696670", "value": 1121448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785934983, "uuid": "6cfc99ed-87be-4006-a134-ee735801778c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934983, "uuid": "f1f75f55-77fe-4638-886c-9d82a7162e9c", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0387996a-909c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785913517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913517, "uuid": "35d3b8be-dc8f-43d4-bd3a-c82c267c05ac", "comment": "Malware payload", "value": "5e5fd34f1cd54ac50535c7fdda676c8b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913517, "uuid": "ed249da2-e62e-493f-be98-d83a214fffa8", "comment": "Malware payload", "value": "30fc62404248d12fca97c639d2b84a760be4edda2c187932235ac8756d15877f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913517, "uuid": "4acff94f-48e3-4be6-aa2c-3db6b428201e", "comment": "Malware payload", "value": "6ee88f8135874a2b891454e83aa549f99378752c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913517, "uuid": "fd6b740b-bb8c-40be-92e3-654615272a8e", "comment": "Malware payload", "value": "a2f5e8dff99b3397b8278928392bb7820915f0b9930c85b84676fe8e9f42537fd16ac6fd60ecea779ccb7c133e5ca724", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913517, "uuid": "bdfd9ce2-2f5c-42ac-8146-7b52be1ee1bb", "value": "T1B9C27D966A867C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913517, "uuid": "95c31d83-133f-4951-bbd7-85fe7f1c9b9a", "value": "768:p8vCB+25j6es8RGr9FYpMSUpi+20qUpi+20YQX:p8l25JG9d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785913517, "uuid": "7def35bc-fc61-4ad1-a938-263e087e765e", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785913517, "uuid": "b50232f1-6b9f-4026-94fc-48523a43a0f3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913517, "uuid": "f8b6131d-828a-4be9-9fe6-24b452ab4001", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c24815-90d1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785936603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936603, "uuid": "7c5aef18-7301-44bd-8a1c-4e82e22b4564", "comment": "Malware payload", "value": "af1c0398b4ec4d2bed1496c63d0b01a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936603, "uuid": "0b48160b-5535-4818-8b83-86222a9e45d5", "comment": "Malware payload", "value": "3140e3c6570fb31aae5f424b2c6f81b7b91e654110bac5c562afdaced7e20848", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936603, "uuid": "f6c965f8-26ad-4b18-8e76-a0a4e253bde7", "comment": "Malware payload", "value": "66adc37792d614d28fc1b4a26d5a4f5750e103e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936603, "uuid": "65532ccc-0262-482f-b177-bdf0b500fe32", "comment": "Malware payload", "value": "23c1f802ad4b98702b915ad6280fe4c8a044d6b02c7848d3947d9e3953de78653bd31e62752b7569ddd4c7b52224cea2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936603, "uuid": "6d17bda7-9753-4def-b838-279815cb7283", "value": "T1AE265A22959113EDE17FC075898A5E13FB71700913616BEF09D045A3AEA7AF0AE7F342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936603, "uuid": "9a8751d2-c324-46fb-bc07-f143893ad011", "value": "f3687c65b976634bcd3af94130004ae3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936603, "uuid": "8c5a2d3c-a78c-405c-a71c-170083eb447e", "value": "49152:Sxmk6DiKfriJqVOTZauaKil8KgCInaoDP19fMuWBvJIPMxAmINGEDtxexicqouLi:IabWaYx7sgohT3higkVgohT3higk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785936603, "uuid": "f9331ca3-e057-4684-9267-bad73c952d1a", "value": 4768768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785936603, "uuid": "d1650337-dee1-420c-a4f8-5b31c4e717b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936603, "uuid": "26df67b2-f0ae-4af7-9aee-4fc317c18243", "value": "agenthype.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88208e35-90e6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785945522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785945522, "uuid": "91d8882c-34e2-43c7-9e7b-697c91a409b4", "comment": "Malware payload", "value": "7ca874abb84f8bea6b3dd58262fcb1ca", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785945522, "uuid": "d1e611be-5ed2-4682-af3c-4bba9c15386a", "comment": "Malware payload", "value": "32328e9cbc836db28ef249b78ef77200561eefdb71c8df3c8df7d364f9680c8c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785945522, "uuid": "bd5636a3-a854-4acf-b76a-e9b65bf34e2e", "comment": "Malware payload", "value": "0d3e0cfabac5b29f7fec54b3375124475ff27ea1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785945522, "uuid": "03866fa5-ad02-4dc7-aa59-c8547c74f813", "comment": "Malware payload", "value": "4535dc18c85f9cc538ad18b24d6f9beaa74834b55cd833a0c78c2160ded0a68b85d37b466c86601248f69d9498833d45", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785945522, "uuid": "53925f75-c0b7-4ea4-9ec8-daf9e39fad15", "value": "T160C27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1224942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785945522, "uuid": "7a797c95-51ec-43f2-8fe2-901c40a6677c", "value": "768:Z8vCB+25j6es8R1G9FYpMSUpi+20qUpi+20YQX:Z8l25J1wd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785945522, "uuid": "b01b97d1-a3ed-49c5-8d4c-1a77aefc006a", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785945522, "uuid": "d0b15fff-6965-45d1-8c55-d590b1f7e5be", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785945522, "uuid": "d67c6d63-1e0b-49d3-8802-777d1ded2faf", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ee3e46-90f9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785953788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785953788, "uuid": "1aa4f6dd-df66-45f1-bc7e-8875cc7892e9", "comment": "Malware payload", "value": "ff81ad882ba18d91f63f3dad4057250a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785953788, "uuid": "e1490ba2-2759-4875-87fd-00719334b8aa", "comment": "Malware payload", "value": "32957f4bf885a0b5eee46cf5d17fa4a7423157abb8b4d3115633f60cf24b50f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785953788, "uuid": "b97ace75-ad66-4548-ac05-8e517091544a", "comment": "Malware payload", "value": "e243cf3bd7da3ad711c7be6e2c98b93122df40fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785953788, "uuid": "ac938601-74bd-4266-b60b-eca902f9d744", "comment": "Malware payload", "value": "c9cace3289f39de9f198bb9741f45296e396d289f763c9f14d1793f71dff740a6a411f81639a7a0a8674d1a52f034e81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785953788, "uuid": "b757a8be-8001-48d4-84ef-80db07d5912f", "value": "T13A462873A49154E4D2AED574C6256213BEE0389B273423CB7BD076F11B7ABE49A78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785953788, "uuid": "78b506c2-f1d0-4bcd-92fd-30367bbcc038", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQu:cqYUQuVDt0TZEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785953788, "uuid": "590eae7a-6f4f-4f68-8cd3-3023031b6664", "value": 5406720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785953788, "uuid": "aa2e39ff-e9c1-48d5-b5f2-b380489328c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785953788, "uuid": "5ca09a0d-c45a-4025-bd65-57446963cc37", "value": "32957f4bf885a0b5eee46cf5d17fa4a7423157abb8b4d3115633f60cf24b50f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1136a53-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785917727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917727, "uuid": "a2ee1c07-4b3e-45b7-806b-8afac4aa52d4", "comment": "Malware payload (XWorm)", "value": "f208f2c5ed2693051e840ac2028496fc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917727, "uuid": "829525b4-db61-47be-bc6b-38199c158538", "comment": "Malware payload (XWorm)", "value": "329b9cfcc633c230f6892141c6a5c584cd1a24d389a495766ff3c93b152451b5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917727, "uuid": "8cf35d0b-77db-4f97-97cb-182cfad3e5b3", "comment": "Malware payload (XWorm)", "value": "06cdf5c0c01d7f4c362380e397c90818a078c8dd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917727, "uuid": "77c2007e-8f41-4bc4-bf94-183bf60b0309", "comment": "Malware payload (XWorm)", "value": "84589138a43067f4305633100f779c2b8f92fb85028efed58caa742fbf6e4fd7cc5eb4a0d8f8925325f50ec4ebe416ae", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917727, "uuid": "c8118bf4-6ab9-4c9d-a6a5-e35dbddc0ce4", "value": "T1C3353F520E43EE03C4ADDAA3DD14C0DCA7B1791AAC8DD226F662CAC8509175CDE9EF71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917727, "uuid": "94ddfa5c-f820-4afa-9698-56051c3eb36b", "value": "768:lvJC2vkvmCT8+T8XC2vAvFT82vJvmvmvmvavmvYT8+T8XC2vdC2vAv1vJC2vmvdZ:jB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917727, "uuid": "e5d0e1c4-143c-495d-badd-0f0446ae917d", "value": 1108074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917727, "uuid": "8e4b03a0-7d43-4b6d-8b88-2215d093fe97", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917727, "uuid": "7902037d-de1d-4ff8-9da4-8f6f4fbcf4d2", "value": "Claim Documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff02312c-90a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1785917375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917375, "uuid": "fda1c027-76f3-4f51-a29c-1c0aa10abb4c", "comment": "Malware payload (AsyncRAT)", "value": "f0392b5ce0fe0b6acd8b1d02f5b4d494", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917375, "uuid": "dbe3f9a1-bae3-4bc0-b471-318abe77704f", "comment": "Malware payload (AsyncRAT)", "value": "32cc5ce6ca786875f7399fb4a39fb8fa778e8e5d519cfe9b8851428ad8f3bb3a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917375, "uuid": "fad6fade-8e10-482e-a529-8a5efba9e0c4", "comment": "Malware payload (AsyncRAT)", "value": "6c1680b6a8c33fd84ad1475f7f5e4b4e95868546", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917375, "uuid": "73f825f0-4882-4a31-856a-d7415427f2b2", "comment": "Malware payload (AsyncRAT)", "value": "ade58ff9f11df0e847b6a4b577ca2ecf2ecc6714f9b1e3385a9241b705fe7c34913a23a0b7e867a23973c5c26cda1329", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917375, "uuid": "c2920f71-836b-4ce7-9c99-384897df0d1c", "value": "T13914BF2C33B3C80CD1928B392D4F99D471E55244CC48C6746AE4DA6B7CF148FECEA66A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917375, "uuid": "0b38eca1-14aa-4621-a94a-770a0eeaacb7", "value": "6144:pemXq5234WRXi0pb+aIbYy8IIkbUhDuE3Sm1sX:8tSy00aIbYy1RYlutX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917375, "uuid": "8b5a53d6-a6bc-4efb-be27-756070954ce3", "value": 207115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917375, "uuid": "b77b38b4-1bfb-46a3-afd5-28151515ab1a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917375, "uuid": "21b644ac-2a60-43ee-b8ad-6137a55ff7ff", "value": "Contract - CB-KLS a c2 (003) - 05.08.26.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f47406-90d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1785938665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785938665, "uuid": "915f5cb3-f771-41f3-8b12-2fe87f89bb3c", "comment": "Malware payload (Vidar)", "value": "bdcc2570f715c43231530f81634c6e70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785938665, "uuid": "f260f01d-0963-4e38-a1b8-d3e66e5f7b26", "comment": "Malware payload (Vidar)", "value": "32e1579eedeb079478165a94c221d3bb47dc383013fc7ac1ff7b435d8f08517d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785938665, "uuid": "28f8221f-1244-4663-bbfb-8dabbb4b4de0", "comment": "Malware payload (Vidar)", "value": "bf0099937a019dcbc4a3e8e5b803e90b0e99bfd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785938665, "uuid": "e47a460f-2463-4625-9d3c-6dfa58816b3f", "comment": "Malware payload (Vidar)", "value": "2a2d9d3e443af2eb54f536e7f919584a46e221956177113ee1f456ba02e14aa587b46916881674d5a1b5675d0823eb47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785938665, "uuid": "a819ede6-af60-4ca4-93c0-7536faffd398", "value": "T1F6669E07BCE149EAC499523185BB52A17B35FC190B3223D72E80B7382FB67D09D7AB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785938665, "uuid": "d3b20c05-33a7-453b-b3b4-b4940ef1e9fd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785938665, "uuid": "91621fb2-5a02-4be1-8873-6edaad21fc4f", "value": "49152:hZaDyp7y66n5bwDOH816TPbEt2JUs8Gb2:hNGJc16Km6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785938665, "uuid": "24417ea2-d4d8-4d66-b74e-30bb9fae0a2f", "value": 6537080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785938665, "uuid": "bffc4744-a9be-4e63-9eaf-0636f587a3c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785938665, "uuid": "5a8455c1-b746-4ebc-82a5-9fc8afb80017", "value": "32e1579eedeb079478165a94c221d3bb47dc383013fc7ac1ff7b435d8f08517d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e10da4d-9096-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785911011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785911011, "uuid": "68f65fbc-c9e9-4325-8501-e6fb9618252b", "comment": "Malware payload (Mirai)", "value": "3e31cac56306d730c3265c8be158dd5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785911011, "uuid": "af58477c-f866-462a-85ff-fa76b18e4dc3", "comment": "Malware payload (Mirai)", "value": "334cfc85d8db34c491142fd985c84f4c097fddf8ad7d948083557b62fd441eeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785911011, "uuid": "c70f3b33-c0c3-4475-ac08-985303f157b9", "comment": "Malware payload (Mirai)", "value": "757f324e734dc48ee02127d2980f7915c9faa75a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785911011, "uuid": "c6bf9b3b-ac59-4db0-97cf-9944771b8bc5", "comment": "Malware payload (Mirai)", "value": "b2866d6f655f496eaffbe11d7f88969b49fec715ae3dcb320cfca2fa9ce5612b681ef4b8324b1e14229a115eabde8c7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785911011, "uuid": "9fc01477-d220-424e-9730-458a89f24342", "value": "T1B7B4CF63F6B06ED1C4030A7018FAD2340715F29123972A61F6FE86543C8BA7A7D6EB75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785911011, "uuid": "2b61a225-9916-4bfc-842e-45d1bca5a924", "value": "12288:PTFrfiryM5BGsfB1Bce0sTpJfSFJsK8mvDAJ5/U8p0+uq:JLiOABB0gJfLKL7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785911011, "uuid": "308a8921-c837-4f30-a7f8-3194a7547226", "value": 529104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785911011, "uuid": "9ee071c4-5f68-486a-bb5e-4844518cfa0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785911011, "uuid": "38a4a701-abdc-4142-bfd3-1d9d5a92a829", "value": "xd.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29df8277-909d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785914011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914011, "uuid": "c41d1c65-76ce-478b-99ac-f1016774bdca", "comment": "Malware payload (Mirai)", "value": "df5f76aad147c6e5fe35d0f1fef660e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914011, "uuid": "4e3a15d3-940a-4f1b-a6a5-8b3bee73ecaf", "comment": "Malware payload (Mirai)", "value": "3376a4aa867d0bcf1135efab1c983fa3ed6cbe1e2ff527d91cea8610c98ee339", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914011, "uuid": "b357e474-57a8-407b-a09a-e4af905d7812", "comment": "Malware payload (Mirai)", "value": "bf019c6645b9a2691e692afc636c82355c75e326", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914011, "uuid": "d4de73fc-78c1-4a4f-a1ac-0743dd82a3a7", "comment": "Malware payload (Mirai)", "value": "2b77bffa9ca9739e5888cfca416a4b997d3f529b338990699ff382c1d9ba1b1e596c9a430906455f2935ac52e04c3c18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914011, "uuid": "63be1656-8fa6-4691-bf6c-c78d1643c5ba", "value": "T1FCF31A56F9819B11C5C156BAFF0E528D73231B78E3DE72129E246B347B8A87B0E3B015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914011, "uuid": "47f05697-372f-4168-b56b-1f2851d2f343", "value": "3072:Oo0R0M1GwnMVwH8VMFU79wfmPtK93ura4hCG3yx67uk6nD2c62+hLz:Oo0R0M1GwnMVY+MFwCOPtU3oaKCMl7uu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785914011, "uuid": "aa17103f-945b-4e33-953c-e84d7ce47349", "value": 169012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785914011, "uuid": "fedf0b0d-2599-4f48-b642-d2e523d5846d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914011, "uuid": "7b35fb4e-bcd4-4ecd-9300-63b6c93b776c", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953a8f2d-90cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1785934807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934807, "uuid": "b31c2179-7627-4932-a176-2ac66b864971", "comment": "Malware payload (PhantomStealer)", "value": "782e40111ebc0122e7886713dfbf2db4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934807, "uuid": "afa74ebd-b3cc-4c8f-b510-791f4565f1d8", "comment": "Malware payload (PhantomStealer)", "value": "3385679dcd0d089d6e071862ea3345b6c00609784cf4e91e44005791895c0f5d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934807, "uuid": "d4df08b5-866a-4a7a-8e42-78b33159f240", "comment": "Malware payload (PhantomStealer)", "value": "41b37b2bed9b1e89422eae434cd89c242838e364", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934807, "uuid": "001b7594-b2eb-477e-8232-636a8e5b9a43", "comment": "Malware payload (PhantomStealer)", "value": "210a946772cb3f1244144d5e7ef4e49dc5ea5b5f9802d6ded1a39c660d1f98fd4da88ca8714be0a1cc51b7d038c82a1a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934807, "uuid": "f058bbed-f3d2-4f39-b99c-a874f7308f08", "value": "T1FDF53C911D7951877178089981837EAF8A2FD43F2141E8C0FA9CDFDEAB5F959D3CA808", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934807, "uuid": "924c96ca-0af0-4edb-8aaf-59ace4770199", "value": "98304:yrz3xdTnfjot139htTk69331f8ejazdH2ltAcEEbnFWQ8+ulaq:4dDmKZAtAcEInF1V4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785934807, "uuid": "9b4dc7e1-8411-47fa-b054-400b84c119dd", "value": 3589720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785934807, "uuid": "db50283d-d180-42ad-8a95-ea8541d0a3f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934807, "uuid": "f8899a48-0003-465c-b61e-b6b23aa30664", "value": "Profile_Details.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b581368-90cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1785934763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934763, "uuid": "d965b915-09ee-41cb-a6e6-7f24d2d6d7ef", "comment": "Malware payload (LxBaseRAT)", "value": "0132f42dcb64fa4a8c15ac011a7a1f61", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934763, "uuid": "cf6ce0b3-86aa-46f8-8c74-0b892d43a036", "comment": "Malware payload (LxBaseRAT)", "value": "3424142693fb7b55bf8dc570ac0657a82e6032a0fb9d4f5c2f02337c19a42707", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934763, "uuid": "bde7018c-6098-4d31-8a5c-03da38da0eed", "comment": "Malware payload (LxBaseRAT)", "value": "59c033a4a312999ff086ee41c528b8ab13aab3f1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934763, "uuid": "cf7378af-8b3d-4fb3-8045-9dcc607956b0", "comment": "Malware payload (LxBaseRAT)", "value": "7af8e941e7ee009de0259fc1479864212f8dc842f3ac0b5f00a7da09639d79245bd0dcd93a6d624d3c6a260c1ff34038", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934763, "uuid": "397bb665-a49c-4a35-8b5d-57a289a7dfad", "value": "T1DA058D07E37BCD1B8E8103897D07B09979ED41D7A098EDE25D4A8DF611CD4EBAC8E918", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934763, "uuid": "5b0f216b-c400-4443-85b2-cc3580a28fde", "value": "24576:kzfrrPoUdOOMRzevJHVmjp7gR4FLmTrBwkrIj5hDN3gEG+B:AzrjKqvjmjp0R4pQ9wkrQ5/+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785934763, "uuid": "f85e0522-99a5-48b6-9f9f-e045f6fbbdaa", "value": 823640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785934763, "uuid": "181329bb-59ce-44db-ac27-d0f30d448455", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934763, "uuid": "6e98bf8e-a45f-4edd-85c2-165936586a1d", "value": "List_980045211305082026_Fugasa_xlsx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0474b473-909c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785913518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913518, "uuid": "b740ca53-3a85-45d9-a951-aeb553ba8881", "comment": "Malware payload", "value": "17a28d4f0fe20d786693a9d0c5aaccaa", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913518, "uuid": "1148c53b-8d3f-4e8d-a325-304dea2d10be", "comment": "Malware payload", "value": "349c388f5bbdec382ea492b442f5f595792c55a6b0270b77e8aa77934e841f03", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913518, "uuid": "b388f919-9aa4-46a4-ba97-f4d9da798a80", "comment": "Malware payload", "value": "7b36068658037c2d61cdd5bbf7394a936fc88b7f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913518, "uuid": "598a846d-bb9f-44d0-a57c-05438be4286c", "comment": "Malware payload", "value": "dc3544dc3eeccf21be34c09a93655c0575f940cbf92205a41dc8da34b8039f7f4956c1b9f43b589e33d1a4cd9acd8b9e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913518, "uuid": "e6d12909-6e0c-49c7-9e9b-c0e0f247d944", "value": "T15AE223F1F8ECA835329D453A779DA805A9DF7C2F0DA77D2014275A38421CB1EA119B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913518, "uuid": "f4664ae7-4000-4b50-a4fe-1aa7c7b57b4e", "value": "384:6V42iRUud3s153iBu7isrGcA4UADAZdhQuW5a:ciRUQs53iBlYUAkz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785913518, "uuid": "03e5ec73-d5f9-484f-8a02-e704eff80cca", "value": 31311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785913518, "uuid": "23661372-a04b-4e41-ba61-455638dbd64e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913518, "uuid": "50e8ae25-71e4-4db9-81ef-be3d2f678e87", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cef47af-90d1-11f1-bd95-42010a9c0009", "comment": "Malware payload (OverlordRAT)", "timestamp": 1785936457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936457, "uuid": "fd2fad09-261d-44c3-8717-06624a8058df", "comment": "Malware payload (OverlordRAT)", "value": "b72e6547fbb9e49eb96ce291ad24fe09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936457, "uuid": "f2e1dfcd-163f-4cd3-b9d9-f431a0e0b354", "comment": "Malware payload (OverlordRAT)", "value": "35442b21cc246eb8070491778f7421079038ffe9a950285c39441780692d7ada", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936457, "uuid": "9800c428-3bdb-4930-b45a-b7c468ab0305", "comment": "Malware payload (OverlordRAT)", "value": "eb7fcb703e32036c9c04c511afe83249884fd686", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936457, "uuid": "f10bd8cb-a87f-47dd-9e89-6a8c912fa6a1", "comment": "Malware payload (OverlordRAT)", "value": "ae9b49a8d52f7abb3f6d60aee7f0dc2c6b0fc5f4fc3f63d0a87ef9bbefcee664ff7b2659b32e8106383e65091420125d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936457, "uuid": "517a2db8-81e3-45b7-8f89-b84d10481fde", "value": "T1D1963308D7EB6510E4A44FF044A0134F0A3EBDEA52A5468F74EEF1679632BD426F1B2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936457, "uuid": "7f4f15de-cd86-4ba6-b096-e00e6b0e739f", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936457, "uuid": "0325a013-faa6-4ef3-a553-475deeec4ce3", "value": "196608:5eCEW2OnF0VphOaivVZkHTNt62bRqxFQW03SwNqlcstFFdmzhuyGJfi5XTJohMIq:5XEW2mFShQa02MHQd3+lc2fT6IG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785936457, "uuid": "fc3b766c-3864-45b9-8411-643407918c26", "value": 9121792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785936457, "uuid": "9fb139e5-9651-456a-afe1-d6a55fd146f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936457, "uuid": "033294fd-25bb-4a85-8825-ecaeb2cd921a", "value": "35442b21cc246eb8070491778f7421079038ffe9a950285c39441780692d7ada", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c529112-908b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785906445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785906445, "uuid": "0475a42b-e052-4552-aa21-b9b9c33e6896", "comment": "Malware payload (Phorpiex)", "value": "1a62caa2ccc49ff846625fb0c54b885c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785906445, "uuid": "44afbbe9-77d8-4024-ba7f-0e134c2eb419", "comment": "Malware payload (Phorpiex)", "value": "35d1a650fe790571b25a107242a70190b8931ad235b533e44443fd7b938aaf3a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785906445, "uuid": "f5b53bec-22bf-4029-b937-15f0c07c9228", "comment": "Malware payload (Phorpiex)", "value": "7914ffa5ad5be1cfde75c20c89b11d1fbbe64966", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785906445, "uuid": "8be8e638-c822-48c2-815e-9dd430284456", "comment": "Malware payload (Phorpiex)", "value": "ee2a02cfff689b3aad702aacebd7260dc51ee4d8c59db6ef5b4853bf5f836e71cfd51c11c3d91f273146f99c027f6b1c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785906445, "uuid": "a687ee76-2f72-4d59-8f78-c4f0f238a29b", "value": "T10C824B0FB9424226D0D110B09676967BDA79A87633C414DBF7E48AEE0A686D1FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785906445, "uuid": "c5177e32-ab1d-4747-822b-c629d66ba47f", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785906445, "uuid": "ce86e38e-e201-4b41-936d-fa25acf76b0f", "value": "384:8YI6I8/V6l6Vio0HlmLu94gXTcolmxav8U9cUl:8xfk0Ht9j8a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785906445, "uuid": "041fd87c-2562-4159-89b3-f9c00de24ae7", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785906445, "uuid": "025af9ac-425d-43d7-b109-c6dd7332707a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785906445, "uuid": "c57e2a95-2e82-48b1-8619-f700201e557f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5babc2-9099-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785912299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912299, "uuid": "3861dacd-6c58-468f-ad15-fa4c4a2f3cf4", "comment": "Malware payload", "value": "4f1bc4be3bafa87023dcabcb1b659936", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912299, "uuid": "161a39c6-4ce3-4595-b08e-912bb60bbb9e", "comment": "Malware payload", "value": "35f5189a2ff7bda6df0cb628d0ddce80ee41aa7369eb6d10a8d1a5b2725abe98", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912299, "uuid": "7c819131-75f4-45ec-83bb-a01a7d9f6a13", "comment": "Malware payload", "value": "baf70f6f5817fc68b8c3dd4070dd4bac88678ac3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912299, "uuid": "9e07654e-4149-42a3-806a-e4d2ff83decb", "comment": "Malware payload", "value": "9a7190b0982977f2764245d9b2c032f56a6d0d13de3bba7934d97274bab7e14e3952ad3718c0ae1029d5cdd77cc92dcc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912299, "uuid": "73ec1765-6cd0-453d-afb5-1832f0cde4fa", "value": "T104236C6516857C14AA98C4375D7E2F0CBDAD43E6314492DE7FCB3CF28C4AAAD920871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912299, "uuid": "b5b6807d-283a-488c-b115-e383eeb5659d", "value": "768:se9NyXsZztC79GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:seHusZBcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785912299, "uuid": "0e6afa89-d07b-45a3-a84f-e6735a18f4c5", "value": 50071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785912299, "uuid": "789e1e64-ea1b-41b5-90f0-54d6e8d9e402", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912299, "uuid": "d5dca000-08a5-4a2f-92bf-728cedee2cb8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf90159-906c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785893266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785893266, "uuid": "40663619-636b-4f4c-8ae3-781b6bbb7e34", "comment": "Malware payload", "value": "f52e334be54ae6f28fb9f19fdf5f00fe", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785893266, "uuid": "c76bf675-168d-4da2-9f6b-0aa850939a69", "comment": "Malware payload", "value": "367ea7e4e3abd64b1d89c6d4ebc82bd42b9f2b56897b093c1f0f411303c28945", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785893266, "uuid": "39696835-89b4-4947-b57b-bb4368c4cd54", "comment": "Malware payload", "value": "5cadb5c016687aab7b39e42b91361feec5c5283c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785893266, "uuid": "05a89a6d-115d-4a60-8fd3-8aec755690ed", "comment": "Malware payload", "value": "7e0a38d1274bce214d7606b564dc642ef4d17630062b76e0bd4eafe10c68db3961973a4bac72f7985de4eadc2a5f99ce", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785893266, "uuid": "54222bd5-f1a1-4532-9dae-1d4369905507", "value": "T100236C6516857C14AE99C4365C7E2F0CB9AD43E6314492EE7FCE3CF28C4A6AD920871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785893266, "uuid": "274d2d0b-ddea-4ff6-8b58-c397d29d4ff7", "value": "768:w9r9NyXsZztCt9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:wFHusZTcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785893266, "uuid": "f3543409-c046-4dd6-9c4a-e60a042a1f07", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785893266, "uuid": "abdefcbd-0a99-47ae-9939-486eb7f4387d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785893266, "uuid": "276f7168-c670-46d9-9c94-aa272972070e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf9bb6a-90d1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785936593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936593, "uuid": "edb3514a-8e9a-4c54-83eb-19935c98af66", "comment": "Malware payload", "value": "2683373e14ba77c4d98e7eb38563d6c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936593, "uuid": "43375b0e-2024-42bc-95c8-66be34d8a4ce", "comment": "Malware payload", "value": "36e7f2a2a2711b617e6e7f5e73c49e3cbf03b4398169331750e649070442a30e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936593, "uuid": "efc3f68e-3716-407f-9ba8-160b316f151f", "comment": "Malware payload", "value": "779399c179983bcd54b0cda9f3b2d29b17b2f283", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936593, "uuid": "44db871b-24a1-4bf2-aa86-74aaa8dd080a", "comment": "Malware payload", "value": "58d01f32d647dfb8b94998b04ede0784a632aaf39f682a1e9517074f42e1923d88b31f780996a8b6b8b7a3893007ce1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936593, "uuid": "1b821bc6-7c50-4a77-b144-d778ed779833", "value": "T161264A07F89191E5C0AAD130C676D292BA317C881B3023D36B51FBB92F76BD4AE79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936593, "uuid": "a27b5d95-5b63-4edd-9d65-e40cdcef429f", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936593, "uuid": "f0ef7ba6-bc52-49cf-a12d-b4cbfb152524", "value": "98304:BuCF1ybql45eEdjWv53aoVxcn5Q/Rlh1O7YMm4ZGxxX8WUo13eBVNucUBx+vdhmI:BusoqGbdjWv53aoVxcn5Q/Rlh1O7YMmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785936593, "uuid": "26885e3c-3773-407b-af2f-96a0bc606eb6", "value": 4677632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785936593, "uuid": "6cf31173-1d45-4c35-831b-9c6bb7afec9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936593, "uuid": "2220caa9-6716-421b-9307-97531b64cc8a", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035090c3-90a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785917811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917811, "uuid": "773aff70-03d1-4c2e-86aa-f037eb7234af", "comment": "Malware payload", "value": "d2e89641aab3f2c1790dcad746aa67b8", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917811, "uuid": "ffc8c735-d816-447d-8458-21b368e9cd7a", "comment": "Malware payload", "value": "3764f4b259a72b12422956f553eba62edc7a0b21cf628e839d24150e701e0a69", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917811, "uuid": "7509290b-72d0-4d7e-8c74-8052fd4725e9", "comment": "Malware payload", "value": "12e00daafe8d30219d044659c4368f5a2bda56bc", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917811, "uuid": "1c4f7181-5829-4a26-8703-4b8d832a8512", "comment": "Malware payload", "value": "37904a0fa72b15f4b0a0d9095315c4b8434e9247d78bfd818c802d540c4c311f9f5e03b2e97e97b1e02c0fe069a13ff1", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917811, "uuid": "05977acc-b4b0-4796-8f95-89b5f15ec94d", "value": "T1115149295FE40725FAFA4F76E4FDA20274327E3AA801D95D4181D18C84B2609E4F6B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917811, "uuid": "439096a0-a593-47c9-a3e2-597cc1715c7e", "value": "24:8hNE14mXlOFCHHVXn6cFOxwy5bi4o0wM/8CWT4o0:8hNYO+HVnNsxHhoGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917811, "uuid": "03baea9e-7f4b-4791-b00a-8b345f8cbc3d", "value": 2690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917811, "uuid": "c1fe7b64-4fc4-430d-9b2f-0c4c32465d28", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917811, "uuid": "eba3e735-2f3f-4895-9874-b1d26ed4c528", "value": "photo_287742060718.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9445585-90a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917365, "uuid": "523e1786-df9d-4f72-8c2a-7f4d5570b200", "comment": "Malware payload (AgentTesla)", "value": "9d292a2ce53ca9746e37878ada8992ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917365, "uuid": "4571fb3c-554a-44ce-b8dd-6f39e9300cf7", "comment": "Malware payload (AgentTesla)", "value": "37708552875049051d17402ab0dabf65457df870790666712c5b4d04ed94324e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917365, "uuid": "d8acb8b7-9222-4ba1-b30d-aa2474a2896d", "comment": "Malware payload (AgentTesla)", "value": "5b3f56d62cd8885b33ed09908ec65af2b3b1e4c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917365, "uuid": "de448c14-4989-4560-9b5a-9d55c14072c6", "comment": "Malware payload (AgentTesla)", "value": "948c70c3162e47b0b88e429e498ca4c02a821afdb262546683c03ea32f45d1302d05a87bee6b9a081bf5497ae9c51d2c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917365, "uuid": "a1ac041c-c9bb-417a-b314-8f44f075db09", "value": "T137254EC9C2C5032DAF4E513D8C2D8A4CBAA2381B7C5A1B4CE1F7B3547AD5E8566E1D38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917365, "uuid": "c956a78f-a68e-4c6f-bef1-3fe66c3e6bbe", "value": "96:NBy28RTZ4Ke1Dmbk0rDf80xRWyFVtRWEsJ5SZg147sB1/X1YoZNM8x+j:ry28X4yPDE0x8yFVtRWn5SZb7OYx8xA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917365, "uuid": "1a2683f2-e03d-47e6-bb93-0ecf7596d20e", "value": 1016597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917365, "uuid": "a70ea001-dd59-4792-b04c-ee3850b39b86", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917365, "uuid": "a37331ea-8f83-47ba-a767-2b1bbba401af", "value": "SWIFT_COPY PO_2500033&PO 2500054.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c56025c-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917585, "uuid": "bc37ee76-53af-47c1-a3ff-52bfdfe9b5d0", "comment": "Malware payload (AgentTesla)", "value": "3b9dfe5cfa01334dc4f2437b49a40204", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917585, "uuid": "4fe18f3e-b766-4b73-9399-0eb325f6bdd4", "comment": "Malware payload (AgentTesla)", "value": "3780f207b9e25d7f56b83920dacd5b758b2f3bbde5130016debd65025e6bfe77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917585, "uuid": "0e6592a2-aaca-45b4-8d70-dd50c2a80765", "comment": "Malware payload (AgentTesla)", "value": "6016e30f8c064f6ac430a459d709ca10c1d1128f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917585, "uuid": "41a71fc0-5312-4999-b0dd-e42baffe41dc", "comment": "Malware payload (AgentTesla)", "value": "9877fe2509f3d2dc50561caa8c39e84e63018d0cf170781b7377705699786d79ab18ca2c351f21a54eee2a843de3fbf3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917585, "uuid": "621af7ab-e606-4156-a545-6b1e60993fb9", "value": "T189D5E6912B48D2737720ABAD623BCE319A0EF04315C1EF0476ADE618365DD4F6358EE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917585, "uuid": "65039305-7d8a-4fa9-81f4-474c004ec25d", "value": "49152:t2urio36shUejRf6PYHRUvnZo9Bax5Tsw9bWISRN4Jx4scVBHudY7U0bNr32zFkd:t2TshDFSPYHRUPZ4BMowFWISRN0x8VBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917585, "uuid": "0c3f93d6-3849-4f2e-a540-eb3c0966f021", "value": 2943274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917585, "uuid": "f82036b9-4995-411a-a82d-9bd70a5175bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917585, "uuid": "acc071d8-f373-4b7d-aaa2-f5bd694ea9b2", "value": "Scanned_Almohit TVL & BOOKED MHA1108703312.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e133a6c6-9098-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785912171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912171, "uuid": "6352bec0-1e61-4d16-ad3b-a9b0028941a9", "comment": "Malware payload (Mirai)", "value": "b8ae867c8b82e47272e15b23e72df2ce", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912171, "uuid": "63edf128-b478-4522-b403-6ac4f24e8983", "comment": "Malware payload (Mirai)", "value": "37d5f76b99a8eb88688b0437ea5c899bad42a767efdc49d8432929a8614a71cb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912171, "uuid": "3ded8608-0377-4724-b434-9416027345de", "comment": "Malware payload (Mirai)", "value": "bfc8d5f5ef8a1d46cbac6abb811ea46271735eff", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912171, "uuid": "f55c8e6e-58a6-4cc8-9777-707a563d1258", "comment": "Malware payload (Mirai)", "value": "93e38957c197fcbc2890e81a933f06b50939227f517cf650cf5ec4b24decfede5720585b97af2348e5d2d5514e178332", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912171, "uuid": "e02bab07-0df9-4839-ac63-d687710bfefc", "value": "T151410D9F0570D011A92FCA0274E582F66322C9AC95E92F7BEC82DDB5B48CE75B016B35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912171, "uuid": "bf814d03-033e-4b72-a528-2db971e8aede", "value": "24:UXfGOXeesJXO0Xuun+TXbnX7nJgX0cXUt6tYNBXznXTnJgX1KG+YX1j+o+a+3Xvf:On8bKL4XkmubU92rOjSd94nF+7IlLAPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785912171, "uuid": "3d283459-9397-41b1-96c4-549a2676a0b0", "value": 2206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785912171, "uuid": "b2e69e9d-4acb-4a73-bb47-7ff2d10519b2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912171, "uuid": "c54238b3-6d2d-4672-b811-47978d20d294", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64fdee97-90a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785917975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917975, "uuid": "28cb4ae2-268f-4b01-b5d7-f76696cf7ca8", "comment": "Malware payload", "value": "01a8ed7e0a0aed0672625c61d1af58fc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917975, "uuid": "081aee2e-7cfa-4dee-9b19-3f4505c2ea90", "comment": "Malware payload", "value": "384ed10ff3172f2c09ec12be8e7b601c673adac4342c41fd33d5859c064d35af", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917975, "uuid": "9687e50b-a882-4e4f-bfc7-ff0114afe9f6", "comment": "Malware payload", "value": "f007fb94b08ab6b1175363672dc733a216a07dea", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917975, "uuid": "bec8adfe-8d5c-4e4e-baad-8f31d0216285", "comment": "Malware payload", "value": "3233c4c3891aade4cd2f75f499ce6917dbca9b35ab16516945f74c98692d73f459c26d140c365fdb5a3edfdce182e4b7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917975, "uuid": "1389ff13-c9f7-47e3-a472-7c0c9dc51080", "value": "T150236C6516857C14AE98C4365C7F2F0CB9AD43E6314492EE7FCE3CF28C4A6ADA20971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917975, "uuid": "b1984bc1-5275-4ce6-8cf9-c075dfa3fd6f", "value": "768:Ar9NyXsZztCj9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:uHusZpcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917975, "uuid": "5f6438cd-c97f-41a0-a961-78647ee66c88", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917975, "uuid": "e223b5f5-9e9a-4b84-9093-f828f54b65d8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917975, "uuid": "b5ad97d1-2ccc-460c-876b-8835021a9c26", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e9d655-90a1-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785915754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915754, "uuid": "8f620032-d08b-4c29-a5fc-4f7c8d45a52b", "comment": "Malware payload (RemcosRAT)", "value": "06f506aed980b50789c4d0e01bb37396", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915754, "uuid": "d3f67cad-da09-484c-bd3a-9a8c3fb5ac85", "comment": "Malware payload (RemcosRAT)", "value": "3863d6a80d72d9447a103772a9d3b75752bbcf4997c0ce6ae99c07678880466d", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915754, "uuid": "ea730f2d-cb21-4966-841f-0a4ec4edb059", "comment": "Malware payload (RemcosRAT)", "value": "db270570562dbed133f19d4eece9513e3d22632f", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915754, "uuid": "1001da50-e050-45b3-8204-4e1347494401", "comment": "Malware payload (RemcosRAT)", "value": "4d7db553d4c5cd7bbe5cab285f6efffd48f6fc537e772e2d135a70b6898a11b4dac6af6b4629792a0dc98b8a41f1ac50", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915754, "uuid": "e4e535f9-c9b7-4098-b4fb-292991aaec1b", "value": "T1268583F55B22496DD542A6FD2ED91307B510CE8C4227C35AD6C39DE82FBAD227C72388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915754, "uuid": "fb55939b-5ef1-4f4d-8442-d3d345a16f82", "value": "24576:88BFpBZowi27yalH3mv/e5wrIvpgzLr2rsl5QGwh1xo/iWtXR8OTgZR5WEtkxvf2:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785915754, "uuid": "2df586cc-c41b-441e-b5ca-5b6c9b64f62d", "value": 1746432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785915754, "uuid": "6499e7b9-7226-4559-a7fb-b46b2fce5766", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915754, "uuid": "74842e3b-f245-4fb8-8182-c6db9bc3a050", "value": "specificationDrawing.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d70b47-90a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785917304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917304, "uuid": "4856b81a-9b0f-44dc-bffb-009383862a08", "comment": "Malware payload (Formbook)", "value": "4a95d180cf02593637eb1e84bcf007d5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917304, "uuid": "2b13ace9-5dd5-4ee6-95a5-3a9550d17dfa", "comment": "Malware payload (Formbook)", "value": "386d7cc46dc906903df933ff2c5ecac83b4fd432028cc17ac3bed8ae29e32eb1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917304, "uuid": "2442cf07-c56e-4a17-abc9-a6fdf612a772", "comment": "Malware payload (Formbook)", "value": "7903b1cfe9357ea88216396d6a559a14bf676035", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917304, "uuid": "c102aa6a-a34a-4fa2-ad63-934c5688de20", "comment": "Malware payload (Formbook)", "value": "0a808db838760a59118f27bc24b48982279e0d0c9f6e83b3d85e0dbd3c7b86146b50db9e7416b9c976bd46b3a7aff7c7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917304, "uuid": "62242508-def7-42a8-9304-840a0c66224a", "value": "T1CD630C9008876484A3767B7FA22AE8D4F7764B6B02841917B83C7050DFF2D1ADEE1D76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917304, "uuid": "6688fcfc-f14e-4e48-918f-df4f5171d40f", "value": "768:a3BH7i68V7/rJVP/tk/dL097pmcXScig6PQMeQ/jZSiNQl0zJmhJQm6GGTjnQ3q8:lr7/XiEVNOgKd+NFUIQgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917304, "uuid": "9e29704f-23f5-402d-9edc-310465575115", "value": 70751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917304, "uuid": "7e72e6d7-e410-4424-be90-ac097a42e5f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917304, "uuid": "4e8989b5-82bb-4264-b3ac-5fbe1ce726cf", "value": "folderhwpqmfh3.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461a2c72-9100-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785956578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956578, "uuid": "1c204bd1-6e62-4e7b-b620-5e8cafbdae1a", "comment": "Malware payload (Mirai)", "value": "fb8885e084f6e8cf12008b9309559824", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956578, "uuid": "15dabc0d-8bf5-4cf9-b76c-4c6057e4eece", "comment": "Malware payload (Mirai)", "value": "396a63a8bbccd661331046b5e37db0353538af37f5b1725b399774c7a9651dc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956578, "uuid": "324e59f4-a429-4b6b-9ee3-132e53bbf72f", "comment": "Malware payload (Mirai)", "value": "5bb75d4d6324551ba41e3e0d44c0dd3e6424b6c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956578, "uuid": "42ca4de4-aba8-4728-9169-4abe3b5b3340", "comment": "Malware payload (Mirai)", "value": "fd80e503dc22523807952948c3157332c8532351a71a9ddf810d00edd1db7b24dd267ab048c1921018d1fc0723e03f3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956578, "uuid": "a252200b-a271-43ef-9da6-42c3915f3020", "value": "T16553F182B6097E82FE90906F5A4EC0DE39F45BE3673149C156A88D44A01B67BB306CF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956578, "uuid": "43fe3ae7-cc02-4e6b-a0a0-c0953515bec2", "value": "1536:zeCob0bFx0FHawXzI5nuZl5xmqZ0HOHnqtkkQsf4t3G4u+qgw0re:yCogbnSFXzcnuXjymq8sf4xG4u+qgwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785956578, "uuid": "a6b47a57-ea7b-46eb-9c88-e976ca651c33", "value": 64668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785956578, "uuid": "1e00fac1-6c97-4d82-bc1d-b6450866d536", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956578, "uuid": "2a8275e5-bdc1-4c1a-9b2e-bf98d0e0fee3", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd4261a-909c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785913747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913747, "uuid": "cf6dd190-3f39-4495-8c55-c40097314474", "comment": "Malware payload (Mirai)", "value": "db5f4a2431b691dcf408ef558f3cb0b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913747, "uuid": "30dfc737-1a6d-416c-8554-0788a12a1032", "comment": "Malware payload (Mirai)", "value": "3a07c06437a6d8ab4f3abab5d7246a0425161826ad54f809c0f4fac1aa6c3299", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913747, "uuid": "1311ce23-63ff-48d5-9307-fb19704bae47", "comment": "Malware payload (Mirai)", "value": "5813ef19e1151b11026306a0d686772165e4c31c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913747, "uuid": "4f4e1715-b29b-4bfb-a7e7-b25788d64406", "comment": "Malware payload (Mirai)", "value": "36fdee858cba289f2f838a446430f8196468dd2e8fc4180310824ab639a15a018869331fb3fefa28142041bb287d8aca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913747, "uuid": "bf410401-c365-4646-9b15-44cab40290d1", "value": "T190F34B07A8655FA7C589AEB566F75A340753E8110B4F0F8AB23AEAF406079DCF40E374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913747, "uuid": "14e2a529-be58-4153-84f8-85f84f9a73fd", "value": "3072:K7CL9hXpdAnqsTZ6UO2s90WRhGcIC0A6IC/L+5vCBv75xXBT2aLf5FwD:KWZlpdAnqsTZ7OXtRhdzQICDmvCBv75Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785913747, "uuid": "53346134-eebd-465e-840c-e7c971e04105", "value": 163019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785913747, "uuid": "a0eea4d1-2a10-409d-9ee7-252455e96254", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913747, "uuid": "1588dd99-4e7e-4083-995c-98c64e88aa52", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a711d32d-9068-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785891457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785891457, "uuid": "5f6279f2-124c-4864-9f88-41a625491d78", "comment": "Malware payload", "value": "6df6013b68ad0921b72c4480d4ede5bf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785891457, "uuid": "53ef3786-40a5-4293-a1bb-5c0e5b3f6f9c", "comment": "Malware payload", "value": "3a09f7e85184a22da474d5fba72c2bed3afb2423e139b7973897067264f7bdc6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785891457, "uuid": "11f1a9a9-c938-4005-b50c-49cc773a9cb6", "comment": "Malware payload", "value": "566ba581c73e8684ba66b59f218a1ea2a2cbebf7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785891457, "uuid": "cbca4b8b-6e46-4f89-9fa8-17c63b99d0ab", "comment": "Malware payload", "value": "055246ae748f380f6d8c3883d3665e5773f2692ab4dd7ed089d88c3eba993788fe837b69537862c7f5db43c809d21b44", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785891457, "uuid": "4879bb3e-e372-4942-af45-727a15396a1a", "value": "T140235C512A857C14AA99C8371D7F2F0CB9A943E6320452DE7FCF3CF68C4AA9DA10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785891457, "uuid": "dd616929-9a5a-4b72-80fa-71e9a9423edb", "value": "768:HJFWzZx569GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:pkzZcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785891457, "uuid": "54fb4091-f2e3-4d5f-bd30-b5ce78a556dc", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785891457, "uuid": "5707f276-3f92-4ebe-a030-51ac23b74620", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785891457, "uuid": "f2e13d3b-fca0-445a-afaa-1b7fc1f64603", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f1827a-90a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917178, "uuid": "558c24da-3df4-415d-993a-ef50d1f95fee", "comment": "Malware payload (AgentTesla)", "value": "980dac1f7fdf2c8fa3844535a0261f67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917178, "uuid": "e7abe9e2-6201-46bd-a842-e2d95d9ff76f", "comment": "Malware payload (AgentTesla)", "value": "3a0c451e4883f5d5fd1ecb0db0447a099d78c1c3b27d86eb33af3ea78e33eff7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917178, "uuid": "f85044d5-d94c-4807-abf9-3db460a59d74", "comment": "Malware payload (AgentTesla)", "value": "d69909e0247b7c4ebaaa75949e7b8d63fd5acfab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917178, "uuid": "c76b9b16-5421-4849-bd8c-014df662baa5", "comment": "Malware payload (AgentTesla)", "value": "12a2367177f9116811b87f7144075bf6ceffc1523b94b56f3b1d02f39b92db5e8f3b30b92e0571f48bebf7003453dbf0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917178, "uuid": "e36b25be-d4e9-4ec4-b3db-4ec172a862c0", "value": "T127E50781178999B27720BB9D61378E309A0FA01325C2EF44396DE614372DD4FA39DEE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917178, "uuid": "3f2508c2-bd06-45be-be6d-6074aefd1b72", "value": "49152:nu+iVr4ax/orivQ6uykRbMn2UqJ9oVU8LEMY6Yd3yQoQP247B040Oi9w1jnkKLU7:nu+Wrvjv+YnTG9KLEMY6YdiQdO4l040l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917178, "uuid": "6ba64e26-dd6b-4258-85f7-fbbb8a883a9d", "value": 3043594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917178, "uuid": "7ebbc989-4b65-45e4-9098-702b501e6f45", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917178, "uuid": "f096196b-cecc-4f34-bb81-43ace15eea65", "value": "RFQ 500114681.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16df0d7a-906e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785893792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785893792, "uuid": "a8312c05-eb45-430e-a1a3-bad95a6b6eb4", "comment": "Malware payload (Mirai)", "value": "3cb849c9254f28ad3a10fd3211a77217", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785893792, "uuid": "ec368d8f-7d35-4de5-a0de-bd0500e22ffd", "comment": "Malware payload (Mirai)", "value": "3a6e532493b6e27a65591644109e2d2021d1ef4d7abae9e5f5c36244ed653d4d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785893792, "uuid": "b221d4e5-b477-4e22-980b-b8208bd3c3d7", "comment": "Malware payload (Mirai)", "value": "80ace9b8fd7fd44149d50c51e20379440c2cf56e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785893792, "uuid": "accc1c9d-afb9-4ecf-a64f-8c42b6e6d68b", "comment": "Malware payload (Mirai)", "value": "dced079a9a5c258ae3dfb8797ed00828dba3be040da90710c1514b62c89e7e888241a6ef06177b629bc3db6760186344", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785893792, "uuid": "519613ba-1166-471b-bc00-2270557dff64", "value": "T1BB01ABCAD4609800909DD55C22EB2155FC31C3C7165B8F79BFACA93E9B94D05B067FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785893792, "uuid": "c2e500f9-809f-4682-9006-80ba0fcc504a", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaVjCoX2C3VbjCmXCeTIChzMBX:kXCKysE2hi0ziQvZohaVjxG0Z1h8U4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785893792, "uuid": "2ac441af-77d7-4c7b-b20d-2e3f29327914", "value": 840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785893792, "uuid": "eb5d34ac-f2c5-4331-9849-55252ce0611b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785893792, "uuid": "8f3f93b7-4ad0-467b-93e0-9062127fc42d", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3554691-90fb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785954641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954641, "uuid": "44ccdef6-21fe-4ec7-b24e-5933552b2cb6", "comment": "Malware payload", "value": "3fd71c6c999a1ef938fb257bf76330af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954641, "uuid": "2e1a54e7-9237-400f-8644-83f31484003d", "comment": "Malware payload", "value": "3ab0caed38f88c48c25cf86e2aa5e0d5f906afed696425f0bc621eecdd49baa3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954641, "uuid": "ff362d7a-e745-42da-ac7e-be7c37b9e52e", "comment": "Malware payload", "value": "0eea932bd4d3b949ed0b6f743a6f071d46c6bb60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954641, "uuid": "d5681839-d70d-47e6-b19c-d85d5a48f54f", "comment": "Malware payload", "value": "d89aa9a816e74d9fe1985ca82d6cd6bca66ac5592af2162476f914b0c18512aeaaf2af39e05b7d0dff1738a7e4c9fe20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954641, "uuid": "280c0c58-1213-4a8e-afe1-1e22593965f4", "value": "T13E542339E5854C19146E0EFD4343B766DADCFFC28051FB42B21DF6A50D4012D936E9BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954641, "uuid": "cd5b19cb-6c8c-460a-8cc0-661149f82d18", "value": "6144:urBRcNGGJ7hhmPP9WoetzAKl0A0iyM9fuWRJj/7hwf1njH3yl89:1TJ7ePVOtbMPMxTF8nD3f9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954641, "uuid": "849cb605-c292-404a-be43-ecb4701c740e", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954641, "uuid": "5ce3393d-91fe-4742-aaa4-9662b03c18d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954641, "uuid": "7d82aa13-c728-418e-beaf-5d05b42e8cb9", "value": "3ab0caed38f88c48c25cf86e2aa5e0d5f906afed696425f0bc621eecdd49baa3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae3dd19-90d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1785939138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939138, "uuid": "19f3eb12-51c5-40e4-a086-305ec6a5a987", "comment": "Malware payload (Joker)", "value": "74b852e7fc04e1fb584a598cba7f6415", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939138, "uuid": "f7d2fe80-3ba1-4955-905b-45cc5a7d725f", "comment": "Malware payload (Joker)", "value": "3b1b199047888c4f79e18cd30fcfcdefeab0c40b501bfebb8d49594f081c7ed1", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939138, "uuid": "370eabe3-8ec4-4579-bf71-08257b365fd2", "comment": "Malware payload (Joker)", "value": "efd3c860f3513a5bf07979100cfc6dd2729134c6", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939138, "uuid": "a446130d-fc74-4a22-8039-b9003c48fd9f", "comment": "Malware payload (Joker)", "value": "a649667a9dce8f95d85189caba11b9fbccd6577395493dbae0dd591f427a30b3dd3ed0656145bd12a72ea203e02d0147", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939138, "uuid": "4ba09675-8888-4b56-81c6-0169b0edb226", "value": "T1C256F15AF758DD2FC837203249AA6371919B4C128E83DB43A9443B0C69BB6D45F5EFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939138, "uuid": "68f52707-acb6-43ec-8c67-7f333097a17e", "value": "98304:yDrF6vkSLNvUvZM66lFagiv3YxzthjqgVQ1XXUZO2EBA6STUd7EbBbp4e9A1v1HT:yDrF6MSJv3FQYZbjJ292EBCTA72hJ/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785939138, "uuid": "ca188076-0764-437d-b252-ab681d95724b", "value": 6132204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785939138, "uuid": "50796f6f-73a6-4393-a61d-9b59fa2c4f2d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939138, "uuid": "ca72520d-92fd-49d9-aed9-5a542f12ad2f", "value": "Swift+Cleaner+Pro_1.5.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d070b542-9075-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785897110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785897110, "uuid": "0db35c6c-1f65-496a-9624-c6c666c46f99", "comment": "Malware payload", "value": "38e1fd82d7e08a915a910ce78186f073", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785897110, "uuid": "5327a435-8ef2-45ac-9314-f7c459e04eba", "comment": "Malware payload", "value": "3b3bc398e71b2dad7e7af96b0607b264e405f3af2ed453b251f3575a6e513fba", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785897110, "uuid": "c5a382a6-44ab-4853-a819-ff43f59815f0", "comment": "Malware payload", "value": "1a8b0b7e6324279fbf409aecbf9a8d6950f12624", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785897110, "uuid": "28128e77-685b-4206-b10e-acbbc50d9621", "comment": "Malware payload", "value": "1b7d846dbdc32459800cf7997b7a317aa2ddc0cd9b7eba60d0ca96a2492953781febf8afdcee0c24fb781f4b8b695dc4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785897110, "uuid": "480f95d5-bcb7-4874-8f35-4741067f163e", "value": "T14FC27C966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785897110, "uuid": "9d730811-7d6d-43fb-a1da-ac0b312714e1", "value": "768:m8vCB+25j6es8RF9FYpMSUpi+20qUpi+20YQX:m8l25Jjd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785897110, "uuid": "ca55542d-4921-4ead-b81f-e0407d504c73", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785897110, "uuid": "35fe8230-f71f-4577-8a17-f0b82d2430ee", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785897110, "uuid": "a65b9d84-c6db-4862-ae3b-a6c1498ef479", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0115901-90cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785934422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934422, "uuid": "d43e8988-cb66-423e-b31e-0bd909a74c8f", "comment": "Malware payload (RemusStealer)", "value": "466a990698c559b4eccca876bc698cfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934422, "uuid": "3f4bf13a-df2f-4fe2-a091-31da7c37298e", "comment": "Malware payload (RemusStealer)", "value": "3c6b036f2eebc124c17db51960d9f6c9b39e236e9a33d5ac0c3a3a2cabe36833", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934422, "uuid": "1422dbef-3d48-4a4f-a9ec-3cf1908f687d", "comment": "Malware payload (RemusStealer)", "value": "71a9089679fc101b50efc47fb5efc388867dab94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934422, "uuid": "a883f728-f220-43b0-ba6c-335dfc4a7534", "comment": "Malware payload (RemusStealer)", "value": "2c2967885e6e7e4f61525cc01e943e13406fad64551c2436a47fb0b12b471791ca8f2a16aec3450d15357941d2d71357", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934422, "uuid": "96098c55-a593-4a8e-9ed0-690031b351fc", "value": "T154857C1BB2A510E9D47AC17CCA525116FA71B8550730ABDF17E05B262F23BE0AF3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934422, "uuid": "22509ce4-eafb-4972-92c3-b4ba992f4d77", "value": "b4391a59da933d8be5b46a8563b59117", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934422, "uuid": "8c9fc33a-ef9e-4753-9f3b-eaec4aeb82a5", "value": "24576:Zaa91LEgeK1zQt30+kt/z0VMOYeU7x52K5vip6hXpCN1pqVJbHuVIJAEvrodiodi:n739VQBWaVMOYeU7x52KhB2w7bOVIDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785934422, "uuid": "ea8f0efa-9be4-482e-9232-7f5c1ab95c88", "value": 1826352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785934422, "uuid": "c40c97d3-6aed-43c0-abac-c5715664e864", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934422, "uuid": "d79a5917-455a-4c99-ba09-fb56a9f80eb1", "value": "466a990698c559b4eccca876bc698cfc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b11893-90fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785954103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954103, "uuid": "2c2c4500-c9c0-47f5-b09b-b78b76a54e9f", "comment": "Malware payload (Mirai)", "value": "414de565b4b67507bd888dcaf51d95d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954103, "uuid": "240ac89b-e0c0-4c33-9d5f-aca61c5d505c", "comment": "Malware payload (Mirai)", "value": "3ff12ba8cb30ca5e0e8399650f1c02338c01422f5160cc767f8997e0136ffebc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954103, "uuid": "dcef787f-030a-4f81-ab67-0d8a5adacf00", "comment": "Malware payload (Mirai)", "value": "8ebdd708b2f13cb5688ec7be73f56704a74c3f17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954103, "uuid": "65b592df-c6b8-4eab-b429-41bdd259a203", "comment": "Malware payload (Mirai)", "value": "27b96481d393981a4fc6bff35e3b947c943c0fc9ec58f409615e0db9ac1404e524685181630daf7a9c947bf55528aeb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954103, "uuid": "4e19edfd-b19e-42f3-93a6-8853c8e45fe8", "value": "T1AA536AC8AA43D8F6FD5241712133EB378636F139112DEA87C7A9DD36AC52900EA5739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954103, "uuid": "91ea74f1-3017-45ae-82cb-048ab94eb59d", "value": "1536:KhberOEn3VfK+naUZGxt9V82YhQs3EFTwVfudVFUHWdI1wubjariXY:KhELn3VfKpJV23qsudVKHWYwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954103, "uuid": "18eab4fc-73cc-42c2-b7ae-3378b1465bb1", "value": 62928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954103, "uuid": "8b0ed274-f7f6-4ffe-a90a-eee4507a51f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954103, "uuid": "84939865-0b9c-4c52-a701-f6a967b18b9c", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0326b1b-910d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785962447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785962447, "uuid": "201d3d66-6450-45e6-add0-5f59fb089f25", "comment": "Malware payload (Mirai)", "value": "22bee70986e4966a5e009facebcccf71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785962447, "uuid": "26e6271b-6344-435c-bdf3-645dad9cc7df", "comment": "Malware payload (Mirai)", "value": "4135a4f52eb88adb74fe31baaa9b13c89b17a743ccf8dc2dae2f7ee5e2c634e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785962447, "uuid": "2f501d7a-e1ee-420b-9ad3-664b515c9791", "comment": "Malware payload (Mirai)", "value": "cf9ead45a7574faaf6aa9c4e19872b955c3f3dba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785962447, "uuid": "eb0ecca3-c6c0-4c42-8646-2698fab33f79", "comment": "Malware payload (Mirai)", "value": "9b4d73b871f18d8441c9a387fde0483a8b85e2dad44f7717bf942ee098fd95d89e61e8f6b212d6c9e30397698b4fdaa4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785962447, "uuid": "a64a2e4b-900c-4a45-945b-509c1801e061", "value": "T18CA36C40FA83D1F1F85705700167E75A8B34ED398024DB4AEB593E35ECB5B068A6B7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785962447, "uuid": "1d4fce41-d387-4a24-bebc-a556bb619a6e", "value": "3072:IZFJEggNaoTcad8yzmzhEL9Z9Wa1YTDGNg:IZ/gNavEL5/oGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785962447, "uuid": "08e11837-8e33-4357-85c0-50f1db23e716", "value": 103800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785962447, "uuid": "0bc68a4d-3d37-4a79-ac03-58cbc6414cdd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785962447, "uuid": "fa10b132-a816-4ae7-962b-ddbc4ae0bc0c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a295b89-9078-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785898227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785898227, "uuid": "b7cd7c80-8fb8-4924-9d0f-78698eb7c15f", "comment": "Malware payload (Mirai)", "value": "5edd133760ff0b66524654958b0f3614", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785898227, "uuid": "c0cd81b1-34de-4153-b877-e3612918b19b", "comment": "Malware payload (Mirai)", "value": "41973e5dc419ef5d31ba3c0b984ae22d80dddd15d3bf65696e7e0c919134430f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785898227, "uuid": "688bb5e9-6f12-4517-94cb-6a8804d0e742", "comment": "Malware payload (Mirai)", "value": "13ad2076c05702a776053ee9dbff2cca014ef1a9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785898227, "uuid": "08d4e63f-0c39-406a-978c-c2fe5f199ffd", "comment": "Malware payload (Mirai)", "value": "03f62bae331537fc14074cbb86ecbe34a4087370414f703e86c9d94e73f0723594acf2a59890702e00fd36291718d907", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785898227, "uuid": "61f04e17-a548-42be-849d-4ae98616ea29", "value": "T1E0F35B0274D0D4FEC8E5C2B84BEFE136DA32B4595274761F23C8AE262E5DF212B6D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785898227, "uuid": "ee962d34-bffa-43e9-ab97-b8b6cfdb5bfd", "value": "3072:wQUWH4VklB1Amd10qb8ODAhv4y1jFg+SVqKE:wZWfYOB25dfKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785898227, "uuid": "ca221b5b-7391-4a64-8999-7e52d2f22850", "value": 164272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785898227, "uuid": "a463818e-3305-41b9-a989-84bd144b4b43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785898227, "uuid": "a13c9337-ae25-4edd-8a19-50f2b0280daa", "value": "sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1891ec99-908c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorphiex)", "timestamp": 1785906680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785906680, "uuid": "2ef72e31-d4af-4f31-baf7-8b88c7bdb59a", "comment": "Malware payload (Phorphiex)", "value": "200e69d045085ddeecbb9fb0c2ac79de", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785906680, "uuid": "9a7f7626-d98e-48de-8c62-522b3e50a37d", "comment": "Malware payload (Phorphiex)", "value": "428e0a62d12d4a1d3421b158e3d58ef6bc554e1715da19158a3af6468d7c6bb5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785906680, "uuid": "a386c58b-e9ce-4641-a13e-aae0460147f8", "comment": "Malware payload (Phorphiex)", "value": "105574ad8b72fff29c517a9e9bcb0e3823adfad6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785906680, "uuid": "39cf095d-62b1-4dac-a27e-b8227dfad050", "comment": "Malware payload (Phorphiex)", "value": "253c079bbb7b99a193472e92130f2bd55fb46e2af009a74663b3798485a7b3cbb2abf4e3fcdea9c8c2b9d6a795511866", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785906680, "uuid": "424f7032-d815-48dc-b772-a62edd5930c1", "value": "T1B2824B0FB9414326D0E11070A276867BDA79A8B6378414DBF7E48AED0A6C6D1FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785906680, "uuid": "a919e61a-7c12-400f-8c48-881f9f091825", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785906680, "uuid": "ba9216e2-3601-4a87-85a2-5e12e517ae97", "value": "384:Zt6I8vVaF61eYUQQlmLu94gXTc4lmxav8U9c/l:ZtPAUQQt9z8a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785906680, "uuid": "d05f3b03-a8e3-4834-bb20-9ee23a37a9a4", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785906680, "uuid": "1d1e50d7-5f8c-4b50-9925-b6ab2ff7e361", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785906680, "uuid": "d4a78068-684a-4272-b024-997e3d8d32a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7055b91c-909e-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785914558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914558, "uuid": "d2a7d417-b07f-4de9-859a-bcdc9f680913", "comment": "Malware payload (RemcosRAT)", "value": "4d0aa7c9b0069941dd07a8019fcccae9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914558, "uuid": "12a17262-abd1-45fc-9c77-cb433766243f", "comment": "Malware payload (RemcosRAT)", "value": "42c6458628a8e33486b6a275b7ecfecadd596874fe1e8602a4a9e7bfca72e362", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914558, "uuid": "605f8546-6af9-4ccb-a605-0bff2d59d291", "comment": "Malware payload (RemcosRAT)", "value": "1dba9605641219839f184a2702da6c9edc223e85", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914558, "uuid": "59237df4-2975-45ac-a6fb-8d436a017583", "comment": "Malware payload (RemcosRAT)", "value": "93ef209aea14139374cfb9c5a60d5d8f775f609638369dc9b26fd084330b693a3ecefc152913feb7341f8dca175a7102", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914558, "uuid": "50afb02e-5359-49d4-86f6-09d3a4223462", "value": "T1C3938F74111FB8F663C1E707C3ACA4449E2FBA19E8D2EB0CA5659AFFC2187D0F899514", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914558, "uuid": "d0ac4e81-9fbb-4328-a4df-6da1ad395c29", "value": "768:jRbJjceBcQZ7iZazEL4vYkRgknlLkzvk4ckbkjyV0ktigk+kf:VbJjceBVF5v0kpkLklkbkJk5k+kf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785914558, "uuid": "f5cb406b-06a3-499b-9dd4-35912a8d35a8", "value": 89572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785914558, "uuid": "a630d5dc-8ca7-4034-89d3-5564093912e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914558, "uuid": "19f09f41-25e3-4f44-b4c3-bb7301267ddb", "value": "RFQ-20260710171901653.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4afcedd8-90c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (ZigClipper)", "timestamp": 1785929958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785929958, "uuid": "b29b5ec1-62a3-4eab-ba0c-2f23da45bc29", "comment": "Malware payload (ZigClipper)", "value": "e8a57773a2cbc39610a3707a175e02ac", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785929958, "uuid": "8c905922-06f9-4cd2-a655-585297094d25", "comment": "Malware payload (ZigClipper)", "value": "42d00bbf109d84bf076159af48932d3354d76daecf049fd09559dba48d3b5d21", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785929958, "uuid": "83ace1d2-3a02-4302-b9b7-014356a6b472", "comment": "Malware payload (ZigClipper)", "value": "228f0bddad60a54084c91a8703d346bafb95e16d", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785929958, "uuid": "a42c1abc-439a-4c7f-9d2c-b6c3a7480c35", "comment": "Malware payload (ZigClipper)", "value": "383a82b81dbbf79bb4cc92390e05aac5ab925dd21d43f622bee119718a01fa552f5f9e337fcdc5d8c73b60f56fb27d6b", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785929958, "uuid": "bda48651-390c-4d92-992c-6ed4a17ba0ee", "value": "T149769E0BFD6A58DFD69EB034502372157F213C004666276769E0F3382E33769A5EEB29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785929958, "uuid": "8935d1a4-a22b-40ba-8e88-f16170592f1e", "value": "38423d1725d9d93a9af5427aac0c4e07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785929958, "uuid": "e0881094-d5d2-4b14-bad3-4a1f1ef83fcb", "value": "49152:d8ipm4YoewYd3PKK4MZYWqvZaqZOEFbXCixPCpLzaR9FgprrawwMWyZZSPUP8Ijj:iJpNZYWyZHTC2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785929958, "uuid": "60c92c9d-d51f-4ade-b060-357647509d7c", "value": 7767896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785929958, "uuid": "01333aa3-1f7a-44e0-9135-ede8afb79959", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785929958, "uuid": "1a8f56ed-0043-41c9-bb7e-a4c4e5156039", "value": "gd.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89932435-90cb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785933928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785933928, "uuid": "81fcc96c-469b-4510-a233-34ed09957328", "comment": "Malware payload", "value": "fecb9f83da1c1521e675616efb40c3c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785933928, "uuid": "2f11af55-78ed-4463-87c0-a0ee19fb2f53", "comment": "Malware payload", "value": "430b7b1a40143e04e84378b7d14936c6ae6dedd33fac2cad461d9b98b42ca2e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785933928, "uuid": "3297afcb-60e3-4418-aa48-815d6c31ebed", "comment": "Malware payload", "value": "3acd9c389f86eee9564ecac32f72375e0923e600", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785933928, "uuid": "f25ebd74-d8ba-444e-bb45-4d21d4f87e9e", "comment": "Malware payload", "value": "07a4f4bef7c58993cc5732089027264b8921164e50fafd67ec637e250809b9dcfd9d986022be38dd841f051bd7edd617", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785933928, "uuid": "81ced6b6-631f-4c2d-a052-18e81a52a54b", "value": "T113286C43A2E751D8F0BBD17497E65323E932BC490B3469EF12944B312F72AE0A779B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785933928, "uuid": "65530e4e-ffa0-4c0c-885f-dbd77839e97c", "value": "fd6f6d07cc33ee9a2b65bda58a07bb94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785933928, "uuid": "bb529efa-6b60-458e-bee5-407e92235efc", "value": "1572864:WZa7hmguP2nG0/Vyv7UhgxIabc/x7Awby:WZa7hmguP2nUOnAwby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785933928, "uuid": "03af92ae-be0d-439e-9dd8-ef45f2b2b9e4", "value": 97882112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785933928, "uuid": "eca8e8df-cef6-415a-97bb-90d1c6442808", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785933928, "uuid": "2b1d7fa9-8198-4800-be63-f0fb9651b772", "value": "430b7b1a40143e04e84378b7d14936c6ae6dedd33fac2cad461d9b98b42ca2e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba61915-909d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785914014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914014, "uuid": "5c9f32f9-582b-4014-b58f-b1c280912d69", "comment": "Malware payload (Mirai)", "value": "395345e94b5d822ebb01184e2f5a089d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914014, "uuid": "5a6cfe67-60b3-40cd-bd26-7e9c65752cac", "comment": "Malware payload (Mirai)", "value": "4392617b7710ffed664cc259ae5864e0cfce5f35ed0cbf5d478626dca1305664", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914014, "uuid": "c6f7d09c-8b53-47ad-863e-b5294328b062", "comment": "Malware payload (Mirai)", "value": "43aff7858cea9e2638e1ac7881a638fd60e51dc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914014, "uuid": "2fd95664-146a-4aa9-8972-4547c75b0e45", "comment": "Malware payload (Mirai)", "value": "f9a97d0525ea018f28c1c2032b6c9e831d80c8cbd6ae9d09f802e9c340ef23ece2463427edb4d66ba6b3abe5ad91145e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914014, "uuid": "89d7caa8-89ff-4b62-8415-2b12bc650bef", "value": "T15CD35BB3D825AF58C564E6B1B0318F781B939A6082471FBE19B7C6748087DCDF6163B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914014, "uuid": "6dc607cb-6bdb-4b42-8e2e-cd9f42eb06c5", "value": "3072:5WbCJE+dQ29RHrmP71xmbdspxYNWtrcVhQTv5:5WRuQuRHrmjebmo4trkQ75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785914014, "uuid": "24251e79-1998-4bd1-bbd8-aa0e280d5878", "value": 142140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785914014, "uuid": "0478b2a9-fbb0-48af-a597-192e2f448e7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914014, "uuid": "e40a27e3-d26a-4e81-b1fc-cb5d5b9b504a", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b357211-90cb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785933743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785933743, "uuid": "1c882085-71cf-4bee-87f3-1dc5423c8f80", "comment": "Malware payload", "value": "b266ce25d37332ead9bb528ae6c0b049", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785933743, "uuid": "98b975b0-1f2a-4491-b666-0b5022a28d8f", "comment": "Malware payload", "value": "43b79ae0f1fc1311b7d61c1b48d6e73c2ddd89c7ce469aac8d0e7f0217f3816f", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785933743, "uuid": "00ac35a4-6e54-466d-8984-b8d6dd9311a3", "comment": "Malware payload", "value": "55fd5ab79ea8538a3b74b5379b354e4a39044f20", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785933743, "uuid": "abe76723-e6ec-4a97-a6a3-6d9a9491e457", "comment": "Malware payload", "value": "9cc06c45d25c5a4b9182a2f63739c56dba40498bbe4960fd1793b1f94a21ad0c5c33cb2a65d8d79ee28d030ca5bd1490", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785933743, "uuid": "bfd4f1f8-a9e3-495f-914f-e7287cb7d5ad", "value": "T160C6233FF28BA53EE06E563676B6D210583B7A6065124C1296ECF88CCF255701E3E787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785933743, "uuid": "18fe1b8e-f92f-4985-9a7d-465debc4af26", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785933743, "uuid": "4e7282a6-bb40-402e-a10b-629143099160", "value": "196608:cx/hWuy4Kh3OFO+2XFlUW3isi2UQ37UFqKsQl4yvrsbiuPQwfLIBSBp:cx5WuQh3kc4ijUk7U11le9QyIyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785933743, "uuid": "f96c0106-0122-4503-a7f5-d46da369cdd6", "value": 12240012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785933743, "uuid": "6e3fba4c-1220-4993-a4db-e326f08a024e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785933743, "uuid": "547ae9f0-299a-4256-aae1-5295f1bc016a", "value": "\u4fdd\u5bc6\u6587\u4ef6\u6d4f\u89c8\u5668.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1394d3d9-9081-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785901947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785901947, "uuid": "949613e6-be31-40cf-89a3-211dc02eb052", "comment": "Malware payload (Efimer)", "value": "0de491eae5672fcbf8292a649f8b5907", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785901947, "uuid": "71fbcc30-d88c-4bec-8feb-b0500a7f3e21", "comment": "Malware payload (Efimer)", "value": "447eb0c36173cd39617ab77af0c6d56349e31f0ee8a10ecd244b447199fda1c2", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785901947, "uuid": "6cb7e911-3df1-44c5-8a91-a13e1ae41136", "comment": "Malware payload (Efimer)", "value": "cbc6263aeee0a9af9010ff889c338089662dd48b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785901947, "uuid": "ba8caae1-f93a-4327-9a2d-dff6bbfd45d4", "comment": "Malware payload (Efimer)", "value": "5f2957a5001f27fb4806c93201224941b4e79e84bba7ff68e2364c26850c412a6b1f44be43c777b3009e0ff530c3e01e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785901947, "uuid": "1a00045c-5267-40ae-8d4e-a58b1d14148e", "value": "T162E6330459D012FED973203DFEA301A1EA74F8762772C9DB47789A662D571E0893EF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785901947, "uuid": "5e471f86-a6e6-40ab-b9b9-cd3589aae73e", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785901947, "uuid": "d6477b0c-617a-49c0-9b8e-4f7a850bdda2", "value": "393216:/GmPmXp5e4nJNZUXEryGsVLLsOPVQQPXMCHWUjb/cuI3/PGTAI:/GZaVwOPLXMb8bUH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785901947, "uuid": "d536bf43-bb0b-4227-8681-a89522424c6d", "value": 14298725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785901947, "uuid": "716eb2b6-bfc9-4615-b51c-975105b35633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785901947, "uuid": "a3d83b4d-1ba4-4b95-b953-3c2422b54bf1", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bda212b-9086-11f1-bd95-42010a9c0009", "comment": "Malware payload (Rekoobe)", "timestamp": 1785904189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785904189, "uuid": "fa18030d-e81f-4ec8-80fd-bfd2c5ecac30", "comment": "Malware payload (Rekoobe)", "value": "a2ee3169a20b362f70537ec2ece0c8d6", "object_relation": "md5", "Tag": [ { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785904189, "uuid": "dbe393bf-4047-412c-ae61-f58ba9fe508f", "comment": "Malware payload (Rekoobe)", "value": "46ce4b0fbe106258d9acd3af171106d85c0332079d489b391c35d592cefa030f", "object_relation": "sha256", "Tag": [ { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785904189, "uuid": "6fb8632d-41c2-40c3-9807-b65b1c623418", "comment": "Malware payload (Rekoobe)", "value": "1ebf9454cc58ecf3d3adcf0d7041f1e8b89d1890", "object_relation": "sha1", "Tag": [ { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785904189, "uuid": "aa828535-7c42-4ed9-a4d8-3e5588fdd299", "comment": "Malware payload (Rekoobe)", "value": "5ce36eccefc2ed3d561b8785cd1d79c68ba7a57321d61521be2451863e24fbb5d38c7514a16399f5e2458ceeef707d44", "object_relation": "sha3-384", "Tag": [ { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785904189, "uuid": "7738d935-207c-4052-8054-2ed5e1cc644e", "value": "T175057C47F6F374FDC167C1348697DAB2B932F46402122E7B65C4C6302E26EA41B2AF65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785904189, "uuid": "62901aba-2ef4-4a5e-941c-3fcae1e803b5", "value": "12288:eh2bzrRQV8dNDtRK7aQfjnk4mY4PoNN6GQJ/g6IyPzCHmi0bSlugKl:eh2bzrRQV8/SWQfjnk4mhSgPcMSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785904189, "uuid": "4eee98e6-9675-4a2a-a682-eae89a4d716c", "value": 827440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785904189, "uuid": "7ab6399a-c9c5-4e58-8a27-00a5a7248583", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785904189, "uuid": "90e2776a-77af-4cb7-82fd-8bb4ea5c23d3", "value": "lol", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba7793d-9093-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785909772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909772, "uuid": "d3e4f8b1-fbd0-4a5a-a6c6-cc8c80819d2a", "comment": "Malware payload (Mirai)", "value": "2b5da75bac4742717d9e74c0769f681e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909772, "uuid": "1958d409-2e77-4dd5-99a5-221638b1e209", "comment": "Malware payload (Mirai)", "value": "4759690d5d1d29a12400f9ca83e71e37923b7b1f0dc483280153e9e9aaf9b4a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909772, "uuid": "cc02b7d6-c4ee-4de4-8c93-ee247266b517", "comment": "Malware payload (Mirai)", "value": "79bcbea0bf7aad6cb16d517dc46e4f5fc0ae0c85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909772, "uuid": "90f09181-ce70-4f0e-b776-43ce049e5332", "comment": "Malware payload (Mirai)", "value": "2db0f5a1ef72d927d2f1460c07eb595294d012176da48992fff77a100eec4078ce2286e16d4989af8c960bbbbb005156", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909772, "uuid": "8eea5d8f-6067-4c5f-bfff-b7b32a340eac", "value": "T1EB4302C5D9389C66C2F091B0B9221FA13686E954B39E2973E3310924B664F8B77D3B94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909772, "uuid": "1df4514f-19e9-4d45-8cde-d57e8617da82", "value": "1536:Ya3EBhgKOZdzzFr/mkWmW8RXNTRu3MPfaI:Ya04vzFr/lWCVrPSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785909772, "uuid": "9b84c7dd-ef1a-4acb-8073-f2dca5e8fdfa", "value": 58160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785909772, "uuid": "ad7c296f-029c-4260-9cf7-20ec74cfec33", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909772, "uuid": "babd0b04-6474-4675-b0f7-d77440ebf042", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e40ae5-90fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785954217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954217, "uuid": "6a86c289-721c-44be-ac14-5caa6c5ccb58", "comment": "Malware payload (Mirai)", "value": "b83ed8505678ae317d8cec00cffc8a66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954217, "uuid": "898dd73b-3af1-48f6-b0ee-0be46e8e2e7f", "comment": "Malware payload (Mirai)", "value": "484a9a68014af692fa5c6da0f83a3e10e887b1d3381a483bfbbcb1a31b6f949f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954217, "uuid": "7d1be94c-5bae-4d31-9710-75796e876c07", "comment": "Malware payload (Mirai)", "value": "fd4fe4903f420a8c47c0318832714009e9b51933", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954217, "uuid": "089482cc-90d6-4aa6-9093-18f3bb06cec1", "comment": "Malware payload (Mirai)", "value": "74995291e34804a8f2938508c139985a8cea81d001abbb7658d16ec1d383c3f6507ec369e28168cf342848b5a78ec6d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954217, "uuid": "627f8bc6-89d2-452d-9c42-0fdc6a000150", "value": "T19BA3B91E6E218FBDF769C33047B78A21A39833D626E1D685E26CD6105F6034E641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954217, "uuid": "85322285-68c2-4e37-8725-e9b7591974e0", "value": "1536:CZptTNWMjWpa4mWq1SMLHnnHzTVp461rZlOyeC1f6Mds/RdV:0xNWMjAa4Z7c46xZlObMWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954217, "uuid": "c195b1b8-c506-40cb-b631-1e92e5dee589", "value": 97740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954217, "uuid": "18eb3c0c-6469-4282-84c0-07207c4364d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954217, "uuid": "2c096322-4eb3-4225-9a13-c7de9639c3fa", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be380cbb-90fd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785955491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785955491, "uuid": "65ee1b29-98f4-49df-905b-f14656545370", "comment": "Malware payload", "value": "2ae589599415dfb32a6b03e53a96b9be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785955491, "uuid": "598119d9-7e5e-4c35-93a1-62eb11520226", "comment": "Malware payload", "value": "4863a52ea633c1894b1331ae5cf4470e43be15e09765983a5f2bc853a6578a56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785955491, "uuid": "b15cfab7-4369-4c04-9ae2-3b831a9aed1d", "comment": "Malware payload", "value": "3ced531cc6ee384e6c03914bb803e78cc0c81868", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785955491, "uuid": "9059d9fa-881b-420f-af80-80a641f4da0d", "comment": "Malware payload", "value": "a6da4ab207b2aee726f4f452539a9c02da4dcf77de6516de6726e99ce18a3de9463b24a83c8ef60a5f9d88ae40e03555", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785955491, "uuid": "e57f9a4d-5792-4623-bd1c-a6f3a9b9c3bc", "value": "T14AA511EA9CF2C2B9E9DE4B7858ED0F850C796973CB00E5E540A388613DFF196171690B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785955491, "uuid": "80d0988e-04d6-4dbb-b365-9cdb7e64037e", "value": "2e33a544f54ef773efa81545fd112848", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785955491, "uuid": "cd494950-787a-4ee9-a851-a07dd3946842", "value": "49152:Y8fpPB+2b42HVfx7cQgJmriR0zKiXJhuGgxeCXt:xf9Bj4237cruKcJhYxeCXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785955491, "uuid": "2c930d93-1f76-49d7-8ff7-6cecf4c2288e", "value": 2150982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785955491, "uuid": "377a7d1e-fe39-40ef-8c60-f36983ba26b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785955491, "uuid": "5fb7fdbc-d583-44c7-8200-2c56e8aa48a9", "value": "Utils.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8790f6f-90a6-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785918115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785918115, "uuid": "a6da793f-71fb-4161-979e-7143b416c32e", "comment": "Malware payload (RemusStealer)", "value": "c1668c8f64bd19486d31db47daecb2c5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785918115, "uuid": "ced33fed-957a-4821-b5da-bce52dc18c83", "comment": "Malware payload (RemusStealer)", "value": "4881b36375cd5240cd6bbbe1391b904e0e13264cbaf14aa41c11403397253ca9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785918115, "uuid": "adadfa00-a08f-4df2-8727-b8c5e31b10a1", "comment": "Malware payload (RemusStealer)", "value": "07888273831a11240494188c594796679abd1e80", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785918115, "uuid": "b63c2cb6-8866-49e9-b4af-ae9a51769152", "comment": "Malware payload (RemusStealer)", "value": "d85aa594133b2913d4a5ae1e9c5770153797a0bc1edc81e287428f44179b3d236be712d3bfcc8c75c7536a63105829c5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785918115, "uuid": "180ff50e-8ad2-481c-94b5-e55b504e95b5", "value": "T1B3B533DACFB0989CF65EDFF2B88FB645AF22C7D65B9102367C0D164DA040A4BDB16241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785918115, "uuid": "d2cc1d5e-465b-416c-8702-a1801d05209b", "value": "d9c0bfb4053066384ee7484b4c2917f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785918115, "uuid": "2cf88c16-8795-4ac4-9e22-f3562b2eff6a", "value": "49152:Zk+VcSJHt+3Bxdv/+uAhwW1q0IErvjYvAb45hQYsHdU+wa:Zk+1bYdvmzwWw0IELkvI48Ys9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785918115, "uuid": "732b6508-66ec-4e39-a77c-42837f693fd6", "value": 2489616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785918115, "uuid": "8d39c045-e6c8-4c36-9df3-cfc93b37a3b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785918115, "uuid": "c14d653f-2c1e-442e-8580-edbf79de96db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af07e7bf-90a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917241, "uuid": "934fc66e-02b6-4200-9488-a4e1433b6600", "comment": "Malware payload (AgentTesla)", "value": "f3d6fe33b482c694ad5b8d1245e9a955", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917241, "uuid": "2cb09803-2e99-4847-83dc-afe144b66d9c", "comment": "Malware payload (AgentTesla)", "value": "4889ae0da32230745be234aa78671327998013209e740d60cef7800b774b16e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917241, "uuid": "ea7a305c-d2e9-448d-9324-f65add82c16f", "comment": "Malware payload (AgentTesla)", "value": "9a9212d425a3cb5d8f691f7e73beabe16c18d8a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917241, "uuid": "ec1569b0-368c-4cb4-bc9f-c942bc4584d4", "comment": "Malware payload (AgentTesla)", "value": "fdbd4e28ee687f8ce4f3fcd33e5fe7248c75b16d76c820c8943f423e86c14e9a394a0b7f001f8b5d7a006edf2a5d271a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917241, "uuid": "6d3c1e74-da6e-4125-8424-95b8ff84477b", "value": "T189D5E5916744D1727B20ABAE553B8E31AE0FA00354C6DF04316DE308776DD4FA3A9EE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917241, "uuid": "703a31df-c883-4da2-b58e-0f9d6594421d", "value": "49152:ec42E7BksYkUz2XfYphFe/l7QcpM3CJ7gO6M5xQpdaL5ov7/qz46rMjMrrYd+APY:w9ksYkqgYphFYl7QISVO6M5xQpdaL5KK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917241, "uuid": "ecf41bba-8d39-44fc-9ef2-3e5d02a33b4c", "value": 2959658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917241, "uuid": "7d83d544-db23-4294-a2f0-1598aefdcd09", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917241, "uuid": "59cf6efd-e55c-4ba8-92a3-5e66b34591cb", "value": "Perfoma invoice.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9a8d06-90d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1785938658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785938658, "uuid": "52d3a180-1b65-4d05-9b39-7facead3864b", "comment": "Malware payload (Vidar)", "value": "cc44aa912304bbb62c108a5280650704", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785938658, "uuid": "629f4a9d-ec3d-4763-9a15-3fdcd3a47d4a", "comment": "Malware payload (Vidar)", "value": "49e8d7172a7e387d3c3ca996b48b033c6ddffba42152ef4ce132fb906b774ea9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785938658, "uuid": "4636b5db-22ee-42af-9de0-110e7d3fe5e3", "comment": "Malware payload (Vidar)", "value": "91d36bbf06ffa96d1012412ac0a1c3e49c8b9998", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785938658, "uuid": "03840ad9-6b28-4f7c-a725-023e985ffe50", "comment": "Malware payload (Vidar)", "value": "2952097555a22dd4d87212482d919904696a67b8442fc416ed61f66c5081cf30266ba7633bfc5a3becfa932ab0ce7161", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785938658, "uuid": "ed171e37-5310-4d46-9d31-1694626baaed", "value": "T159E59E07BCE149EAC499523185BB52A17B35FC190B3223D72E80B7382FB67D09D7AB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785938658, "uuid": "8269c60d-4696-4dd5-95f3-29e299f73362", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785938658, "uuid": "cb142a6a-0541-4fcd-8749-270eca207093", "value": "49152:jZaDyp7y66n5bwDOH816TPbEt2JUs8Gb:jNGJc16Km", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785938658, "uuid": "2ac7fad0-dcb2-4b3d-855e-d8833965e2bb", "value": 3264512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785938658, "uuid": "ece74ec7-fd42-4e59-b95d-aed8318b099a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785938658, "uuid": "32a3be8a-d95c-45f8-98c5-adf5190c7a16", "value": "49e8d7172a7e387d3c3ca996b48b033c6ddffba42152ef4ce132fb906b774ea9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392f73ee-90a7-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1785918331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785918331, "uuid": "f2aafc95-073a-4965-a35a-7fa1a6d8261d", "comment": "Malware payload (njrat)", "value": "1822b73c4989c936b8f8da85257cd633", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785918331, "uuid": "76a3db61-92fd-4710-a013-96c7a6661acb", "comment": "Malware payload (njrat)", "value": "49f8c04bf8360c88ec8119a88db9b39abc517cbef4fc174138012ce306d37317", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785918331, "uuid": "da0b73ef-b926-4261-90e0-1e87d530c621", "comment": "Malware payload (njrat)", "value": "248f7272c504c796998734cb8b9d6138f1f7d6a4", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785918331, "uuid": "295a013c-344e-4656-bd23-52bfae1c924d", "comment": "Malware payload (njrat)", "value": "f0d11cd63763850ca23483acd96b98c1985629300f5e2d742d3ec476557be0f9246f3c3708bae130d1474bfdb7b49fc8", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785918331, "uuid": "c41827d3-6cb6-4970-8d2d-a77db477b2b0", "value": "T1321589A1A23297C0CB7D01BACCD97A4391277B77549EFBDA070D67660CC688E5C7E890", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785918331, "uuid": "8ca7ca0f-5995-4493-8006-e20ef7fa2d6c", "value": "768:RQq7eUuONrq7BMMceLOssBGJF9Mdugrj+kOte2lpJPhu0OoY9aDuylkPf/6bHf2i:c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785918331, "uuid": "33856d50-fd08-44f4-be0f-da0441b7cec8", "value": 939822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785918331, "uuid": "04a871b4-9e65-4fe0-b4bf-4fb53c061cf6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785918331, "uuid": "4124c9da-9e13-4444-9281-0c0fc26ebb3f", "value": "RFQ-SCM04429866,PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc2a505-9101-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785957099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957099, "uuid": "b07ada8c-605b-4dd9-8608-773fee478b10", "comment": "Malware payload (Mirai)", "value": "89bc05786c7586e77d365c0cba26d913", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957099, "uuid": "4f7e7bd3-2df7-42b9-950b-1cc25ad0bbfe", "comment": "Malware payload (Mirai)", "value": "4a40b533934722243cf816a07bf4b41f747b1a1438adcefc0e5cfc0da529e8af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957099, "uuid": "7b087e74-45df-4bfc-a727-c8d2856cb8f9", "comment": "Malware payload (Mirai)", "value": "3ea2281a59cb6a8ec77b85a72c016e1f58dc425e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957099, "uuid": "8ddcf627-e7ae-480a-9ad0-ff3fcad7242c", "comment": "Malware payload (Mirai)", "value": "f6be1c9c77a9afed0cef25c038d40401a4b6853383cc129506cbfccb3b32c24419b3283331e56e11a025bb065e349ae7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957099, "uuid": "fd680561-ea9d-4f55-be95-62bbab73c735", "value": "T1C8C329A9F890DE52C6D52676FB4E018C33231778D3DE7106CE149E34E7EB95A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957099, "uuid": "7d685c5e-237c-494e-8db4-e556cd656ee2", "value": "3072:I85FjA5l1pSzeFMyD1IekcYEEUw60MW/NwhrRtYaPI6NeFFJduIf1Dlg:IWdUieD17kcYEEUw60MW1wXiaPcT8I95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785957099, "uuid": "8befa4e8-2ab9-4351-a377-4ddd45bc02f4", "value": 124340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785957099, "uuid": "118be2ea-1b13-4745-8b18-6023cf6b02d3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957099, "uuid": "a2c6f5eb-7c10-4718-94cd-903f0941e742", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95fc538a-90c5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785931372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785931372, "uuid": "a4e1e420-57f1-4c3c-ac59-f4cb5a3b842c", "comment": "Malware payload", "value": "fd1562962b73a59a18724f0744f13556", "object_relation": "md5", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MEX", "colour": "#96BDDA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785931372, "uuid": "087bd136-ee11-4d75-810f-38ad927f4097", "comment": "Malware payload", "value": "4a6fef3f7173891b062a37a7b956cca2d2295590840e7582141da7612e3fc7f1", "object_relation": "sha256", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MEX", "colour": "#96BDDA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785931372, "uuid": "8aa04970-47bc-433f-98f1-e0d9a32ee606", "comment": "Malware payload", "value": "5a83c7053a61e55166814f2049a5dacfc15ec099", "object_relation": "sha1", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MEX", "colour": "#96BDDA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785931372, "uuid": "5d35cdf0-92c7-4cad-8d3a-6fc363a51932", "comment": "Malware payload", "value": "c5d221387c341b12336c8c1481d20ccd9c93f3954d0e10782f5521c9955235ae893aecd475ab747495c557442377ccb2", "object_relation": "sha3-384", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MEX", "colour": "#96BDDA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785931372, "uuid": "c367b059-492e-4e06-8f2d-f4d1c31beea2", "value": "T19C463332AF6A156B0A704319F01F1B337FBDC813424CD2A98DDAA15639DF686C63F865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785931372, "uuid": "b7ed4755-bb12-4487-97ab-20906c32b723", "value": "49152:hkpdOByEkHlyqELVq3vTbVRsNhqTxrS36LHMjni51YsVX72z3E59ZuJUTOoLOyml:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785931372, "uuid": "8150a0d4-1938-4857-b1c0-36c70a00db8c", "value": 5399489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785931372, "uuid": "16de185d-ccad-4f48-b88a-eda8a011bb20", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785931372, "uuid": "33980b25-b3da-4e3b-bac5-b05b4c19b60f", "value": "_04020Regist-P9D7AFYUTT_8ZN5InstYMYUR.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5388c74e-90db-11f1-bd95-42010a9c0009", "comment": "Malware payload (ACRStealer)", "timestamp": 1785940709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785940709, "uuid": "0202d6e2-9cbf-4ccf-a872-cac5ec0685fb", "comment": "Malware payload (ACRStealer)", "value": "ade58bbd2f3815119c28ab7ee05390b3", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785940709, "uuid": "ff3f01fa-8d5a-4f3b-b3bf-78572c5dbe7c", "comment": "Malware payload (ACRStealer)", "value": "4c245ae9f80db604f285eeb27f05964cc2f1dbd35f2cf2e60736fed39ffa5f7b", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785940709, "uuid": "de55b877-59e2-44ff-80f4-fdf37342c49b", "comment": "Malware payload (ACRStealer)", "value": "a678ce66bd77e10c88c32080a5187d0df1a88376", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785940709, "uuid": "b7faef23-c135-4051-8b37-6b5fe953af0a", "comment": "Malware payload (ACRStealer)", "value": "a6e0bbc9d9c8b8c7dbe4aac7f534ea9df1d61b5d784bc45514f6a7ccb0edf6db85ba05812f641f1df60688eebcb65832", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785940709, "uuid": "a56f48ed-bd59-4098-a661-2b4f185fdeae", "value": "T119769F1BBCA608DEC5ABA17440137A26BD317C1057157FAF17A0B3343F736A1A99A738", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785940709, "uuid": "b7526dae-2b12-4d0d-aa52-8aefff899bb8", "value": "aa205cd3438a05c4b9bbb4bbf214b45e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785940709, "uuid": "eda1e219-9c3a-4551-a2ed-d072665781df", "value": "49152:7vh9spa69sHaZm6pw8WU/X8E7bMLIRQR7+XR0T3GV8LktT6ko15zEib7ifPobt:7vnQGaZm2dXCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785940709, "uuid": "1d7dec9e-036e-4bcb-ae58-abe3a5552f0f", "value": 7512896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785940709, "uuid": "0f1ecd67-3aee-4dfc-b94c-7a4db3cba1a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785940709, "uuid": "7f3016dd-9cb5-49ca-935e-ebf1931b43b9", "value": "pdogowpktkwtuesavruw.DLL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c17b50-908f-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785908048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785908048, "uuid": "fd7c94ff-67f8-468c-a812-73ca34943a2a", "comment": "Malware payload (AgentTesla)", "value": "3ef62083dc7fcdcad082954d8675b3de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785908048, "uuid": "58626df9-7f05-468d-b8b1-9029e5fb74fe", "comment": "Malware payload (AgentTesla)", "value": "4d08acae8180270235f519d9ec24e27e94c32f5c0370edd122bc6dc1f33a8240", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785908048, "uuid": "492c04f6-ad55-457a-826c-ee5d58e9c929", "comment": "Malware payload (AgentTesla)", "value": "dedbc07d033f66fbb74065c82912d646c54a2d5b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785908048, "uuid": "f5a69747-1e32-4087-b37a-2b0275e2faf3", "comment": "Malware payload (AgentTesla)", "value": "3bd1b0c6efcadb0bb557e5c8cde00449fcf22993ca6b771a15b4a1210cb6c812af04c9f6323f62bed0df5e0e26826d75", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785908048, "uuid": "85bf7d6f-d2a4-49ae-b568-059aef535d22", "value": "T1FB340F027F88E715E1A93E3782EF6C2453B2B4C71633C60BAF49AF5524516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785908048, "uuid": "5936bf30-4f22-47d1-9955-c5a07dc930a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785908048, "uuid": "2ba64c37-aa78-4438-8003-cb70fe4bbcf8", "value": "3072:ECliq6CyZVc/2MKc2BLIg0THo9rG8KaG5jnTh/qYufzz:Viq6CyDY2Mk+sq8KaWTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785908048, "uuid": "2ad12004-3ad4-4c46-929c-2477b751e876", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785908048, "uuid": "76ffb01f-46b3-460d-8155-c56a8e27e95b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785908048, "uuid": "68386a14-4f99-487a-a82d-6ed89f0d7de4", "value": "CUSTOMER STATEMENT of ACCOUNT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca6a50c-9095-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785910633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910633, "uuid": "7f521c7f-d920-42be-9999-493cff79f6dd", "comment": "Malware payload (Mirai)", "value": "dcaad420ea4ef5a294eacd16bdf66ea4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910633, "uuid": "cbe98014-38a5-485b-b603-c9c159f836fc", "comment": "Malware payload (Mirai)", "value": "4d6387cc077dce1889995f555ec74ed5fa3f66ead3e453b069031e89cfd5226a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910633, "uuid": "be5a97ef-0f93-4d89-9274-f8f69e547e74", "comment": "Malware payload (Mirai)", "value": "5a48e978146871536c900ce17d6acf20e80a78fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910633, "uuid": "0cd6c7da-1719-447a-aee0-b9f0e01210bc", "comment": "Malware payload (Mirai)", "value": "4ff9c33d28bb25b19739b2524dd74b76f1339a07d972ebb0e34cdcd79b19dc36d703e7df252f27dce9a5526e47f2bcce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910633, "uuid": "cbfb2ade-ec61-4bf6-a3b8-a359324afcde", "value": "T159F45B42FF1C0923C9430DF0297E43D5F3617A9281B9D239331E5B572622E76AAC779A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910633, "uuid": "7bc30e3c-552b-4047-bd7b-04285fb3b81c", "value": "12288:aejDOcGeEfwH8VBONt7H4gLdytJNECDH5ZQQF5QkrZLep1US/esHL:9LEfwH8VB+4myxcQFCkPSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785910633, "uuid": "3c33944d-fb96-4c4f-be7e-333870e90148", "value": 726992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785910633, "uuid": "999479e6-c651-4722-8d3e-92ed6edb4eae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910633, "uuid": "90749d8b-1578-49e6-91d5-c80ac5c2c384", "value": "xd.ppc440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f999199-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1785917644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917644, "uuid": "185caf0b-c030-447d-a4cf-06b2bfdf6a44", "comment": "Malware payload (AsyncRAT)", "value": "cdc4d0093f4c912d6efc9d82dde2ff1f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917644, "uuid": "3549ec86-1f2b-4d80-86ec-ccb3fef957a4", "comment": "Malware payload (AsyncRAT)", "value": "4fdc7e31fcc7c2eef5da1995217c3b9533d371f16bcbe5919eee7d102a8a4fe5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917644, "uuid": "f97a8018-20b1-4267-8bdd-f14fb3e0c740", "comment": "Malware payload (AsyncRAT)", "value": "1769c7f367faf56166e9962b7c908f1b4bf9b1c5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917644, "uuid": "e707ea38-8536-4a3d-b7ca-36f26b099510", "comment": "Malware payload (AsyncRAT)", "value": "696920cfd99ffaf1bd2ca62660693fb32d12f42a53a4da00de928f5bc756f3528ce50fa982730fd0294d285249483a57", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917644, "uuid": "760cc022-50ea-466e-bddc-710a9d5c2266", "value": "T18934AF842F2F902F51F176B5446E73C15123622DA6529AE1B8A0DE5A332FDDDABC07F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917644, "uuid": "5a022f20-7a84-4518-ae18-0eca6c5bbfad", "value": "3072:LWKvrpiGPOTOi1I6olsTzU3ijEWItXJFaygBu6uY8w8LL5TykF/ltjm4W8twv2W:JjICM1IfsfWiQp+/c6uLTZPfjhKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917644, "uuid": "a8e22ddb-8f9e-4e8b-bd3d-07887ecdd9ac", "value": 230582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917644, "uuid": "c5872717-ae18-4dbb-9d54-332989cd6beb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917644, "uuid": "77febefd-5fdd-4bc4-b7f8-e0f7ce75e172", "value": "yazi.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2ecec4-90ce-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785935224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785935224, "uuid": "f8c1c279-9b7e-4ed5-98fa-ddc24563682c", "comment": "Malware payload (Mirai)", "value": "b5300c1a15bb5af6a97b9abaf18f65fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785935224, "uuid": "315e5bad-20f9-4902-9df5-d0a32ec6e85a", "comment": "Malware payload (Mirai)", "value": "50d595843b66c092f100576070ae14609806cc87c7c90ba0164d8a63d049f558", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785935224, "uuid": "218d0f66-799c-4a9b-87ed-569c4acfc98f", "comment": "Malware payload (Mirai)", "value": "a6eacd52b30f9fc092ad8f1b9e22d763c4ea04c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785935224, "uuid": "5aed1e75-0295-4c31-b854-1127752bcadc", "comment": "Malware payload (Mirai)", "value": "1474bbe173835f1e43a8492354493e11a7c7f7d1348f443f6de4272d79c8abb91e03974a2ed52295be24423cca18ad99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785935224, "uuid": "4fe3be55-dc89-45cf-8f81-54ba7b0f0913", "value": "T1F1265B65BD1EE5A2E6C833703B6582D4323EBC48DF41D2236611FBAE59F675C8F22112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785935224, "uuid": "c7a19f12-61ff-466c-9e5d-51e42f840e0f", "value": "24576:6dRxtlHgH86SC4A/0eGRZs1c0+9PQNucbbgrm9YzMkX/oiHKdqZ5cz2L/Nninfno:6lTba0Rz6kIAbHJw2L/95EgKG+M2B1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785935224, "uuid": "98fac649-bf78-4b06-b8b2-c43d76da9d76", "value": 4521984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785935224, "uuid": "9b6f1a1d-81e2-431e-bd6c-ec39192fb716", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785935224, "uuid": "ab5c5988-0ca0-4013-9935-c6bfd7039443", "value": "android_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c7a84e-909b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785913256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913256, "uuid": "3cd2696d-21c0-4d74-b920-71055ba99a71", "comment": "Malware payload", "value": "84aceeb11ef529f55f407b197d845005", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913256, "uuid": "57e38df9-f3f9-4b47-8b47-287b3ed7dee5", "comment": "Malware payload", "value": "50f93419c211c6dcb2ecc0c40761a33397fe1b0dcd9271090fcc10f57735ad2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913256, "uuid": "95d28987-7d67-411b-83e6-dd8ab8c4549a", "comment": "Malware payload", "value": "c69d99cda4987061ce13578a31d1ae2a2da897f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913256, "uuid": "928d88ce-a47e-4ef5-96d8-4b7b71894b15", "comment": "Malware payload", "value": "6df05094a3d9b4014ecd2fce55c60e21b33f1d6663dd0ed17d9384d86c0270cc5507cb18d149bd9b9df42925912b22b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913256, "uuid": "9c728886-25c2-41d2-97e8-437a3382145a", "value": "T169E69D77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913256, "uuid": "066afb42-e911-41c7-be8b-76a168e29724", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ0:cqYUQuVDt0TZEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785913256, "uuid": "697e8c4f-72e2-4ec5-bd1e-c7018f9adbda", "value": 15237120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785913256, "uuid": "f1bcf6eb-6e0a-42f0-bdcc-82da49929941", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913256, "uuid": "d2d75b6a-5a27-47b2-a5c5-ab19cf44fc03", "value": "50f93419c211c6dcb2ecc0c40761a33397fe1b0dcd9271090fcc10f57735ad2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c634dd2e-9093-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785909978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909978, "uuid": "34e2b0ec-d64e-45c2-b98d-da7c482e45cf", "comment": "Malware payload (Mirai)", "value": "e990c4e7e1ed84582d69ac251a15f192", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909978, "uuid": "06830591-5e4d-40f4-8dc3-d789199a3b3b", "comment": "Malware payload (Mirai)", "value": "533c98bb5892e4d1bc65e861bd5c9cc979401da825e26bbee312273103cd7094", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909978, "uuid": "439a8487-88a5-4960-8971-399746f7b442", "comment": "Malware payload (Mirai)", "value": "d14dd15498d0a823610adf83caabb072a4ee66ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909978, "uuid": "66637a1b-f1f5-41f3-9ebd-b660fdbaa2b5", "comment": "Malware payload (Mirai)", "value": "9e847d33c382b2e9d6a6e865e84a63752198b4d332c042530359ac3f652339435e3b82da68cebafc54befc53ecea8948", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909978, "uuid": "bfc19a52-47ff-4d48-81be-5dbba4c5862f", "value": "T16BC32AA9F890DE52C6D526B6FB4E418C33231778C3DE7106CE149E3477FB95A0A3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909978, "uuid": "fa90acf0-acad-46be-b7b4-a167f88035c0", "value": "3072:R74ICbzNB9v9/KUMnZGIKgcYEEUInhMWTNwhR605cqv4NvF+6Aur5mf1Dlo:RsZvBArG/gcYEEUInhMWBw6icqeNjNmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785909978, "uuid": "5a58a8fb-0928-4125-842e-7531963ab8f4", "value": 128444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785909978, "uuid": "4d724cb6-f1cd-4ab5-a58a-a953fa56779a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909978, "uuid": "b790361e-064f-4bc8-b157-687182e6f49c", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06144a5e-9129-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785974080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785974080, "uuid": "1e66204e-2f5d-4f27-8db8-648d09d3ac32", "comment": "Malware payload", "value": "c5d688ba843a446a819c3825c1cd5f34", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785974080, "uuid": "07ca6d22-f562-4b66-bc57-458a5e24256b", "comment": "Malware payload", "value": "53fe10c9126473590e35a1fac360f48e815cd39ec48e3bf73baf350300dba3a4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785974080, "uuid": "e5827c2b-7c9e-4360-9d92-dccaf196093c", "comment": "Malware payload", "value": "22acdae08e83a6b557479cdc2d656c9c587fdbe6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785974080, "uuid": "9d78c83d-8ec0-4e67-999d-3d6a86f2fd82", "comment": "Malware payload", "value": "cb5c3a1fcd20d6b283910bf169fd4997140e363da0998a8f07874f998e03f25e7d961333772c65d3ba0c09e1bba14b53", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785974080, "uuid": "63be6317-875d-4db6-93d6-34ad1398fe86", "value": "T10AA5E1D3EBA645F4C5F21838623EA613E234350D87185A7BB3DD0AA03F2674D94B971E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785974080, "uuid": "227fe0f3-ad33-43e7-b137-f51cc1bc4797", "value": "de85a398477c39117ee5fd3f2278b959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785974080, "uuid": "baf53f64-a052-49f0-afa6-6f4d4960c583", "value": "49152:Gd1/CqfWT+jF7jiViWSdL434iQUQC/4dW/vYm3CD4rtT:+xFJFMQU5/pbCDWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785974080, "uuid": "914e5435-0f0c-462b-9c0c-5a13f1593497", "value": 2205184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785974080, "uuid": "768ffa08-c656-43cb-a4f7-b5135d2869bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785974080, "uuid": "b968f2d4-a358-45d7-ba14-838f38483b5d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a7d3a9-9103-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785957884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957884, "uuid": "91a06469-e947-4588-9573-82d5179b4b81", "comment": "Malware payload (Mirai)", "value": "c2b38e1062f80088384e5714cdb74e49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957884, "uuid": "d0e3ed6b-b8cb-4553-b031-074c8df31d36", "comment": "Malware payload (Mirai)", "value": "550b200e7cdadd099c0e54cad3a479f7cb3a78a96cdc82ef21bb8f6dd5871f38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957884, "uuid": "93e36ae2-2759-40c1-bbb8-91a313a8efa1", "comment": "Malware payload (Mirai)", "value": "9b13c7cae7bbc9977180a845931ff13e76f02333", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957884, "uuid": "dcea3aaa-82f7-4e07-b825-152173fea51a", "comment": "Malware payload (Mirai)", "value": "c09b9781f6ccb9785a64ead766515af18cadca2789011a6c7b572cdfb9765ebbbb5fa3fe349b52e33bb55ed6ce0437b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957884, "uuid": "e414498a-70f8-4738-b923-772b11c57577", "value": "T13E83120FCB368E4EF47E01F60FD98E267A95DB051E589D6E80807A356771045E03EEA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957884, "uuid": "b09e14ac-f535-4520-82e6-6888acbc1eee", "value": "1536:vgQX1tYkQnWdsR/ZhOkPXUoDC1hWZoK7tp5gPc1dsOrMUeQo:vfSWAZPXRDCHkB7D5gPUsOrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785957884, "uuid": "1be95ed0-a2c5-4054-9d66-cdf7d6616535", "value": 83460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785957884, "uuid": "3e4cd64f-5bf3-4b01-8793-1edbf622d177", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957884, "uuid": "40a740ac-f893-48a0-b36b-4503b19e574e", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0205194-90d1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785936597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936597, "uuid": "87ad314d-c4b0-4897-85f8-248f678e41e0", "comment": "Malware payload", "value": "58ff753f30b9495847057ace047f816d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936597, "uuid": "5f44fac8-8ba6-42f2-9cd3-d960e51b614d", "comment": "Malware payload", "value": "559529c54442aea6d6aa5639e51e8144bba3cc6fc5c658e0d59d58411b05c0b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936597, "uuid": "72ea0fcc-3f7a-494f-9a4e-4cf0cb9b3e35", "comment": "Malware payload", "value": "d3b9a5dc9c5d14c2fe29d91e5ac75648823cded4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936597, "uuid": "6012218a-2c72-4069-8cde-d74afd9c6b76", "comment": "Malware payload", "value": "b50123771e16eea7ca765ed3548e811724a3cbf5b4b2d3be783aef28e4f1a4760f300d7382e4b01f59dc24cfa09c1e6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936597, "uuid": "f6b26cdf-16bb-46be-ac82-674298ff9752", "value": "T1CED5239979FA1E74D832C7B64F52F03E70297B448B31DEA37AC829009E635585C3A3B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936597, "uuid": "ab183b9b-f39f-42e8-bd1e-51c63e64aa5c", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936597, "uuid": "b83214b8-ae18-4aec-bc52-05b5663e90d2", "value": "49152:Rzcg4z6lfIyKykdfB+mi3/MtuIx5IF6gR6q7tUeAD4+EhUjiaKG:Rzcg4GlfIyKy6hi3liRS7tlW4ph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785936597, "uuid": "22181fa7-9c75-4c88-af3f-893f462b1bda", "value": 2951168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785936597, "uuid": "d3c316ac-e1b8-485a-92de-9661eeaa886a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936597, "uuid": "c84c9ba5-8f1f-47e7-b07e-542953da3f1b", "value": "6eq5gvOfRvNmCi54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ae7e8a-9077-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785897815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785897815, "uuid": "d2970d7c-d358-47b8-8a6b-d6900c27d1a8", "comment": "Malware payload", "value": "2964fa0f630463150faa4313bca1966f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785897815, "uuid": "bcfcd1d4-1370-4978-93f2-1ee81c590699", "comment": "Malware payload", "value": "563bcacf84a7c6e900023f7970caaace95bf49c91f63f76c295d32a8f9cc55bf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785897815, "uuid": "3e766ba6-7652-4170-8f55-3e5274c52285", "comment": "Malware payload", "value": "d45a66ddcc42faa5463f6f2b83e78397012a3d78", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785897815, "uuid": "07a9eba2-1908-439e-8f40-7a6910e7d5bc", "comment": "Malware payload", "value": "f83814de6605f442538b699dcbbd1038f430a0714efd337e074731ce7a270b5d49e89101b3bfb9cf77bf684fead25fa1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785897815, "uuid": "eae54344-da63-45c9-9a22-2592cb645fdb", "value": "T16DC27D956A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785897815, "uuid": "0b3356c0-7682-4441-a6b4-053a0d656d48", "value": "768:Y8vCB+25j6es8RY9FYpMSUpi+20qUpi+20YQX:Y8l25Jud2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785897815, "uuid": "dca3fe78-8731-45a2-941a-821e405f6667", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785897815, "uuid": "6f43072f-1909-4e8e-96bc-466c8da2fb05", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785897815, "uuid": "7a102398-2b9e-4448-bdeb-e67b8814ab53", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876915ff-90a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785916745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916745, "uuid": "f4350b01-c9c2-46ba-ad73-203207b2fb8b", "comment": "Malware payload (RemcosRAT)", "value": "c002541c310d4e98ad770a8c5cf039b6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916745, "uuid": "5bca5574-83b6-48e5-8443-35d5c495301d", "comment": "Malware payload (RemcosRAT)", "value": "57ba59bc77bba0970e5092ccb97f629c327dc1d4ff3087844e838632fc8856b2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916745, "uuid": "c84a7345-90a6-4926-8dea-534c1f404b36", "comment": "Malware payload (RemcosRAT)", "value": "677d522e462019142b21dae935709b3239322857", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916745, "uuid": "dbd85479-d755-4d01-b3cd-af9c024590ab", "comment": "Malware payload (RemcosRAT)", "value": "77233670ed8bfbee820c31c3905b588e40194a7e037fb18be94e446d4bccbfca630cabffe375618138e2c83ff937b2c3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916745, "uuid": "35afa3ec-987b-454b-a29f-4139046b5e01", "value": "T121351CCBB371035C184872DACEBC6E9D2854FE92D110A76AFDBC3787D60C659A290F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916745, "uuid": "304fcf9b-f180-4dc1-b852-95d08b11ad09", "value": "3072:thlNnWpYOqQDacpAFREFXdxNMvlCnk+P0iVIEtmDUd94BP4Fo80+8qQV+Drc5uM8:lcxz23O9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785916745, "uuid": "50089d0c-770e-4569-a30d-f9014b94c221", "value": 1064240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785916745, "uuid": "1632f8be-fe0d-4225-9572-cb3f268dddf4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916745, "uuid": "3d0a81de-fb4a-430b-8098-1577ab45bbe6", "value": "REVISED PO-47010065733New.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cbb134f-9102-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785957368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957368, "uuid": "8ba6b34a-6ac6-43a8-9d8b-850b0f3d7610", "comment": "Malware payload (Mirai)", "value": "6e997553dc2acc7721cab646801b28da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957368, "uuid": "0c669f7d-0698-4146-b2c9-9c76258d9246", "comment": "Malware payload (Mirai)", "value": "57d3bb540b754e9fbcaf5f5c49204c1814a07864856a8740bb43716cc8a253b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957368, "uuid": "911527c3-d580-42e1-8f1e-7c62d9953efc", "comment": "Malware payload (Mirai)", "value": "4a47b84ed921b8702a25d543e3ffbf8ee6556a59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957368, "uuid": "09e98e12-db46-4d91-bb19-3cea1336cbe7", "comment": "Malware payload (Mirai)", "value": "b73822a23d2b731e647c3fbaf6ead174ecfdc18fe1f881e4aafd8ae197a004d0f929049d49083deb24a294349ecaa4b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957368, "uuid": "504560af-1432-4a0b-a00a-a60d0285df6c", "value": "T140C34A0675A144FCC156C474C77FE927EA31B85D12303AAE7B84BA31AE22E365B0AB51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957368, "uuid": "eb7d332f-fe9c-4bf3-a6e5-57d47aa17ea0", "value": "1536:kjoqk+INc2+1ZDIq41/GPKRa49aPm/isY39PY2gaxnih1/GAEw8zDXG44dorAnA:kjpX1ZDI9xGyxUEKYWliWAENDXG4ZsA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785957368, "uuid": "5c4e8981-ba3a-417c-a70d-a0e59dec6160", "value": 124792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785957368, "uuid": "087b7f33-c25d-4e64-be9e-f2c0afde79c3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957368, "uuid": "7dd41be4-5735-44d0-8350-cc6b254fadcd", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1278f6f-9103-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785958019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785958019, "uuid": "103d97b8-a0bf-4111-a088-b99d03c653a9", "comment": "Malware payload (Mirai)", "value": "4c816e836e6f7d365ac4a24ebaf83333", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785958019, "uuid": "667c6041-8d1f-4e02-bb93-1ac40020d6ea", "comment": "Malware payload (Mirai)", "value": "58344ba1d657d0620d762730bcfca0fc5d7df510777c7984db227e3013f6f356", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785958019, "uuid": "c9a29366-3bd5-45eb-b4cb-7113edf84831", "comment": "Malware payload (Mirai)", "value": "04c8f09cc41bfb00aea7e622237e0e9189d49b3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785958019, "uuid": "b9dc7505-fc1f-44d7-b5e9-2b5023a95db5", "comment": "Malware payload (Mirai)", "value": "1145e97b6a6d67615f0dadc993a1d40e59cf74109e769b8fa85df8cd70c0ea260ef6d8076c1590b979b26e466025c23a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785958019, "uuid": "362ad595-97de-4dde-aabf-cf931f0d8bdf", "value": "T146B3F755F880DB62C6D4267AFB4E428D33231B78D3ED3102CE14AE3577EA95A4A3A502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785958019, "uuid": "a1415dca-e8a4-4b84-aef9-0192ef38aa16", "value": "3072:/4hcWz6Z5lcaysMfJZKGRohO5A1cqdRFp4cdai:/4hcBlcZsMx1RohO5A1BGoai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785958019, "uuid": "b593203c-0c01-4206-8930-0951314ed97c", "value": 112160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785958019, "uuid": "5669e1ec-fa5a-48ef-a2d1-f4a26512d0d1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785958019, "uuid": "53ec9bfd-5ba9-4e94-acc6-183aa3c08ea0", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a57ae1f6-9101-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785957168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957168, "uuid": "9f6083e8-5b09-4b70-8d04-005aa0f0cd3c", "comment": "Malware payload (Mirai)", "value": "d9fc60d47882a8515c11b9671a008995", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957168, "uuid": "73cdea2e-9d46-44a8-97c9-693ab84412eb", "comment": "Malware payload (Mirai)", "value": "59069b2962fbf85d1c37429a2545dab9fa21c6a65a5662440e9575f17f58a8b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957168, "uuid": "57708c3e-318f-4581-b3ee-6f7890f69596", "comment": "Malware payload (Mirai)", "value": "568f898aa05caf5f2d7268d7a56223f9c78e397d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957168, "uuid": "197f2a63-83eb-4882-a2f3-9f58fb569290", "comment": "Malware payload (Mirai)", "value": "b4c2b7f5c78824e4dea88acdd2b33ccc172a9f997cb21faa132a4592da565d2ee25634e68b9eea1c1701b8df564fb7e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957168, "uuid": "124fdd2f-4405-44ba-8efb-9fb04688b71e", "value": "T13533F1301A4EDFB5C4B40EB3B1D66298527ADFF103BA19A5608567D063F20B9321CE9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957168, "uuid": "ab96bb43-e031-4065-a100-6d8ef639682f", "value": "1536:xnBIHmIgpB7zYd6CcqMqjYfDKyjsL8gXZVRWf7:xBIYp6EqVtygwgXjAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785957168, "uuid": "cd084322-03a3-4124-9004-16971b7cf16e", "value": 54492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785957168, "uuid": "9d2bf325-294b-4d05-851d-70d933eaa0ab", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957168, "uuid": "0220f741-ae49-438a-9656-4c9d7cfb985e", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5caebcd6-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917532, "uuid": "006c971d-5fb8-4123-92c9-fab8186b74c7", "comment": "Malware payload (AgentTesla)", "value": "d61cdf5fc94b0d581ce32adcf7fa1406", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917532, "uuid": "9c3397ff-9d0e-4de0-bc47-257501292c85", "comment": "Malware payload (AgentTesla)", "value": "59bb8229fb059a3a65dcd25cb1997e0fddaa90b8cf76bfceb351dc481bb81bee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917532, "uuid": "65543001-c67d-40cc-adb1-c6a1842e42cf", "comment": "Malware payload (AgentTesla)", "value": "31b9e1ccd9f6d9f875f037602c8b09468be42cff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917532, "uuid": "3b3124b8-3579-4386-8b84-f1e368b8d3f4", "comment": "Malware payload (AgentTesla)", "value": "264e35be98e62ce740773ec3b3d9ada843fbbb655956a4ecb54f75660ccde7f245ee84881281889f55edd5dcc902bcce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917532, "uuid": "c614a9ef-0193-4397-a9a8-955234c04614", "value": "T1A3F56C0207469163E5B81A7896096BDFDA3ACA173D849E073AFC558F5FECF04F29852C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917532, "uuid": "8d4e015a-2f92-4228-a516-5d32894f10c6", "value": "98304:f4ArjnhdpVU1FvWQ2zxamHLYP9ic9uhrY5lq8mw/:zjnFehqxamHnKX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917532, "uuid": "c345ee2b-3c74-4402-af67-678dc84b5fca", "value": 3328410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917532, "uuid": "2048d53a-a1ff-4899-86c0-788e0ae99310", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917532, "uuid": "8f6fc6ff-bfbb-4da6-821a-689e192f2061", "value": "info_New_Order_7132026 _PDF.shtml(~99 KB).JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284896e7-909d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785914008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914008, "uuid": "d2c362af-bbf4-4cd5-81c7-58bab4edb749", "comment": "Malware payload (Mirai)", "value": "56f3d0520e635c42d5be52c787c3b4a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914008, "uuid": "7f9c565b-cd2a-431b-afe3-7e882b8125f4", "comment": "Malware payload (Mirai)", "value": "5a00f93541e8b2bf7e2dc16ce2d349c82bdaa77ff3ca2666f622150560871d5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914008, "uuid": "ec1dbbe0-8719-4b83-a049-d19949d94d24", "comment": "Malware payload (Mirai)", "value": "ee57b387ba10cd2225bf76daffd67607356c28f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914008, "uuid": "1e717e75-ae35-4055-9e22-4e769484c057", "comment": "Malware payload (Mirai)", "value": "4586196a74b6636ec90b39d52e15aceddefd349af1ed30e602db93bb95312eb06f33a3158b314de4a6a831e8a1f0a866", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914008, "uuid": "21cf6981-5efd-4d33-bf13-e7aeffbcf061", "value": "T1C2E30845FC518B16C6C662BBFF4E428D772A5768D3EE320399256F20378B96B0E3B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914008, "uuid": "9f456733-8cec-48fd-a31a-1149c72c2018", "value": "3072:3OtstuCDxzd9AOBDZf9Qq94cZwiSXUtgKh8J7/8ZMEh+8:3+stuCDxzd9TFfDCcZwiAUtgKqJIZHhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785914008, "uuid": "7a1e0236-218e-49f4-83f4-ee63047b4aec", "value": 154360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785914008, "uuid": "48e98658-9a2d-4408-96ef-d174037bcf45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914008, "uuid": "147ae2fd-89fc-4e00-8a1f-f9fae9d3bae6", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e99b6bf-910e-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785962579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785962579, "uuid": "9dfb3957-f5f7-49db-b3bb-0e575cc212fa", "comment": "Malware payload (CoinMiner)", "value": "5c336f724d3da4b821c3fa6a69f92746", "object_relation": "md5", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785962579, "uuid": "ad3914b7-5a6f-4966-bd55-f74646d6d042", "comment": "Malware payload (CoinMiner)", "value": "5bab10c1591c7266cbfc42b0e40ee060ba34ad4cf5cfd0d7a1913516c836953c", "object_relation": "sha256", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785962579, "uuid": "8b2ddf7b-4b4e-43d0-b1ce-799578a93be6", "comment": "Malware payload (CoinMiner)", "value": "0e137764acb0ad25066d4222b37a45eca5b66515", "object_relation": "sha1", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785962579, "uuid": "4afaf646-2b24-44ce-91ad-f17f1578d2e9", "comment": "Malware payload (CoinMiner)", "value": "a103ede9962c8e1113f62b6faec97d8646eded9f8eb8326f2befa6b99fcad840add1e9352f42dc91794584b63596f18c", "object_relation": "sha3-384", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785962579, "uuid": "591a973f-5ef3-474c-99f1-0c48669af534", "value": "T19D3633A6ADC295B1C047C3F8442354AEB33A7B91CAA07D56779E79888E37F06603D7D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785962579, "uuid": "a00ce879-1df7-47bd-93dc-79cae18813d3", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785962579, "uuid": "18ed19d1-3844-4202-acde-63d9f4525b3f", "value": "98304:GAJdY+0Ll6TK09RUIFr3psguiYdHIC2vPF2C8enAkbBI+G+vmhCU:drY+0LEe0//Fr3psgWiF58enLw+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785962579, "uuid": "d210dcc7-893c-4587-bfb1-6dfd56048876", "value": 5248512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785962579, "uuid": "8c899f43-1238-42d1-a8fa-e2db20fd5888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785962579, "uuid": "134517cf-23aa-4ea8-818c-3296c5af1d05", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a1aa757-9068-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785891275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785891275, "uuid": "ce0ec3e5-1934-4e9c-a664-11a3a332d398", "comment": "Malware payload (Mirai)", "value": "ec6f8d8d8cb60fd3e8e91c9a744f4214", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785891275, "uuid": "291ec8d1-23a1-44cd-995a-3f6fe9819261", "comment": "Malware payload (Mirai)", "value": "5c5e89bf5b0ecf61e19bcd0f50f4edcba6b256c8862b4ee8f5efa1c416956c00", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785891275, "uuid": "1602f9a4-e6d3-4613-9ecf-e695c4290fa5", "comment": "Malware payload (Mirai)", "value": "b5b335233d8531386148b0ff25f0f26d5c94e154", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785891275, "uuid": "60516e31-0af4-4c04-af68-6b18e56cce13", "comment": "Malware payload (Mirai)", "value": "e269f6824d711a205b21d541b28f9c3d1d3fdba0ee6e8823e85842c6a744555a5e7d284fc01793360bd76e20246ac61c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785891275, "uuid": "2a5cbd0f-af77-47a5-a0c5-2eb85cf36d9c", "value": "T1CB01ABC6D560A500905DD91E62EB52A0B821C3C7465B0F787FDC993DAB98D05B0A7FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785891275, "uuid": "9ae46f62-7dba-4dd4-9ea4-4c65a9d61dd0", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaVjCoT2C3+sbjC4XCefIChzMbauD:kXCKysE2hi0ziQvZohaVjxC0+s5hgUU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785891275, "uuid": "084377e2-6271-4764-aa22-d8bb838df984", "value": 831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785891275, "uuid": "4ae47059-4ef6-421f-b2b1-b25a84deec12", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785891275, "uuid": "4a9f57c7-decc-4e63-9f0d-7586e5e7c120", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ea01eb-9072-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785895693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895693, "uuid": "e85d8549-7e35-46d6-8793-1eb88161931f", "comment": "Malware payload", "value": "24cef98575e7a54fd5ec53671d0c715d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895693, "uuid": "ddc97d1d-e36c-4175-b3fb-bb875d72f47a", "comment": "Malware payload", "value": "5c724000830082753cdb5c57ae528b92350d9ff94bb0e935d17c04b9b41253ba", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895693, "uuid": "967f8c08-2075-4861-acbc-4db568f76369", "comment": "Malware payload", "value": "a706a6ad280e0f071553ff4fcba92738f52cd7e6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895693, "uuid": "2bd2ce29-2c76-4f2c-a6e5-66c14c886cb5", "comment": "Malware payload", "value": "c7c2c54361699fd1fc39832449b338cb1abc970984a33590c48ceae56c1181b13e4b57bdb3e0894eab1b498aad465287", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785895693, "uuid": "b1f152e8-9c14-4514-b48a-7926f25042fe", "value": "T1F30186D603225B65F8E46D1D70E1C42A93CFAEA522D82BCDF57609513C49C74B821B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785895693, "uuid": "e79117fd-1062-4520-8e6e-11eeb28156e9", "value": "12:B3O9nPOMoFkCewpCNOWNn+0tO9nviaOMjCewtNCNZt+JGy:FOtOMYkCBpiO7OMjCBv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785895693, "uuid": "e20736f9-0287-42ce-8b6d-93014cf49e32", "value": 661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785895693, "uuid": "5b3ad95d-d035-4bbc-9fe9-41943c4718cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785895693, "uuid": "93fc9dba-449e-409b-8a4c-c4acfdd12a90", "value": "tbk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e95c6d92-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917768, "uuid": "152d266c-b95e-427c-8705-f131c8490b00", "comment": "Malware payload (AgentTesla)", "value": "32b908974f6fc3ee08de70d2afa21954", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917768, "uuid": "c52634cf-32fa-45b8-98b2-fe9772ad0f7c", "comment": "Malware payload (AgentTesla)", "value": "5cb9e1265f6299f31429495d305b43a899c654c15367b87395320d6605ec12dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917768, "uuid": "a08d1df5-b583-4100-8ec6-500ecb5c6174", "comment": "Malware payload (AgentTesla)", "value": "a2ee2c661b44b1bd73f6354338420cb8e30a7615", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917768, "uuid": "92f03d8e-3048-4ebe-ac62-4a189832d075", "comment": "Malware payload (AgentTesla)", "value": "1e0be9815d961ec70952a39130d8100cceee6f15f5a8b97978f15b274b54bc7c9531f9589cb9a992d84e4a91771eefee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917768, "uuid": "5cc01ee6-86a3-4921-a91e-d02e1b3d548c", "value": "T108F5E84A1787D132B731A79D4139CD30DE0A598324D4DF1BB0BED60A3BACD479358AEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917768, "uuid": "d8dc0a81-690d-4c50-a972-fb1b42757754", "value": "98304:/9mbvPHUPfWQA0zLg4n6eE5XOF2QV68J8dvKeU995rsQ5qquEfmTlDLrJ:VmbvPHUPfWQA0zLg8oZB8OIxZtzuBTJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917768, "uuid": "34f3c2ab-93d3-4675-8568-237a7c153cb3", "value": 3328412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917768, "uuid": "20acbdf8-334b-4878-a33a-b4cbc8d1191c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917768, "uuid": "652fcbfb-edbe-4321-a1af-ab22dcb1d3d9", "value": "Payment_Confirmation_Receipt.pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ac394c-911c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785968499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785968499, "uuid": "d6531c01-f6b3-4b54-a855-5963b801ef74", "comment": "Malware payload (Mirai)", "value": "f39684b9ec67d552d3dbc47ae111322b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785968499, "uuid": "9b2ff8d0-1816-42c8-b66c-45bd5568a965", "comment": "Malware payload (Mirai)", "value": "5e468b536228953bcace7b3793da62f6ea5e7d57026812c2654d1f78e8a5e1f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785968499, "uuid": "073bcffa-ed69-49a5-ab0b-aa3e0b228278", "comment": "Malware payload (Mirai)", "value": "cbfa4e0608ae4bbd72c146a85dc10e480b2db9bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785968499, "uuid": "f44a0a41-537b-4c76-a78f-f9cce8211de4", "comment": "Malware payload (Mirai)", "value": "bf212ac28a31558ed0cc8947fc958e2d6ebe76d5ff8a4ff61f59520f56197dc20816c81d7a4c4b53ef6bb96e007b84fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785968499, "uuid": "1a9d23dc-ebda-4b5e-a9f5-6f1768a2a1e0", "value": "T1CF536C67CA663E5CC2254BF470B1DF706763646040671EB929AAC6B8D0C3DCCF9863B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785968499, "uuid": "75ba4d70-e64b-4a8c-ad94-e79779d0c727", "value": "1536:QII2IKjH3qKcz3JPVDiZqyqe87HSC5Qms1:WoXtclVDWqjjS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785968499, "uuid": "9bb01af7-2645-4f61-96f6-9e4465ccf674", "value": 64900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785968499, "uuid": "5f736886-fd68-45a0-a93a-62fbc4fb92e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785968499, "uuid": "b13c9bcc-3f2c-4f78-8986-bc515418f20f", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba9862b-9118-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785966842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785966842, "uuid": "524871e0-144c-4dc2-aef2-4f95aa678d07", "comment": "Malware payload", "value": "a266dbe358d13f9416ca8c11ca94853b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785966842, "uuid": "4e953013-80b0-4b63-8885-3c600dab5cc9", "comment": "Malware payload", "value": "5ef6019fb6ee1db1201ee479a68669b47eb0d5d82770dbd30b05f46ccbc68f4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785966842, "uuid": "1be4c259-f280-4047-9b5a-d6d40bfce5e2", "comment": "Malware payload", "value": "a108b96794a46ea5eb604044f7447d70957a03e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785966842, "uuid": "0c38361d-075d-4e95-b82a-86cbfc9128f9", "comment": "Malware payload", "value": "8fc325596e6369133aa7a9999795aa038817eaecf17dc740d233e3cf36f85fb007d3421f35f5c0789340c9fd3250269c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785966842, "uuid": "a9664da0-116d-4a37-ba9d-8fb31d3ca6c2", "value": "T14E847D11B780D171E4F302B59ABCEB14593DBE310B6690CBF3C84A5E1A34AD0BB75B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785966842, "uuid": "ee250f2a-f081-49eb-874e-5542f2984297", "value": "a015389f60165399e844c3b119b7e185", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785966842, "uuid": "c54c6d3a-5ae7-4b41-bf0d-8b3852684bcf", "value": "6144:s4WATf7l+psNkdSMLLSAT3NxFx3T6RNLL:sITfgpsidSsLT3NxqzLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785966842, "uuid": "3c69dee0-d8a6-4a4c-98fb-f09fc90774ee", "value": 376408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785966842, "uuid": "05a0cb37-9428-4004-8714-ccc25478d086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785966842, "uuid": "cdda97f8-66bb-4206-88c8-84a98098b9d1", "value": "notification_helper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab23a94-9078-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785898228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785898228, "uuid": "3300d938-4c04-4570-9179-2fef41e24a67", "comment": "Malware payload (Mirai)", "value": "e7bc67139a7d7ed94654c4e0de1aa334", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785898228, "uuid": "106c75e8-fc98-4fa7-aa28-33b2b594c5a7", "comment": "Malware payload (Mirai)", "value": "5f3709aa1823bc153c63dc5d0bccab9fbf9e252a910a08a639e857bd9f8f0149", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785898228, "uuid": "35126d04-07a0-42cd-a34c-6a3a6e0e08a6", "comment": "Malware payload (Mirai)", "value": "2668cd67e8df3c5e91df5fc339ad3c110cdc57f6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785898228, "uuid": "a40b3eb6-eb1e-420c-8701-68fce75c9b08", "comment": "Malware payload (Mirai)", "value": "54c0dfa121afb147381b59e84611bada03077b86263768dd63daa8e6798125a672b41d840415b8f004307f91ed799a5e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785898228, "uuid": "a725afff-ed39-469c-99f5-1a84164c8d73", "value": "T17E24955E6A328F7DF368873447B74A35975D22D627E1DA84E2ACC1041F2434E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785898228, "uuid": "575678b5-9b4d-4787-9e3b-a05dd9520c39", "value": "3072:sPvQ0inW06qBVrDuQ5SPkCekMcJXs9op/rzibKom:sw0inW06I1DA81qJQ2/r4Kom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785898228, "uuid": "6141f689-4d2b-4e4c-98d4-980a8117aa28", "value": 209376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785898228, "uuid": "df5c0de2-2b8b-41e5-917d-6bc75e89cbb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785898228, "uuid": "44e268ad-bc14-4b62-8421-573193262a69", "value": "sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2953f44c-90cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785934196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934196, "uuid": "1a892f54-ee17-427f-8e62-4df96b80a39b", "comment": "Malware payload (Formbook)", "value": "dd580cc05f826d76f2f3680fcda22691", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934196, "uuid": "94da4559-c9a6-4a7a-a85a-43dfab22320a", "comment": "Malware payload (Formbook)", "value": "5fd276cac6c062df5554e2a6f2c776f64743db9f431bc3323b6c1df8bc978dad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934196, "uuid": "7addf8a2-2a9b-4187-99a1-db1a51b31554", "comment": "Malware payload (Formbook)", "value": "1a8f495989c3d4d8aefef0f6b5def976d01b8382", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934196, "uuid": "819f3617-0fe9-492c-bb95-f578ca1e006b", "comment": "Malware payload (Formbook)", "value": "cb4b1037b25b9087a2fae8dc1397e612734b42f238c4a9987d0c0275b8f22d1d65a45d30a916014e994d6a158920a901", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934196, "uuid": "79093545-6380-40f4-a901-aaa7aeb32ce6", "value": "T1B0E52A80A70CD4B0AA3D7B2CE1379E645A4EB04361C5EF1D757C6704B3A2A5B638ECD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934196, "uuid": "42fc0c36-5ddc-4d8d-8312-a261126a25d2", "value": "49152:GC4qq+DdCcj0QOgjmEKTz4GsuN9hpAHlk/xoVo4Sq6ZKSVvGJiBx5OText1W0nRp:R4qq+DdCcjBOgjqz4Gs8hSHlkZoVo4Sb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785934196, "uuid": "961cfa21-9427-4884-9bae-c95acaf99779", "value": 3092552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785934196, "uuid": "e3ac9dc1-57e5-47ce-bee9-b0d3bcf169a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934196, "uuid": "6d795cb7-1d39-44c4-b063-01e3f7d3e16a", "value": "ORDER_NEW _HUY7986.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a54f3f-90ae-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785921468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785921468, "uuid": "ef6fac5a-243a-41fd-841d-dc11919f2f24", "comment": "Malware payload (AgentTesla)", "value": "2e8c01d1f0251e56238e8779fb5d0450", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785921468, "uuid": "b33f980c-7592-419a-b6b3-3df44618202d", "comment": "Malware payload (AgentTesla)", "value": "6045d659050d22e1bdd3c6d71186cfc9c32d790a52cadb295ca21406f0fc0220", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785921468, "uuid": "3fb1262f-f155-4505-a7cc-ad6a18da8d7e", "comment": "Malware payload (AgentTesla)", "value": "5c7fb5880d99f33cdd3f3474a63dc0ab28e7054e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785921468, "uuid": "baaa092b-136f-4d39-ab46-5250bc36fc6d", "comment": "Malware payload (AgentTesla)", "value": "1b51cdcd589665834de77037a5109562707abee1e0ac2589dc20a60b11114419ab678d54fb195ba24bfde23708a4179c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785921468, "uuid": "eea5730d-1e34-445d-bf2e-5fec892aef00", "value": "T158D5F7912745D1B37721ABAD663ACF329A0EA00354C1DF04316DE309366DD5FA3ACEE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785921468, "uuid": "f5b6bc65-146c-4554-9628-21b379a64e9e", "value": "49152:VFaTKgXZT3oyK40mhocOZFQQPwVjiioLDqvbfDi1ACmnaLIt6suXIuwStetYBWfS:VwWqZTYp4LhocOZFQIEvzDi1ACmnaLIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785921468, "uuid": "9dfabaa0-2ad4-4c39-a68c-e96df3c5e080", "value": 2959658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785921468, "uuid": "bc881358-8329-4029-8b17-641a7394ab58", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785921468, "uuid": "948e3f15-8951-4cee-b2f0-356b70cb4cb1", "value": "Purchase Order.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906c3139-9099-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785912465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912465, "uuid": "d73fd99a-f815-4bc5-8163-a361355c3fc0", "comment": "Malware payload (Mirai)", "value": "1619056a4ad2da79bdbf554beeec30eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912465, "uuid": "a5623548-ed74-4226-b2c4-d7bd254da3a2", "comment": "Malware payload (Mirai)", "value": "60e6308ec859fbaf332f22f4c25720f9ab2b4fdf3c42a88708303bc12a55f50e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912465, "uuid": "223124f3-9719-46ad-9b87-50dde6075718", "comment": "Malware payload (Mirai)", "value": "573fe86251ca8f899ddec4da640c8768c4cb1cfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912465, "uuid": "e87a057d-9165-4db2-ac6b-1683deab2c85", "comment": "Malware payload (Mirai)", "value": "60b0a3cbbb1e453ece9a5122df45d75e66badc6d246fb2ae98d5b0004c388cc3d4f432a17e75ed2508b7b5d7808c0b07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912465, "uuid": "4f3b6d2a-1948-43fb-b893-841c62f4c71e", "value": "T14EC32AA9F890DE52C6D526B6FB4E418C33231778C3DE7106CE149E3477FB95A0A3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912465, "uuid": "46c06505-0467-45f5-bf53-a464fb162433", "value": "3072:R74ICbzNB9v9/KUMnZGIKgcYEEUInhMWTNwhR605cqv4NvF+6Aud5mf1Dlo:RsZvBArG/gcYEEUInhMWBw6icqeNj7mQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785912465, "uuid": "01198500-6cd8-4126-8766-9dd6775cde7a", "value": 128444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785912465, "uuid": "a0536cb5-0934-410a-a8fe-ca0fa66c5ed1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912465, "uuid": "a4e5c62a-5335-4995-8f4c-2b3c1aab24bb", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a7da332-909a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785912750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912750, "uuid": "464fcfc1-5c9c-48f7-a3fa-c67c4126f5f2", "comment": "Malware payload (Efimer)", "value": "4d505701f803bee1219d7b1b9bc64969", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912750, "uuid": "389d7192-8969-402e-8114-ba341ccc8758", "comment": "Malware payload (Efimer)", "value": "61a9fda03cd03ac5ca795858b75c1eb7b85bc61b4825c8a89b6f157cec498390", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912750, "uuid": "0f62efc3-c477-45f3-8fed-689129c8269b", "comment": "Malware payload (Efimer)", "value": "20ab0d2984dcef70ebf5268797cc320d5e5c99e9", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912750, "uuid": "67696e59-a9fc-4f6c-864b-c2206a758528", "comment": "Malware payload (Efimer)", "value": "6f95210899a17755ccb2ce3f900a0b26240be68aa01be8d367132d145b2c11cfff0da6e44e3dee7459cbccaf96e902fa", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912750, "uuid": "4665e074-31ae-4a21-beca-d11dc768ca65", "value": "T13BE6335827E002EFEA73817CA5E205A2F524BC760375CCCB47A49BEAAE536D04D75723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912750, "uuid": "4defdafd-a785-4268-89d5-6d34d5740730", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912750, "uuid": "df6d2386-9eb5-4106-abaf-db73b4501454", "value": "393216:aGmFufR7HoFIO+clW9F3nNJ/0tu4XMCHWUjdcuI3/PGTAI:aGakRToFIO3sL/0VXMb8qH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785912750, "uuid": "d8242f06-fe5a-486f-8789-7f5fca1ce296", "value": 14316199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785912750, "uuid": "10c2f638-c4e4-417a-aeb4-07b38ce2b90d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912750, "uuid": "8ff6fd0d-94b5-4340-b557-a540cd62603c", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557fb17c-9102-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785957463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957463, "uuid": "3f1fba66-8c13-4390-8c05-c16b622e5fc3", "comment": "Malware payload (Mirai)", "value": "24be1c7592802a294149ee984e6af0af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957463, "uuid": "c1700ef9-7f94-4c3b-85ec-b4309014cf23", "comment": "Malware payload (Mirai)", "value": "6246b9d1b2ebc13656fbd9f45d240d12d5b969ba3889af847f20aa15d0254dce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957463, "uuid": "b119c984-526a-4b4e-8207-a8a14044b99d", "comment": "Malware payload (Mirai)", "value": "2dfecf782d90c9bc9b9224bd45aec4353ac58faa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957463, "uuid": "6ca4fb05-9e50-4cd8-b77d-3e1f90030b58", "comment": "Malware payload (Mirai)", "value": "8d87e599fd471ca7a18d30defd5f087f3e6958e5eb0429f57b1b68b1a211c0c2a6e2d46d0b74104840c773958b90a8ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957463, "uuid": "22730178-405a-4371-b598-c808d5807faf", "value": "T182C329A9F890DE52C6D52676FB4E018C33231778D3DE7106CE149E34E7EB95A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957463, "uuid": "d2605fbc-af91-4d58-8ab3-68c13b37940f", "value": "3072:I85FjA5l1pSzeFMyD1IekcYEEUw60MW/NwhrRtYaPI6NeFFJdu6f1Dlg:IWdUieD17kcYEEUw60MW1wXiaPcT8695", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785957463, "uuid": "0c7c9da2-af28-4532-92e1-8f53b9610360", "value": 124340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785957463, "uuid": "50cc628d-05b7-46b2-b6d3-18854f6bcbe6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957463, "uuid": "d3c0ac32-1a56-4bde-8d9d-112eaff17712", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b90ccdb-909a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785912779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912779, "uuid": "df6e62a6-c019-4d2d-8f42-1395bec70083", "comment": "Malware payload (Formbook)", "value": "eb313246ba207978e027688bc13ae4d3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912779, "uuid": "a9db5269-41c1-4203-8cdb-2199316ec842", "comment": "Malware payload (Formbook)", "value": "64699e0882d4daf001887039e36fcd55bfd37d128e8766719b0a683764904cdb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912779, "uuid": "bfad33e0-3d9f-4cf7-a945-5f262fa17bce", "comment": "Malware payload (Formbook)", "value": "ff1a34ef6af4d897ca80c73dc6da30654b3200f0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912779, "uuid": "adee80ad-08e6-40e2-b2b8-cbd5ec742015", "comment": "Malware payload (Formbook)", "value": "18e2812683848eb840fe6464e674eeb0f23952cfa16890dfec757dbab377ec63976561a154498572eb86e99479c197e4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912779, "uuid": "960419e0-8598-4453-a85a-ec3658bc52aa", "value": "T177250EDB9FB6D699062D7D2EC47CBD9D288BCDA004D0AA5BEDB8414BF70E64501C0B1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912779, "uuid": "4e8f00d9-59aa-48b2-9127-a9bcced066ce", "value": "12288:gtyGD+G3XWkx+sFAo3wcNnRoYK4s9OzXnYc6LSkyoQ+nA0B6l9RQgh1O1A6yi8b9:M8q3b7rA6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785912779, "uuid": "4abf6aaa-8bf4-4f33-b886-27de3279115f", "value": 1018843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785912779, "uuid": "23c9fcfd-586a-45b8-82a9-d5d6e50e9b7a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912779, "uuid": "be0803bd-877e-4a42-9c57-f2d5cb2817c8", "value": "NewXPOXX#82026X.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b736c8-90f9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785953791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785953791, "uuid": "903a5190-195b-4356-a00d-1e3c1cb4be50", "comment": "Malware payload (Mirai)", "value": "a942e7bf85dd8686bbee018e700eae7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785953791, "uuid": "429b6c98-c51d-455d-903f-4ff26defc58e", "comment": "Malware payload (Mirai)", "value": "6478019943fc500df849033186a551102cb20d0e485231456bb40936ebd8010e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785953791, "uuid": "bfef43c0-fdd2-4139-a24d-5372c96611f9", "comment": "Malware payload (Mirai)", "value": "5f7522256dca4f223c0b6825a75cda6ec2e70483", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785953791, "uuid": "ee1906c6-9939-4ff9-86ee-17d72155bad9", "comment": "Malware payload (Mirai)", "value": "f3bb796047bcf1d63271eeab1272865919f00d5cf27a7ca2a34bddefb6f807f16a2c834e42dc0adad4ca2c441fe7177c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785953791, "uuid": "19fd101d-2df0-4875-855f-a281d851e9b1", "value": "T14DC32B46EB418B13C4D517BABAAF42453323E764D3DB330699185FB43F86BAE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785953791, "uuid": "9f090c3f-5d11-4f31-9992-39f4ad0d74ca", "value": "3072:bA8htCo58h4J+Vj/7vqp44mF+E5fieeM/9r7iuh:bnhtCo58h4olzvqp4HF/fixM/9rOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785953791, "uuid": "f7ccb2a5-f75e-4c43-be95-72832e4ca172", "value": 120519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785953791, "uuid": "ccb8f7b5-db62-4afd-a917-a331222142fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785953791, "uuid": "43a7734e-1c19-4179-8ba8-2a020dbcd0e7", "value": "6478019943fc500df849033186a551102cb20d0e485231456bb40936ebd8010e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e10b3e-90a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785916690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916690, "uuid": "8c54a698-3f1c-4fb7-8ed6-029b59512b2b", "comment": "Malware payload (Formbook)", "value": "8649b5b07cbaed2fd695ea611e8fd0d5", "object_relation": "md5", "Tag": [ { "name": "Barclays", "colour": "#99178C", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916690, "uuid": "38baed33-daf1-491d-a5b5-8bc308efcf14", "comment": "Malware payload (Formbook)", "value": "664e8ea263f2cec14927d140deb99bfa8e9cf3194bc64afdb2bbc492e5d34057", "object_relation": "sha256", "Tag": [ { "name": "Barclays", "colour": "#99178C", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916690, "uuid": "4f1f250d-e448-4c9e-964e-3282dbdb1580", "comment": "Malware payload (Formbook)", "value": "2fe85d97d06142c78178f1cffbb244f97abb6288", "object_relation": "sha1", "Tag": [ { "name": "Barclays", "colour": "#99178C", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916690, "uuid": "d304a0b4-a596-49a5-8fad-bd70aee4bb3c", "comment": "Malware payload (Formbook)", "value": "365434ef02bc990e27a03697850999b09ea1359b4cb60201b56a0c620d0d4db99e4510828d111ad741e61a474fd5c1e9", "object_relation": "sha3-384", "Tag": [ { "name": "Barclays", "colour": "#99178C", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916690, "uuid": "a5d200ad-a3f5-4681-9793-746b02b4814b", "value": "T1BEE518F377AE2B5656A43B1E740D2A940B2EC0B50DD257E8F8CF1AA85F4F0071DA498D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916690, "uuid": "472916a4-cb19-4102-af8e-33c3e97951c7", "value": "12288:tHerLrFZf/4Vq2TUrhektMavdWBXesuWV2r/ivbo0NNuM4J98:yXvf/2Qhe6JlAWM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785916690, "uuid": "879ae487-71cd-44dc-ab5d-d82b487e0d96", "value": 3109525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785916690, "uuid": "63cb41a2-42d3-49dd-8072-df8bd80c9e77", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916690, "uuid": "80ad4e45-23f0-47c6-8950-caf4f5448f25", "value": "Barclays MT103 Confirmation copy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912569fd-909c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785913754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913754, "uuid": "3d082894-6a0c-4881-a009-5022ebd69cb3", "comment": "Malware payload (Mirai)", "value": "fb1a0846bceb5f56b04067c5a7cad316", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913754, "uuid": "0f2dca51-ffbf-4eda-ab2d-2b49c1c096e0", "comment": "Malware payload (Mirai)", "value": "668d048f71dcd3c9ad7aea64b28c944e86806ed200fd2cb76bc6a511ee570048", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913754, "uuid": "ae9707eb-3965-4d6d-ac56-1ed1273e7918", "comment": "Malware payload (Mirai)", "value": "adba6d75e1ffc21e7017c23cf52f2ab0c5770c8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913754, "uuid": "2e7cc06e-c2ab-4aed-aaa3-f720cc06393f", "comment": "Malware payload (Mirai)", "value": "7a2d2854f45b0bd659208ec87eb1ad465cfcf09db98a92cf6c47c1a2c3c8adb11b4d80f6a1b5e0d452c15ec2d9593470", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913754, "uuid": "286c3d71-55ef-4fea-add0-05246afbf062", "value": "T1A275AF47B7A760BEC226C13146ABC7224637F8BA06116E3B3594F5342EB3EA41F15F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913754, "uuid": "5e748935-45f2-426b-b99c-2920148077e4", "value": "24576:9/MYbT4PbKBHsfyHcShw/oLY9MBMMugLWdDXF:9EYbEPbKBHUyd0gLWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785913754, "uuid": "0c5e082a-d711-447a-8507-43833e804b42", "value": 1576720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785913754, "uuid": "0be2490e-3877-419c-a149-c3495497fdc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913754, "uuid": "f6eef74d-3f2b-44a8-900b-8e8978baa11d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726e37fb-90db-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785940761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785940761, "uuid": "5d94532e-88cc-4ca8-9322-cb34f1893e78", "comment": "Malware payload (SalatStealer)", "value": "65eebf6fc72a65284065154d3275562a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785940761, "uuid": "f3c06a47-0007-4e21-9251-1d284a7afaaf", "comment": "Malware payload (SalatStealer)", "value": "6747147c5ba29975a557d88cd22114478890a0a0a613f36512dcb730e4efe965", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785940761, "uuid": "bcac5500-91b3-457c-b9c7-38dd5e5dacd5", "comment": "Malware payload (SalatStealer)", "value": "456f7a5a3eb56a0a92dd240be6f8e73e51c30c7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785940761, "uuid": "6329ca4b-ae83-49f1-b920-1681aa65b59a", "comment": "Malware payload (SalatStealer)", "value": "3a2cb72800af0e9a52e3225b72fec4317527a1b1ef239ef32e302f9a126163b39b8deffc7ba78cd5201f08da494a20f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785940761, "uuid": "252f82b0-90ae-4488-87ad-37fe34f8ca49", "value": "T11AC44A16E65444EAC15693F48963390EE76D7C4A0F20DADB33E02A9E5F237D39D3A630", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785940761, "uuid": "d060082e-b58a-431f-a85c-6b01051aa457", "value": "fa36d7b9c6f9b5769cd72fcad04fc5f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785940761, "uuid": "fa7ce695-9b22-4126-ad04-2477d70eec18", "value": "6144:G/OnI0EB2bE0Rtth+X5lHdyxXVgajyEomhEZTVIUy3jnOuYqGr:/a2bvM5l4gaijjIUyL8qG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785940761, "uuid": "939be166-e7d2-46c2-9189-728a764c16d6", "value": 543232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785940761, "uuid": "98f06047-50be-41a6-8e84-6b967cd04267", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785940761, "uuid": "287ff2f1-16de-44d0-9be9-a8a6a5c6f87e", "value": "6747147c5ba29975a557d88cd22114478890a0a0a613f36512dcb730e4efe965", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10daeca-9096-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785911204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785911204, "uuid": "ad39c0f1-a460-4b43-9f39-fcbe8b3b10e8", "comment": "Malware payload (Mirai)", "value": "b840a352d33ea2579552a29b11f9c1d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785911204, "uuid": "fbb73313-05df-4753-a8e7-a9ba6da08a51", "comment": "Malware payload (Mirai)", "value": "67c616da2728c642b384927fee72e6ddef049c091ae579309ec1ab1af77d5016", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785911204, "uuid": "7d892363-97db-42ef-bb35-7e6a5ea3ddb2", "comment": "Malware payload (Mirai)", "value": "d9e3393ad6b389568a8cca5754d019a53fa3ad86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785911204, "uuid": "eccaf968-0016-463d-95cb-167f385f2735", "comment": "Malware payload (Mirai)", "value": "095dcccb00cc3f241a2f69c8b9db2d6eea4df64483325f35663e8a4373cb064c954146c32dbf5fc091ae119a4b0c8cf6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785911204, "uuid": "8c96a43d-7aef-42d6-83c2-d203334e8d4f", "value": "T15204294F7720CF71C329C53045B38B9666E926522AD2C889E35CCE087E6538DA96FFD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785911204, "uuid": "e1b0ac68-447a-4974-994c-5b4c94935c3d", "value": "3072:ecqaquZhjBfs7EEli8csiET1Y9doboEyxk920C4UI1YuDE1DjjtBj:e7aRPETUxvdM11tDCLtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785911204, "uuid": "ffbb22fe-3aa5-4296-8e6f-92c0efd091e8", "value": 185036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785911204, "uuid": "4d0643ec-cbcc-4f74-aa21-510d2b8ab75d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785911204, "uuid": "e721992c-0d58-4e19-9f03-62953ba3e685", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b7a80c-90d1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785936655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936655, "uuid": "313b0d61-3860-4e2d-9ae4-68754d17fed7", "comment": "Malware payload", "value": "1ca65144cad88ab78cf213f8761015c9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936655, "uuid": "8b704a21-225b-46da-a7a9-25258f2718f5", "comment": "Malware payload", "value": "67f5caa64142e0add98b8950ad9de92ff7adfbe9c788fe49d1e5fa64ddba91e4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936655, "uuid": "43da01c8-39f2-4976-809f-c70bf4005671", "comment": "Malware payload", "value": "aa2fd114d21a60a3fd0e1ac4d11a377c27c78943", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936655, "uuid": "3f712ace-204e-4531-a64d-646b2a633b6e", "comment": "Malware payload", "value": "36aac29875cb32cf68dbc65ca4484e3c31111039ad987269de513072e5dbdf3753ca025bb993f951c804ff5373a467ed", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936655, "uuid": "72cffe92-e929-4b33-b664-205290b9a764", "value": "T1DE236C651A857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCB3CF28C5AA9D910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936655, "uuid": "f6201794-10e4-4b84-8e5c-3382dc11b3a4", "value": "768:HXRWNGxVa9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Blx9cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785936655, "uuid": "e2ea2a65-5cdb-4067-bb3d-a61063d3c9de", "value": 50067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785936655, "uuid": "e61346fb-8634-44b3-b7ba-86d6f281d99b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936655, "uuid": "b62251a9-c3df-4894-99d1-6c03ee2b0f92", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec29b0e-908d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785907174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785907174, "uuid": "78639e57-5b76-4cfd-a818-8605e0d309aa", "comment": "Malware payload (Mirai)", "value": "c163b1aae7a684cde64062b304e5838a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785907174, "uuid": "472266b6-c189-479b-b8d0-cb50a2a859ad", "comment": "Malware payload (Mirai)", "value": "686f0876b8ae0677b03cf40b31f7431592ce271ee64a79c31467536044e69edf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785907174, "uuid": "0b7b19ba-1945-4fcd-b476-e2166500a38d", "comment": "Malware payload (Mirai)", "value": "de50e25e428a6a2a16c1a58f4d5798b0beed011b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785907174, "uuid": "c9f5bcb1-222b-4124-98d0-8007842b4dee", "comment": "Malware payload (Mirai)", "value": "f76de1c6db2e3c5cbe6e032c1d5ed56d4a9ff4d445ec64391352919fdc531210ecbfa916951c735478e8b95442f266ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785907174, "uuid": "87b163ea-259a-44fc-af97-5531b7fe8f74", "value": "T16E43F1205BC49FAFC47024B32D7BC2C33D5E89F0161B65A0A415C499F7A536E6389FE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785907174, "uuid": "1de838f8-e8e4-47a9-8a90-626d1b92ec88", "value": "1536:y4Yr8Djj7DzqhYZm7ztjmE0Y1ns8gDiROrVPIoUfH:djfqgmXBm7IDZRElfU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785907174, "uuid": "ee8581fc-3324-4758-8798-62f20965bc0a", "value": 59348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785907174, "uuid": "987ceef4-b582-4a53-a5dd-f14010dd77a7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785907174, "uuid": "7cd5023e-089d-4a38-86ae-2a5b8b7ece06", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a944e1b2-90fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785954168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954168, "uuid": "f90391e9-e19b-474a-9321-f38aae3e02dd", "comment": "Malware payload (Mirai)", "value": "2fac072783c1dd2ea00713dc21e4d31d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954168, "uuid": "48e35196-b782-402d-b08a-e4e9c002e2d8", "comment": "Malware payload (Mirai)", "value": "69500a759e6e3d0dea02bace2673b4fe9f74f66f56e6be615cbc9d8d96248818", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954168, "uuid": "706bb5b8-5c82-4958-b961-6b4bb3430641", "comment": "Malware payload (Mirai)", "value": "14dbc334d0ffd47e14b009df7327f62a9deeadee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954168, "uuid": "c3eda1a1-998a-4199-8050-6271824731a5", "comment": "Malware payload (Mirai)", "value": "62752ff5adc8cf02e5ed9238c69153332548461fe15880fd021d866837fdb4ae91e50d3323b0500ec43ad0a30384404f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954168, "uuid": "f5391b62-0e19-465d-b2b6-36e7f5fd2d13", "value": "T119539E73C63E2E54C19582B4B8709E751BA3F54082975FFA1A96C6B98083DECF6093F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954168, "uuid": "d9fa1756-9713-4ae3-9b0f-3d78eae45557", "value": "1536:3LwtVRCFOcpD54/KloeemSyiCSY5T+8zs/nz:3LQCQcpt4illSyiuNDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954168, "uuid": "dfb81f94-ff41-45f4-908a-2fdd2f71843a", "value": 64908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954168, "uuid": "44d0a129-1bed-4e31-8937-63f5618b0143", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954168, "uuid": "c8abb895-167b-4eed-8e2f-d77a9f75a2d0", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2959147-90d0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785936252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936252, "uuid": "6b3edbd0-406c-483b-96bb-49984ffa48b5", "comment": "Malware payload", "value": "d22221041c6efd081757402ae84c9e07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936252, "uuid": "19aede46-e94e-4a93-8cdd-e7dbc0ea00bc", "comment": "Malware payload", "value": "6b20a62bde1f9ea686c43a878a8549aac9e134bd15e2f9457e1bf9fe93c1b6fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936252, "uuid": "c61849e7-c39a-4b04-acc5-81f9292dc6fa", "comment": "Malware payload", "value": "046df45bc5f9b92b9b02d483ba0a8e3b13ccd945", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936252, "uuid": "607dee4e-2910-42a8-9222-c929817f270a", "comment": "Malware payload", "value": "f334914e273bcba235d7e91c29e149f715d3c87ecb1250fcc5021d91c6d8ffa75c620a268dd9faec5693c2fd163ab9b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936252, "uuid": "828ff17f-d4e3-4a4c-8a0c-4df218a9bb2f", "value": "T184348D15B6A91CFED97B803DC9921406E6B23C9547A0EBDF57A00AA60F137E06F3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936252, "uuid": "dfcc25a7-9b1c-4241-b850-6295e9ec78b9", "value": "abcdb8b48f1a6c556fd339d1950a61b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936252, "uuid": "099e0fa8-122c-4660-b252-1612a8e1f9b8", "value": "6144:RTUuRT3kcy6o7ZwU83qD79P/efWERpWe:RTU+od771/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785936252, "uuid": "867e3fea-2cd7-410b-9f43-02805b0e5bea", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785936252, "uuid": "389cadcf-63be-4ef9-976b-0545804f3ea8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936252, "uuid": "5f7132bd-9494-4aa8-817d-01b0f6bd2e43", "value": "6b20a62bde1f9ea686c43a878a8549aac9e134bd15e2f9457e1bf9fe93c1b6fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b380469-90e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785943782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785943782, "uuid": "586906d9-21ba-4721-b0ac-fbd37c1b2182", "comment": "Malware payload (CoinMiner)", "value": "a53edc758bc697b43b92f366dfb21992", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785943782, "uuid": "8b0f9dd0-0147-4547-9529-d767396dfdb3", "comment": "Malware payload (CoinMiner)", "value": "6b221814fa8c8d800a2ea3dcbb30943c33d8a28e184dbd368e42c5f5e92f90e4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785943782, "uuid": "fb04de65-bf95-4e9b-965c-951f750c5d7e", "comment": "Malware payload (CoinMiner)", "value": "5160ab7f4d04c8e536eb0b0de6e8ce5496e4e1de", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785943782, "uuid": "46443773-cacb-47f5-b92e-e18b66fc3421", "comment": "Malware payload (CoinMiner)", "value": "538900454fa5e4f03b4eba34716bdbf9d0e278933ad1db38684503e9a7559ba7119f72da39feb2b46068df7b72b552af", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785943782, "uuid": "1d27cb1c-a8c4-426c-adfe-b282cf82a8b9", "value": "T10B32092A7E490331E3A488F41475438F653D5633A387A3EBF77396AD4BA62448441EBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785943782, "uuid": "692d6f79-9ab6-4bbd-a1eb-810a1fa51672", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785943782, "uuid": "93fa611e-dce4-4362-b781-7f72ce7c5b52", "value": "192:HroTWSqBEx+eylG+Ibi/+I4PFJxTEZmFhSuc:Hroz7wxLIbLI4PFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785943782, "uuid": "4f030340-60d9-4046-8492-aad9651ab0f3", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785943782, "uuid": "2af90998-46d1-41c9-87b1-35f03a25d580", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785943782, "uuid": "83ee3fe0-0e33-4bc6-ae4c-e9fdba2e76c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9021fe-90d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1785937367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937367, "uuid": "b2b392c2-d5b2-4e43-9173-3eaf11388ea0", "comment": "Malware payload (LummaStealer)", "value": "876962e73c04cef3b1f93172e322217d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937367, "uuid": "2947dc18-a0a6-48dd-94af-98431d841118", "comment": "Malware payload (LummaStealer)", "value": "6babc0e5d90294a1a094c9b83722a0e3fe1cefa8ce935e3226953763b31a5089", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937367, "uuid": "6d37be3d-2e8e-4f86-b8d9-3551a8be7295", "comment": "Malware payload (LummaStealer)", "value": "802c93ab9ce090083fbe67ef0c7e05a1e1538cb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937367, "uuid": "70eabf3d-a46f-4c64-be49-d591a4e624f2", "comment": "Malware payload (LummaStealer)", "value": "50154a07790a06c16f1fdef5c5564fe5f0f4ca073772a95a42e44d2ecc64dad0ce2ca02d95e8103e58a3ba01be54395d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937367, "uuid": "d156ec8f-9cf9-47b0-bf27-8fdab5705889", "value": "T1EEB65B10FEC749F6E903163244AB62AF27386D054B369B97EE447A7DF9772D1183230A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937367, "uuid": "dd479a38-429d-4414-861f-812435146c2d", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937367, "uuid": "896f8e57-6742-4318-aa09-3a6a7fcc6268", "value": "24576:ACjgh0J3/gg/Lcd6F+NhBeOPAP5vIlTqHbG/CwBZiTO6XOFXnAU0X8s208Byn7fV:AIgYUNhsZQ0d8kfKYDHB2TdbQJiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785937367, "uuid": "4e3a8b64-379f-4c3f-b749-d26d36f1acfb", "value": 11366400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785937367, "uuid": "ce364abb-caa9-4830-ac8c-3476204b7106", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937367, "uuid": "19a46e4c-cffb-48a6-af76-4accf087c70b", "value": "6babc0e5d90294a1a094c9b83722a0e3fe1cefa8ce935e3226953763b31a5089", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182f7673-9107-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785959508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785959508, "uuid": "d1bc1950-cb41-4cf6-8203-cd047363a50b", "comment": "Malware payload", "value": "b01e4feeac1e8fdfa65e00d33e70ebec", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785959508, "uuid": "b61bff51-cf24-4fa0-8b6b-8d08864900a1", "comment": "Malware payload", "value": "6c3e891c88b71d2cfde888c389172cbfed25cc5ae7a97f8273279914785172fe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785959508, "uuid": "4a1ca252-2ad0-473a-8f36-271573be8fcc", "comment": "Malware payload", "value": "d6c894b384e20dcfdbf60eb1fc3067082356c646", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785959508, "uuid": "2f36a080-9e72-46e8-bbb7-3dd45fbf3469", "comment": "Malware payload", "value": "964657d1c32eac90f49b71a957a53a95528a3b118a44f736ff3e25193bd9a7232e9c30d0cd2f9adf89e67e87692a47c7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785959508, "uuid": "112c5fa5-0d19-4a89-a4ce-73b611f7e2f5", "value": "T1BD01CECBD5149800409A896D62A79154F831C3CA168ECF75BF6CE83DDBC8D14F076F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785959508, "uuid": "d0b791b0-e4d4-4bd6-9438-641a12279d17", "value": "24:kXCKysE2hi0ziQvZohaSM2BXM4Y5BbGFm/OX:e9Qp+MsS7z0bGFm/OX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785959508, "uuid": "e98ee6cc-efd6-458e-8382-2dbce29f3b84", "value": 836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785959508, "uuid": "f94a6879-32bd-49a8-be9f-366217a94e2c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785959508, "uuid": "8d3ebcad-e0e0-4683-8aa9-3c4b9944a12a", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36511378-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917468, "uuid": "d6c459dd-be87-444a-94e7-a6430d77beb5", "comment": "Malware payload (AgentTesla)", "value": "f29102493905f2632a2853aa5e7bb4cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917468, "uuid": "57b034cf-2b97-4780-80b5-657fee418375", "comment": "Malware payload (AgentTesla)", "value": "6c4797dbc9ed2c4fe5788d54f183b83ada2fb6d888aae8c9128517913949ec22", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917468, "uuid": "dccfb5d8-fdd8-4c4c-83cb-415c113c5479", "comment": "Malware payload (AgentTesla)", "value": "713dd71020fc783bf996b919bb5fe12edb9e09db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917468, "uuid": "68c25e41-17a4-4c1e-8daa-cbf364f32b50", "comment": "Malware payload (AgentTesla)", "value": "e991f4bd16c7e5f9124918d6e634ceb75a26ffcc0d2d11cd7f72242efb2a1daabd4ad0d27c665712f7771d3f04e3a911", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917468, "uuid": "52fa1db9-2c5d-45d8-ad4f-3010c11b0d45", "value": "T13ED5E581275481B37B20ABAC553ACE359A0EE01354DADF04716DE30837ADD6FA35CEE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917468, "uuid": "84c00205-bee5-4aed-a0a4-f7173b0adb26", "value": "49152:bOB7DSUIqpVNaqIPegHmTqt95AMeUngJGYNVdKSSZ3vAC3VxVSFT4fbr:bjUDLaqyegGTs5xTngJGcVdKSSZ3vACl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917468, "uuid": "4b7808ed-a3a0-421f-a1a7-b3d9815886c4", "value": 2961466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917468, "uuid": "e351ecfe-83e2-4aa0-a43e-063f47f2b137", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917468, "uuid": "b0e46385-a8a9-49d7-8fc8-802b4665baed", "value": "PO_13381-608861001026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8bc4a73-90fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785954220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954220, "uuid": "d3f4ff9f-84fd-4e2a-bddb-d42cd2f0352d", "comment": "Malware payload (Mirai)", "value": "7db4144daa2bd773fd09ccdee70cf07b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954220, "uuid": "796b783c-f76c-44ac-ac72-e22bff343942", "comment": "Malware payload (Mirai)", "value": "6c7a8a52fc0b241253c85beab2999af48fefa14adf604c0e98508590ab335863", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954220, "uuid": "1d241f27-a3fc-4e7a-8e1f-0d1e2782264f", "comment": "Malware payload (Mirai)", "value": "1c30ecf7b08fdd3d7f4b79797e032b088a50f0e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954220, "uuid": "c47574c0-d424-4551-aca0-113710665ecc", "comment": "Malware payload (Mirai)", "value": "f0bc5541c58fe3d5c0117384e0beeda3acf8fe742cfbd188203a907dd3d17ce6d7bc1b1e30fd6d2914b105e35c1a42c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954220, "uuid": "d9e59782-b61a-403e-87ce-e2ccfe9701e9", "value": "T1B0733981BC815713C6D012BBFB5E428E372653A8D2EF72179D226F21378786B0E77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954220, "uuid": "bad2ca89-998a-48b8-af04-758fc49829b9", "value": "1536:mqloqjP80Oe9hdXwmIDcl+T20aPdhEjvzs/h3:mqlHJXwmvw2T42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954220, "uuid": "bbfc07b2-d7ac-4c50-8a7c-93400ccd889e", "value": 75652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954220, "uuid": "87d9476f-3469-4880-93cc-64a449e060f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954220, "uuid": "e6fb8921-d588-424d-b835-a1f3d707ddcc", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e7dd00-90a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917245, "uuid": "6d8c0c24-02d6-48c3-a963-e0c1fde25a3e", "comment": "Malware payload (AgentTesla)", "value": "483b7b73f19fd2029f4503c7b7c35840", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917245, "uuid": "01355b30-b36a-48d4-937a-b6076b2ecb3c", "comment": "Malware payload (AgentTesla)", "value": "6cea60db12dcf7def057c16a09f848aa87718cb52cf5266c3566e78c1e823ef8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917245, "uuid": "618433cd-5e1c-4c53-9edf-c5ebdf30f47d", "comment": "Malware payload (AgentTesla)", "value": "bd88e2c9353872c232055ac09ba65ca546bf45a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917245, "uuid": "dafb3d45-a4ed-4327-bd15-0c2e6457f599", "comment": "Malware payload (AgentTesla)", "value": "d3450937a5e06d226cd0f627d50134e7e965eccfac2305860de67c16301ef3886afa0a663a92574675600ac0bf8f9293", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917245, "uuid": "9aaeaad6-d5b2-412e-b8ae-1cbca49997ed", "value": "T188454B20DD2406694E1B17ADFCA60B62CEBC861D522794F5F6DE030D62064FCE3BE66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917245, "uuid": "652c11ff-eee1-44f1-94ae-c0bfa988c6d8", "value": "24576:u5y73V6JRpg6HrafpaeHrsJg1bhJFgjPm2SYFr:Ey73V6JRpg6HrafpaeHrsJg1bhJFgjP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917245, "uuid": "0b10b80e-b9a3-4f51-80dc-2017c2ff907a", "value": 1174506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917245, "uuid": "1264eb10-f09c-4251-ba4f-02bb5145d1ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917245, "uuid": "8c73f9be-0b3f-41ed-bd47-01fa1070bc73", "value": "20260804-000581.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a3dd0b-90fb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785954591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954591, "uuid": "8f689268-fc2c-48e6-953b-2e40e098d22b", "comment": "Malware payload (Mirai)", "value": "3b889ef5da99c51c2546e559e8525e00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954591, "uuid": "27ca4f63-a9ab-432e-ad61-cbecf39e2cb7", "comment": "Malware payload (Mirai)", "value": "6dafc7730f80e1faaa8f64ee90affeac7a0b8d3a4e4f2cb61f6e01582932dcae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954591, "uuid": "b8d29470-e1d8-43c3-8a0c-e68b42ddf56d", "comment": "Malware payload (Mirai)", "value": "90197494d9108027a2c66eaf1e750fcd3c35daf5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954591, "uuid": "16b85fc7-7e3e-410e-9a2b-4ec42c4932f7", "comment": "Malware payload (Mirai)", "value": "f3c80ca8b35192f020436b9d220dce8c1d123f11d08750532c5393ad60d3c8482b7ebce1f824987ee74b96f36321ec3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954591, "uuid": "aac3ddb6-2386-4a89-a96a-b521f39c7032", "value": "T1193327C1B583F9F5EC11457C307BE7765E37F03AA03AEA9BD7959833A841A02D20629D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954591, "uuid": "de9fb8d8-1617-46a3-923b-8b68893b0cb3", "value": "1536:1M9zO39ul8ah+d++yqDPoPPOdTYGBfmaIzKHsa:wO3I+aod++ykoP2TgaoKHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954591, "uuid": "2d54deff-0f8c-4972-8c98-4a6b2806fbb2", "value": 50844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954591, "uuid": "56d78893-ece6-47ba-b307-3b017557a976", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954591, "uuid": "48f56902-bab0-4ffb-98e2-c98efd8c2066", "value": "6dafc7730f80e1faaa8f64ee90affeac7a0b8d3a4e4f2cb61f6e01582932dcae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ad09b7-9071-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785895312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895312, "uuid": "28bcbdbd-a6fc-4aac-aaff-5c97aff29795", "comment": "Malware payload", "value": "5ab45d0e17f3bece44ab60a1659104c5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895312, "uuid": "aeb40296-5bb1-4b89-8dd7-b257d0112260", "comment": "Malware payload", "value": "6db4914bfa06a112892250974b42abde5c7a096050c970a1dcbb23172ff863f6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895312, "uuid": "288e7e44-1626-4dbd-bc5e-6e4a775fd948", "comment": "Malware payload", "value": "b78ae090d9f24269327d5f4dc50b46fe33d964f3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895312, "uuid": "b0ffd7b2-afb8-49ec-9ddb-49ac7641c82e", "comment": "Malware payload", "value": "444f1d00cd9963085ac2fbdf3d0ebe2e46960ba4fed132e2af7ae0039375bf87aca20cb5ab3f12b1f6513944eb18807b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785895312, "uuid": "0ace441c-d930-41b0-8fbf-a38a54628961", "value": "T1763184EF13429A211554CE4BB271224D9700C1DF2E6BE7E8EE4C2D29B68E54C329DE4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785895312, "uuid": "78a8dd9e-6de6-4943-8d92-618141b66cc9", "value": "24:i8919UWC7uut75OeHGtsHQuCBP7+yqT5BH:i8dwua75RGtsHQuCBP7tqbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785895312, "uuid": "f657985d-f0ba-4f41-9933-1ac75d98c5d9", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785895312, "uuid": "4974ae45-0bbd-4cd4-a88a-351532c3cb6a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785895312, "uuid": "d4cf203f-6629-4a3e-a309-0140d71c9e63", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e979d247-9101-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785957282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957282, "uuid": "bc0035df-624a-41b0-836a-ca785a23c3ff", "comment": "Malware payload (Mirai)", "value": "ed9c254843df02de9653af2adad1c478", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957282, "uuid": "9f8e1ffa-ab78-4f76-9c10-07127e46db5d", "comment": "Malware payload (Mirai)", "value": "6e0f622dbe0cd95ce9ea18cc6d8e43a6611a1eabab7d9cfdb046093db46e9b36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957282, "uuid": "179b8035-1ef3-456d-b43b-7d829a6f4c57", "comment": "Malware payload (Mirai)", "value": "f6bc2384b3c9bc183a182b19a88d2df024b0a2bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957282, "uuid": "e84d9033-9edf-4365-8726-85b16f1f850c", "comment": "Malware payload (Mirai)", "value": "eb50b4b104c2748e0b35ff1a2af23b7f3815f188ad7341d4dd522e499cc9755ffa512fee8d602ae6baccecd48c31e2b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957282, "uuid": "503e8231-9301-43c9-abb4-bfa3324b32b1", "value": "T1614301FEA13BD1F4D2A81C31580CA6EAA32388351F65D6BF06DC16B606FE1549DE4F24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957282, "uuid": "2c0b799f-c1d6-44a3-ba6c-0dd8279843b8", "value": "1536:KzqHxbnO1CjQhr+ROAXv5e2aCqKDohinPORqbH:KmMCjQtgOIvnzqOohQPww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785957282, "uuid": "13fc0d1b-2faa-407d-97ef-0a86628b76f5", "value": 60268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785957282, "uuid": "da8653e3-0dd9-405a-a784-77770db53fd3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957282, "uuid": "ff831981-965c-482b-a1e4-9d260377d464", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804cdf3e-90cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785934772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934772, "uuid": "fce4c19c-4506-49a0-96e3-ddc07128510f", "comment": "Malware payload (AgentTesla)", "value": "1c6b557178141c09df7071eadb00717a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934772, "uuid": "15db0751-2c82-4ad8-b7a9-a0ddf8a186e1", "comment": "Malware payload (AgentTesla)", "value": "6ef48d93f657cad9958cb9fbebd089963b34ae06f1b6da673f5e43aa1cfddd41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934772, "uuid": "2241b29d-f88c-4929-b2ef-6d3e488140a0", "comment": "Malware payload (AgentTesla)", "value": "8089a0d3628f7fb69de6893348e95a1e462ae66d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934772, "uuid": "3439463b-8771-4f71-9771-6560b69123be", "comment": "Malware payload (AgentTesla)", "value": "2cd707962b3d7735a4685324bfe85cd7e4805cff19c700cbcc43afb8218bfbd9e180facfaf796f20cb0e18b6e0a55902", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934772, "uuid": "0b745427-d389-4bb6-a791-c91ac12bd87f", "value": "T1E685A571BAEF34E0A65FE42AD3E4ED7F263367E1665752380507A2C24B907C0EBD2524", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934772, "uuid": "f08216b9-2c0b-4d9e-a478-75bc5698e571", "value": "24576:BPrcGeZneQbfWymD7Or+BNg6bVj++8odKsrkYN0QWKMmYpFSJsWjwvQkPv7yV:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785934772, "uuid": "8cb34b3f-1373-4609-9db3-417c3a41cbff", "value": 1775763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785934772, "uuid": "b62b37f3-82d4-42a0-8477-62ddfdd58223", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934772, "uuid": "8c85399f-dcc8-443a-9b88-7f11dc329686", "value": "RECONFIRM BANK DETAILS FOR PAYMENT.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4209a0b0-90a1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785915769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915769, "uuid": "efdd6074-7cdd-4893-8a20-72a690bab270", "comment": "Malware payload", "value": "ce830fadf6c59ffb59f9e97454c53098", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915769, "uuid": "c32016cb-ab57-405c-9604-df6bad7b2cc1", "comment": "Malware payload", "value": "70da7a1fec73a921fd15209e21c29d14d50c0ad66f8d27f91bcb6b5a114685bc", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915769, "uuid": "155ba2bc-6983-4a48-98a9-b84828511d6e", "comment": "Malware payload", "value": "1787f9cbf7a542afa7d385816330e1a378f57f26", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915769, "uuid": "a6c57985-fdec-49cd-9aba-cbfddda88903", "comment": "Malware payload", "value": "e14be804c394b24cb4bed4049df7cce2006285c8542bcd714851f0d0783df681301fd3757ae53db18badf163f3eaa1fb", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915769, "uuid": "55af5dcf-3dcf-4a63-8737-a574f7c40f04", "value": "T17863024FC423973CDD29CF7396DA36B59AECB30E98187C65B096988433D129743589CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915769, "uuid": "f68cc49f-7696-459e-b165-3a0cac73fa27", "value": "1536:MQy1lU59fSuxBgafhL9eHXhbMt+JTlkonj1pgGaeLYjqUzt+yaEXKDZn:M9M9aufvJLgHrD1pJbLWR+REWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785915769, "uuid": "ca05fac4-7b4d-4b8c-a074-ce0d9afdd697", "value": 70949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785915769, "uuid": "470d64f4-4c31-49cb-8471-560268dd2525", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915769, "uuid": "a80888c3-0ca2-42a2-92ec-5ab7b05b2e16", "value": "Oder_specification.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c7e051-910b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785961537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785961537, "uuid": "1b214a85-ff3d-419d-8880-7e07ecfdfe34", "comment": "Malware payload (Mirai)", "value": "269d6af241149e64faa5ad184fac16bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785961537, "uuid": "e219f782-940e-40f0-8781-2544ee089c7f", "comment": "Malware payload (Mirai)", "value": "73954ad21e67eef91256bc65f3b2b88ca6d20ca45cf0918247ade9a4d7bab694", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785961537, "uuid": "9dc3e86b-f3ee-4152-91a3-fd7b4c86f9ea", "comment": "Malware payload (Mirai)", "value": "07fa63293460724bc38a3075ce88bbfa9212d93d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785961537, "uuid": "32b86c91-442f-41e8-a793-32576f5f44ad", "comment": "Malware payload (Mirai)", "value": "00fc93705f43fdfea114606ec1491a2fee06dd47b3846ae38d80c2fd45210efdec2663f08ed86f4220b3536f0c87a399", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785961537, "uuid": "69236f7a-8de1-47a3-8efc-12282731a7f6", "value": "T1C6C37E98D60F9D81D2C3E6BDAD190EB371363CB84664C3B25A00536DE8EDED68C62573", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785961537, "uuid": "effc9029-e3b0-477d-b8d4-1a32a3cd6078", "value": "1536:weeedOxJ94TWQwnX7DXOqrVbXAVPk7Coh4DPCw4SdJ5p+aIoo8L1KauVIr:1eyaQTWvH3rV0T91oaDDL1Km", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785961537, "uuid": "bca6f39e-2baf-42ef-948d-3d3b3f3dcd9c", "value": 120712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785961537, "uuid": "dbefc7c1-ed35-4989-8d2f-4cb6b2f0f107", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785961537, "uuid": "b69966d2-bf6f-43a4-8c7b-77fc51c100c5", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90da3f8a-90a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917190, "uuid": "54885848-514a-4400-b8e0-b5df3a918f54", "comment": "Malware payload (AgentTesla)", "value": "3794bb20fd25798e089b58beba29231d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917190, "uuid": "fc289f2e-c434-4bee-af6b-e743e20f1711", "comment": "Malware payload (AgentTesla)", "value": "73f5787c702d3cfbd8be34147cf59258ce9951ee8812e4cf9c27bd945843c81c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917190, "uuid": "5a606912-e85b-44db-a8f6-682fd2b427e4", "comment": "Malware payload (AgentTesla)", "value": "f8747ce8d86e81c6ac32b1d5b2f6101cd89c2978", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917190, "uuid": "330e64f9-4ba7-45cd-938f-525b450e8ca7", "comment": "Malware payload (AgentTesla)", "value": "7dc3ad60a0fc9d1a4d92f02e1f7fd2654ac561fa5f742b57440f6bb3ed5bbd75d424dd0ba1800db116413f451d23c276", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917190, "uuid": "1587b5c3-e6ac-48af-b337-0293c9e00e4e", "value": "T19AE57D909544D2C2E57C2A3AD40B6F9A8F5FE00FA950FD477F6CEA4A674DF8A7348804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917190, "uuid": "7d11ed28-8691-4de6-b1d9-4c58c4098797", "value": "49152:iJsg5FOjtQtX2mZF/ItVvDNctWiDPVOMU92oGwaV3GqeSD4PfP9MCKgU0nr9CGUc:iyg5FstQ52mZF/ItVbNctxDPVOMU92oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917190, "uuid": "9334d833-28a4-4389-901a-1c3c6a320f7e", "value": 3043594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917190, "uuid": "473b2632-a5bf-4f51-b9bb-6c9734082ad7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917190, "uuid": "44f215fa-ac5e-4fed-bfa2-30da2f304e7e", "value": "CV RESUME AND WORK PICTURES.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d01302-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785917541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917541, "uuid": "7b43cc39-f362-48f0-924f-353bf5cc182f", "comment": "Malware payload (Formbook)", "value": "453472405fd91ee03eb3fcbb95478a90", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917541, "uuid": "6ce6be18-06a0-421d-96b8-d6cc1ab32d09", "comment": "Malware payload (Formbook)", "value": "7413c6d84fc258799fedf2c8f721c9c30dde3272a51f40d755de86c3a27f3cbd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917541, "uuid": "f1b981fd-6df1-445f-8916-a7107b3bcbac", "comment": "Malware payload (Formbook)", "value": "355b4e151e932c3ad93830be6211665bc9dbe7bc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917541, "uuid": "5f1b0d7d-d91b-4c09-a7a1-a5c33f5850d9", "comment": "Malware payload (Formbook)", "value": "eba1e41b2a8beea944809c07f3b5e6138014ac3a38fdb2a459dd33a4ddea083328edf52af50156ae445aaba3a0142c40", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917541, "uuid": "bb933367-6f81-457a-85da-86c2b4657173", "value": "T127E50591138491B27720BBADA23ADE349A1EE05359C2DF05366DE308725CE4FB35CAD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917541, "uuid": "659a6a65-ea6f-4937-a395-bd312ee26734", "value": "49152:KRJEObHYv9ak7vDbyijW6Ow/jVDRwAXyxld8u34j5ruSun12/beHDgu+n/8L8IVC:K/EOEv9tyQaw/h9nyh8uIlrJun1QQN+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917541, "uuid": "94fd6424-0a10-4175-bd1b-ac6b01679864", "value": 3088904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917541, "uuid": "3f83c556-b50d-4be9-8115-f631beed332e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917541, "uuid": "fc52b5ae-8b58-4c0d-8da9-b65b462b8085", "value": "whatsapp.img.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7985ec07-90a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785916721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916721, "uuid": "e3ade0f2-d85d-477d-8195-5bc61ec32540", "comment": "Malware payload (AgentTesla)", "value": "ad0842697480986e351ee797f2c09afd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916721, "uuid": "42a1ce51-6a73-4a2f-a44e-838780b1f20d", "comment": "Malware payload (AgentTesla)", "value": "7484f5553fb515cec8261865343ca83c5d9aabd0b8596881a74671113149353b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916721, "uuid": "e93b339b-d62b-4269-96af-9db1439f1552", "comment": "Malware payload (AgentTesla)", "value": "85575bff14bdcd0a56dfac741975de0207d1002a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916721, "uuid": "932eba7f-5016-4552-9e1a-2aa7e1ae5044", "comment": "Malware payload (AgentTesla)", "value": "1f7c3f6e659fc480de5cbb6dd88e81e416dfd419f8c6ba2a82a318508cb388b424c6ecae56d84db3c2c9543c11ce1eb2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916721, "uuid": "47948743-c360-406a-b611-3b68b6f37c15", "value": "T1C8E5F78117849172B720AB9D6236DE759E0FB02325D2EF02316DE3143A1DE5FA35CEE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916721, "uuid": "d1e454d4-5f54-490b-88a8-3648d691dd34", "value": "49152:ToDaa5bzgXybunMItAgiJ/J2NCN/osydIwS9g8apGYHXoOtd3s1qRiZGiiII4l4E:ToDaa5bzgXUu/2J2QN6dIweg8apD3ouo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785916721, "uuid": "1420005c-b0e2-4e72-a146-187601b01e9d", "value": 3043594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785916721, "uuid": "c6caf862-fa2e-4126-a072-f4d050925558", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916721, "uuid": "8d8000cd-94c6-4125-823e-27857ed4d4de", "value": "Proforma Invoice No. 00124 - CONFIRM.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee9df8d-9100-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785956700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956700, "uuid": "26e3f278-41f3-4f89-9a49-d9c6efb9f657", "comment": "Malware payload", "value": "593ee815772d3dd2cf27c9a86e45cbca", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956700, "uuid": "e73fc11b-acc2-42a5-88b1-4da0caa379ec", "comment": "Malware payload", "value": "756559a93e5ac61c0d23beab92e114ca1654fba6527220b8b2e6e1514dd7e883", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956700, "uuid": "c8b2f02f-5f29-479d-888e-ab05058d2508", "comment": "Malware payload", "value": "7b456c13deedc6c1927220f35634b9cedf8499d9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956700, "uuid": "d7da8c2a-4646-49be-a1f0-36cb386120d9", "comment": "Malware payload", "value": "03338cac2dd52552ae7bdcb44e717fa2538bb567b6ee41c9182eb6170cc5e18970481461d62386f6dc7737cad72717c8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956700, "uuid": "ae561a02-817d-44ae-9ec1-b32e570ef7b8", "value": "T14A01C2CBD6105500401A895EA2A652A0B431C3CA068E8F787F9CD53DE7CCD10F026F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956700, "uuid": "67aeefd8-35c6-40ec-bcc5-b084a0ad4e7f", "value": "24:kXCKysE2hi0ziQvZohaSMUXMUY5BfGFg/67:e9Qp+MsSBl0fGFg/67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785956700, "uuid": "d5ee3289-6367-4c7a-a23c-7766020bf65b", "value": 827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785956700, "uuid": "7f4ecfe7-4bf7-4890-ba14-efe81143f582", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956700, "uuid": "ae4145c0-405a-49f7-bc76-7dfe22566afb", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3838b4-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917555, "uuid": "9cfa70e2-7447-425e-b8bc-2282d2b0c9f0", "comment": "Malware payload (AgentTesla)", "value": "a82c51a038325fa88476e0d139f71d34", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917555, "uuid": "e4430fa8-2662-488d-9e7a-4d5cfcdf8abc", "comment": "Malware payload (AgentTesla)", "value": "7565970cbfe89501523edb17b7a868fb4b013fabdcea386cc3424cbcb30b0512", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917555, "uuid": "40303ab0-6d6c-4af0-9695-17dc25610552", "comment": "Malware payload (AgentTesla)", "value": "5c15ad0414a00e5a31242d12fdedc4ed8c20f9f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917555, "uuid": "ebbfa30c-df94-4c2d-b403-cbabff62270f", "comment": "Malware payload (AgentTesla)", "value": "4d23ec16b6a9a2bf61b23c5e20d11074387abb7bb6a1361804dd25987685d325eb280cbbe6bd2ec3164e9010b5d2b258", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917555, "uuid": "88f139ea-654c-408f-9cfe-f096aff8d886", "value": "T1F8E5E69267C491737B20BF9E563BAE30AA0FA01315C2DF00755DE604366DE8F6358EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917555, "uuid": "1f6fa5d3-8f62-4f72-ac74-1b7bdd55ccf1", "value": "49152:bwpAiRoGZRXvnKP9kYukBnIzaW2m+Rq1ot3ahIT8lDvbMp/Qti08gvMnFCSdU0r3:EhRoKd/8AEIzaW2m+Rq1ot3ahITsDDMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917555, "uuid": "c06b8b82-ea17-465d-b1be-f6fbcc2a2d6c", "value": 3023570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917555, "uuid": "e01633cd-f7f4-4895-a961-fcf5c21cd3d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917555, "uuid": "b6ab295f-c4fd-4798-8d55-ae3ddbc55694", "value": "Invoice 8000241690_CMA.pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277dde77-910e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785962540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785962540, "uuid": "926e1e57-d8c4-4a3c-b1b9-1afb00f80036", "comment": "Malware payload", "value": "21fe9cbf8be67ea36a21466534446006", "object_relation": "md5", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785962540, "uuid": "dd8c2ad1-4666-4bd1-b0a3-4ccad51e9d38", "comment": "Malware payload", "value": "75ae5ef8c6db196c5545ceaa4dc1ac3f916d50b18d5ff73f16a5e3e3cd500a44", "object_relation": "sha256", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785962540, "uuid": "1faf7d29-4852-4b30-95af-fb4563da1024", "comment": "Malware payload", "value": "a678c2c06d2182650d86ec45941a1733e060404e", "object_relation": "sha1", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785962540, "uuid": "1a6b46b0-f86f-4034-9ec3-5952b9e4cb55", "comment": "Malware payload", "value": "2e6ea808fdc9a7787b29521da7c687f512dbb76b61db5a69dfce98a0bd7a30faf09bb1aa5f57fd37fac33ffc85b055eb", "object_relation": "sha3-384", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785962540, "uuid": "8a424c1a-6fff-4def-ad06-2057b291e6d9", "value": "T1CBD5238D7C967276E033C3B392A324ED712E379A8B71AE8E32C85B505D125186C7735E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785962540, "uuid": "b51f115f-cf4e-4346-9c77-6fa4c00fef44", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785962540, "uuid": "3b57ecaf-9f4f-41d2-87cc-f22c688a33ca", "value": "49152:4JQ8eh3uXGoU9FmH3GnUankQxieuLsUzbRShR0DKhXre1ysB/VsGoanVB:Aeh3uXGoUu2n/BuJzbRm0WdsLvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785962540, "uuid": "97cb3bcb-c534-49bb-b002-78a4b6d3933c", "value": 3012608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785962540, "uuid": "59ce43c2-39cd-4e73-848b-8c0ceec0e4b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785962540, "uuid": "16e3661d-3f82-45e8-8279-e2dcbd6a69af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a11e684-9094-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785910092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910092, "uuid": "648d3051-66ef-44a2-aa39-80b50d587257", "comment": "Malware payload (Mirai)", "value": "9019658e07e8c6c54313ebe106577d30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910092, "uuid": "931c38e8-b01d-473e-88c2-66435caed74c", "comment": "Malware payload (Mirai)", "value": "76a42dfdc6b43abac173b4bd26240294d06d6828e4866071084f2407a134772e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910092, "uuid": "4ef089ae-7aa1-430d-81ac-d8982803be2d", "comment": "Malware payload (Mirai)", "value": "d6ec53139d60ae5ec22185aa69b646364e2cc2c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910092, "uuid": "837d5f1e-58ff-4ecc-ada8-c0dda34eccfa", "comment": "Malware payload (Mirai)", "value": "354c1070d726207dba7fba52872027d166c5da92660c79575f7453db4ed3c35f6f9df52b00659044cbb66054ab7eb871", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910092, "uuid": "3f054ea5-3156-497c-b94e-0782b0a64e88", "value": "T11A259D12E7F11266D28093354A72D760BA87A79625E4424FDF608EDFEF972240E84CF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910092, "uuid": "ca0baca0-c31a-42be-888c-4a737a7b4067", "value": "12288:scqm8yXK8bAGsJyR9KfQc5Jv42L8NIY9xs5tU44E:3XK1Y9Kff3v94NRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785910092, "uuid": "c2bbd211-5835-483b-8d03-b7e2f3dfa35c", "value": 1057496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785910092, "uuid": "373d5dd9-d896-454d-9fa1-039fd18db592", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910092, "uuid": "7167fcc2-61b1-4050-92d6-e610396cc22b", "value": "xd.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb742b0c-90d6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1785938817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785938817, "uuid": "3556da1b-434e-4542-83ac-95aaafe7416b", "comment": "Malware payload (Joker)", "value": "989021035b31a013697587534e137688", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785938817, "uuid": "b4814689-a67d-4f99-9e8a-d5bed70df6e9", "comment": "Malware payload (Joker)", "value": "77b010d9b0ea43691744696a55a385b54fc1bf981b186ae45defcc0442a74630", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785938817, "uuid": "ef37a0c7-a88e-4f7c-86ab-1f4ec209163c", "comment": "Malware payload (Joker)", "value": "ee2f3b2d4b94743173797b59009709da0b1b1b43", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785938817, "uuid": "119f2032-b273-4d9f-a513-6e0fe6e97aa1", "comment": "Malware payload (Joker)", "value": "65605f03535943162c78b810698e3ec9ba55c7735fdb803d8ca87c70da48c3ca3f9a13150fc0290181ca8e649390701d", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785938817, "uuid": "4df6dbc2-68a2-467c-9630-55d2758750a7", "value": "T1E647E049F61CD927D9F5B0BC8D8B17A3B4667C150A10C18B3821B20DFAB37E49B56BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785938817, "uuid": "a3010e5d-4e08-4058-8b5e-bcc61ecfe6a3", "value": "393216:QHnum/lfvuzLcZkVw7zN/YJiBnpUWOyrQxCuKrW701QCFa:8u/hVCYJopUWOycFv4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785938817, "uuid": "1c3a3bf4-c2d2-4fe8-b836-ce28cf951a9d", "value": 25092588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785938817, "uuid": "22bf9855-9fe1-41ed-88fd-552fef2a6482", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785938817, "uuid": "82a3fb02-aca0-4212-a3ef-2f76439c0682", "value": "Pure+Message_3.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c8b6b0-90d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785939163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939163, "uuid": "fee7222f-a8d8-4d17-bb4f-e61adb63a51b", "comment": "Malware payload (Mirai)", "value": "cbe23c3fd2daf3fd6e455a9589066ac6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939163, "uuid": "6d5da65e-d3ce-4971-9645-7183b96891a3", "comment": "Malware payload (Mirai)", "value": "78a57de8eb7d70af3d44dda3ea3fc11ed44879d34db45fb8c22211b852398763", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939163, "uuid": "bdb4bcb8-0671-4fee-a75b-d995b7b45971", "comment": "Malware payload (Mirai)", "value": "2c1d6f4a3fd607fd1516e65f35743045c08866f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939163, "uuid": "b347ebe5-8e06-45f7-bbf4-7535f8726abe", "comment": "Malware payload (Mirai)", "value": "4e4de76d5f0d260b6cac25467ea5c30d7406e678c184d0475de2c30a9943db46f665042de58f6326cf92594f5301d0f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939163, "uuid": "cc5d4b6f-c5e1-4f7d-95d5-bb6f3b61eb5a", "value": "T187153A48F4A0EB95C2D4B9B6F31C655C73130776E2EB710699199B3233EB45B0FBAA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939163, "uuid": "13336bc7-22e2-42e8-aec9-af9009b05009", "value": "12288:LiT1m3s+TcVRwkcnYqpXGlviyMo1o/zWGeGDUvVfjKxV2Amoa9Mp8pTHFE:uE3oRwkcnGlvwcobJeUUvAqRGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785939163, "uuid": "d74136aa-d35b-414f-b902-edb31f0b2887", "value": 956852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785939163, "uuid": "22c2181b-5747-4655-bd29-6e278d4f15c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939163, "uuid": "3ec6837f-5a7c-406c-922b-78b98c26b4c9", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f627cab7-90bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785928956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785928956, "uuid": "881eb760-1ddb-45ec-a906-bcb48551362b", "comment": "Malware payload (AgentTesla)", "value": "eb48718f8ee70303224d77724b05fa5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785928956, "uuid": "3be8ffa2-9cc6-4339-8906-b0254a976f30", "comment": "Malware payload (AgentTesla)", "value": "79e3baf24631aeea1b35c96dc7a9a761ea6350a29c1c51eef2f17f7763b681b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785928956, "uuid": "b2d1faad-251a-4727-b9b9-d6f320c3e3a0", "comment": "Malware payload (AgentTesla)", "value": "bb5405a467f209ad7dd5f004c8d355359d12bcea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785928956, "uuid": "305ee966-a793-4b8c-b480-38362dff3e13", "comment": "Malware payload (AgentTesla)", "value": "c60017c5925f4dd85ae5101b7e269f53da332bd92a8791e0f2c26a679bd10ae9e13949e2e8d817b0bf11d1343e2ef64a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785928956, "uuid": "3bfec0b2-c5f1-4d60-bcff-7b10a4be8849", "value": "T1E425125463A1CE22E8BD4BF60832D33113F1BD9DA452E3168EE9EDDB7121B198C58793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785928956, "uuid": "0b110bc0-aea1-4386-811f-0ecb337a6187", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785928956, "uuid": "09516c17-ac29-4720-af1d-e7840069ef2f", "value": "24576:mUwsmjtDbxAhlWySCuT9bjYRekWwhI5Mg5AOQuyugsa:mD3jtDbxelr3mZZNwhcXbQuyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785928956, "uuid": "eec673f2-8019-45e2-aba1-3d983c06f689", "value": 994816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785928956, "uuid": "ab3b4098-3d28-432b-97d5-c262ba7dd6d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785928956, "uuid": "1d6d4aea-b314-478b-ba75-1d0dc4b617dd", "value": "Scan00957.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78cf2a74-90cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785934759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934759, "uuid": "f05aec63-7c9a-49ba-bb6a-97956775a23e", "comment": "Malware payload (RemcosRAT)", "value": "6b2ac664f5265d88fe7ea5d569aa8c53", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934759, "uuid": "b4fe2692-cafa-4682-937f-32d05149730a", "comment": "Malware payload (RemcosRAT)", "value": "7aa3fff3a741634364b442753221b76f1d9b815216fb88094cc2c24f24484db1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934759, "uuid": "30c73aa7-184f-45be-a202-45edf1f91a4f", "comment": "Malware payload (RemcosRAT)", "value": "de5350b235e72be3ce420635667fdfc50410ec80", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934759, "uuid": "fa0d3240-6dd9-4178-a38d-1d6667f789e7", "comment": "Malware payload (RemcosRAT)", "value": "52676e310631e107b2bcc7d9b0c55de9d799b2b936d55040211a99c0babf8bc6d46d36b39b533dc8e23fd9a0f5ecd8f3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934759, "uuid": "20bb0776-050e-4ea4-ba4d-d550a1700b0a", "value": "T1B03540A3D751CA15C1D0EA67CED888069198014F3998A6FD37A45BB9EDB3F4D20F0EB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934759, "uuid": "915b4858-8271-4487-a94c-ddb636f5c7ee", "value": "3072:FbjwVAnAMb47SeSwWwZDv0JNnAZWQ997T5tHQR+1trl2:Uu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785934759, "uuid": "6da89111-bebc-455d-8c8f-a07c29d84f9c", "value": 1070333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785934759, "uuid": "00a3e237-1660-4d0e-bb8f-cf3b6c2660ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934759, "uuid": "bef353da-253f-40ca-88e0-84bd0bcaf116", "value": "WQ-1812- Documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e709d2c-909c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785913750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913750, "uuid": "12f7e546-27dd-4c93-bf85-4c737c5673ab", "comment": "Malware payload (Mirai)", "value": "3ac6d53466d98b4fba3e03bcccbd2860", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913750, "uuid": "b34e853c-e49a-4632-8779-f144a3774fce", "comment": "Malware payload (Mirai)", "value": "7b50e4b46def7510b0adcf2a30c354c5641de17e89f3b60e4fc920c9f632945b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913750, "uuid": "e49487d2-62c7-4c7b-82e6-540250ce7ced", "comment": "Malware payload (Mirai)", "value": "c01795d370fcf84ae98944e8d6f4297043dcea67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913750, "uuid": "09bd9ea0-278b-4ee7-843e-51ec7ca8b7ac", "comment": "Malware payload (Mirai)", "value": "259fa724de81e5b3a342486af3b86c5845870f4cbafb2fbf4d4325de2a6bf3eec6fc6191d8baa9d3b0f1765d173aa014", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913750, "uuid": "79430f5e-2451-4bbe-a4fd-baf591a4cffd", "value": "T10734A71A3A12EFBFF568863107F38A7097D521963AE19346F26CD71C1E2028D685F7E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913750, "uuid": "1c58b598-7ff9-49ca-b171-4943e13b426f", "value": "6144:sx7f5flfnJXQhAoAlaDm7zvnreG3Ai/a9vNYzpWe:ubfnJXgDizvnreG3Ai/a9vNYzpWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785913750, "uuid": "f2666f36-354a-47ad-91eb-baec60dbbc59", "value": 238353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785913750, "uuid": "3d5aed3f-25b7-4369-91b8-b07e349d30bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913750, "uuid": "05d9cd26-ae6b-4f49-b639-39365625bc7a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0b1949-90d2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785937128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937128, "uuid": "2038d651-21c2-4fcd-ab47-c2d63a27d68f", "comment": "Malware payload (Mirai)", "value": "1c425287090c16337ac59a563d64919e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937128, "uuid": "606f5ad1-e60d-4e07-bf7c-cb849023165a", "comment": "Malware payload (Mirai)", "value": "7b8add306d87da91ed1ff4608ad8f829c83f6035cbc852c73869ec66977d93f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937128, "uuid": "6b1f9def-754e-4441-8048-5962db66589d", "comment": "Malware payload (Mirai)", "value": "13a2f751c40d57b66e82c9c2c9613102cd99b4da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937128, "uuid": "224af2c0-15eb-4c78-8aa4-d5a3a0238c93", "comment": "Malware payload (Mirai)", "value": "37fe9b7f88c5811b818c1ccf935c0114043542475ee48e04c4ec3f89ab1720181a01d9c7245745680cdb8e44551a41cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937128, "uuid": "1a879e61-67e3-4aad-8fad-a001ae6fae09", "value": "T11E357C5663B1CF8CF360D63002B39E1699A512B316E360C6A27DE621379225D5CAFFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937128, "uuid": "16f9b3e6-c28d-4f28-b743-e36baadcd356", "value": "24576:lnPMjlEOI6V4qHS7aNZzXD9lBI2UbAqY5YsI0K3Vhy:lnP4O44qPBlBObAqUY9Lhy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785937128, "uuid": "d8ef096f-95fd-4a56-8a05-d19fb8dab2bd", "value": 1121448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785937128, "uuid": "f9c4b76c-f104-4c10-a926-0f567eddd1d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937128, "uuid": "ce2d7329-8bb5-43fd-a52a-c0cea8f90181", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8422287-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917686, "uuid": "a1d9e0d4-54e8-4cdc-952b-622c7407f169", "comment": "Malware payload (AgentTesla)", "value": "80dbe31a279fc1644a7e685863b121c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917686, "uuid": "364f2999-c0b6-4bde-94f3-facbd6797fe5", "comment": "Malware payload (AgentTesla)", "value": "7c3a7747276ff766652786a95b58fc1682b8d9a28cbdd763b9a382e1da35e523", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917686, "uuid": "b1fab924-6c2f-4c4b-9e7e-63b91238f839", "comment": "Malware payload (AgentTesla)", "value": "743c76f43a46c30770942ca5770bc0d24dd78e1a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917686, "uuid": "95db5ec2-f12a-457f-8249-a4a17f5308ee", "comment": "Malware payload (AgentTesla)", "value": "5cabb8bf67f4dff46c9128342cc54d4cfb7bc94e9091b0e58fcc9ee8ed5518de376509ccf572aa882d505c8729785d62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917686, "uuid": "c45560fb-d60a-4732-8a9c-6bdf0101ecf4", "value": "T188E519747518ABA0A86C1F3CE9262F4A1B3EB10F4734BE0D377C65C4279AB9E318E455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917686, "uuid": "f4e7d5eb-3677-4c4d-9358-f4703a34a692", "value": "49152:D/QWOTIzuEQ70XPgyuAzM216/9h9Os63ux6QSIB9ZnyykeqSDBnch16oAij7Xqbc:DYWOTIzuEQiPtgW6/97/xTSI9nyykFSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917686, "uuid": "1f9708b0-3651-486f-b74e-3e749cc76133", "value": 3041778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917686, "uuid": "322b120f-41b7-46b4-9b30-15fd422b32e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917686, "uuid": "8e1a2e8d-fc9f-4c3f-b287-3d220eb4dc0d", "value": "Swift_Advice_Copy.pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e45b0b5-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917481, "uuid": "d30e30c5-c43e-476e-a75f-61f20a83a112", "comment": "Malware payload (AgentTesla)", "value": "1e7785823d13755f0624edb3065bfd49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917481, "uuid": "74fa0ee1-fc45-4264-b88f-6ebffc798d83", "comment": "Malware payload (AgentTesla)", "value": "7cfde34993d2753971d9531203d9c30a77c86b6339fa1c147509cade41e879d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917481, "uuid": "ffd44a72-b6f0-459e-a29e-cc14609cf331", "comment": "Malware payload (AgentTesla)", "value": "d27a3efdfac840e4e6085f069e46041deb1c80c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917481, "uuid": "24bd4c94-b2a0-4006-9c09-f27e94fa8210", "comment": "Malware payload (AgentTesla)", "value": "8e367ee7034e7454fbd5db6be9f031bddb175b656e16c6654bc28f171b53d1492c48ee350ebe016721a2e35f680b0a31", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917481, "uuid": "2dcbf66c-ba70-4896-8705-b1b833d7c2bd", "value": "T191F5C42A0344697067BE636CD13A9E61A52D210742C4FF1E317C6148BBF5F5BA39CAF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917481, "uuid": "dbb1c5a9-0620-4dc4-a19d-2a9644f17c2d", "value": "98304:kLI4ej80jzkiLgk/5UeLT/brt14XRaVznEtuksH8D3142Z:kzewo10ORN14XRfEkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917481, "uuid": "173e0da6-254d-463c-97f3-4e8dff4c4de3", "value": 3410540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917481, "uuid": "71405919-9002-4b63-af47-77181f69f1c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917481, "uuid": "6b455ba2-4a9b-4296-8eac-bf10a1549a58", "value": "bank details.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e737b0-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1785917660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917660, "uuid": "d2bfdb07-7a6c-4820-a04b-e3201b54f00b", "comment": "Malware payload (AsyncRAT)", "value": "98159f537afd6b8992d2e7171304d419", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917660, "uuid": "be64175a-ff4a-493f-9e7c-2a21e6a4296c", "comment": "Malware payload (AsyncRAT)", "value": "7d74d9acc7104c5ce24a5ecfb5f1ed11030c9b4564a5c395adb4cbb5c69b868b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917660, "uuid": "2808de66-7c3f-4322-bd0f-58312e358afe", "comment": "Malware payload (AsyncRAT)", "value": "52054383f8f4b65310431589b48cc7cc5a027cd7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917660, "uuid": "229522ac-e653-4b77-8537-334bd993eeab", "comment": "Malware payload (AsyncRAT)", "value": "f501890409e94daf0213df47563a872db6547649a6704d27bf640ccb16e1a1e513a14ef9e9b4d6661803b16ba106a9f5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917660, "uuid": "eda419fe-982b-421b-a55f-ffaad8a03bb6", "value": "T19F149EDDB6E1B4AE0241C6F78B2EB2E4D58A39175E131CF47881D3A328E09D1CBB5563", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917660, "uuid": "a9304346-265a-4fc2-be8f-8e472102312c", "value": "3072:19+6iaPL7sOg54dtbsYjQXNjxZJRp6vaZpZh+ugRx3yHPMY9UOlmXg5:73j7iOuYj2FRWaZpZodeR9JX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917660, "uuid": "5eb466ee-1427-442b-bf60-f0be15517dec", "value": 194063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917660, "uuid": "16c7bdf4-5ac3-47ab-afeb-85e2cabd71ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917660, "uuid": "dac01808-8638-40df-9ce3-aa0a0e6340d9", "value": "ORDEN DE COMPRA__.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67f2786-90fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785954163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954163, "uuid": "54215204-a5f7-4379-bfb8-51ae076c6e57", "comment": "Malware payload (Mirai)", "value": "953b77fee91e65c6e3094579552816e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954163, "uuid": "02d0a724-b9b1-4290-8ba6-ad7cf773d6b3", "comment": "Malware payload (Mirai)", "value": "7e835d5eddd2350b13cb741f9cc842085a484d9059a986dd1c393ed821fe864b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954163, "uuid": "5926620b-ab0a-45c0-8730-380505a3f998", "comment": "Malware payload (Mirai)", "value": "f638c86faada14f33300fdad0145109e49181153", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954163, "uuid": "4b573613-0eea-4b8a-bb30-a4c66a7e0eae", "comment": "Malware payload (Mirai)", "value": "c66a6140233a54d38e11d9f73da9e8693c5211cb900082083e1f14fb179fb37246476b5a585841db946189a790ab1b52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954163, "uuid": "d467c5da-75a3-42a5-9f48-b428ac8e3bff", "value": "T1C2F2F135610AF6B083340C72EFBC868A17D62EB3D2ECA7B5986017B5BD2141F847D18B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954163, "uuid": "ccef6764-6e98-4262-8282-f70095cc4b95", "value": "768:R9QZbkBAgjlFKhUvNVWVO6dtTfIm53mXUs3Uoza:nQZwZ06VWk6/fIm53mhza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954163, "uuid": "c4abaa15-438d-4630-b6ca-49d63b25f82a", "value": 35696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954163, "uuid": "081ca1b8-67fc-453f-aeb7-3cb38dc810e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954163, "uuid": "2d388f66-bcc9-4302-8689-e00b52db1e46", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f613c5-90cc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785934424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934424, "uuid": "08d6390e-a5b4-4a41-941f-de6c056b844c", "comment": "Malware payload", "value": "ca92ffaa066de4a811e0ae179c1adbc2", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934424, "uuid": "5cd94193-2aa7-4007-bc8c-2925d6206354", "comment": "Malware payload", "value": "7ea9628a6d531b6d190d3333aadf636aae7b87de423ab6975a92dabcf7fbf5f8", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934424, "uuid": "2528b163-f9d9-46a9-91fa-80fa789f4600", "comment": "Malware payload", "value": "4605fc8647d1027234894d3b72f7eb4aabb00590", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934424, "uuid": "38dee093-e6a2-49ba-a8a2-d270561df92b", "comment": "Malware payload", "value": "6442c804df349776d2b4ebe13b1198fea9a3c88e0caa419ec907cc340ca932821534acede9aae08c0f54ac0e2571117a", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934424, "uuid": "c02c1ee3-25dd-4ed2-9624-fc2c4b97e3a8", "value": "T1DC05122DF726899DCF2A943CC00803D79D0E595784E1A85E1E94BB443B5A4FF8F8E4AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934424, "uuid": "a2ddd4e2-bd26-42ef-a078-c8c5ca16ebf7", "value": "12288:gLylMDadzn89+xamtgnZ+xTru0nTlOvchowFQcCbPYLuNTiCw317rvglDVCobOA2:guJ5nXMZi/n5OvchvQpJGCwvc2pBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785934424, "uuid": "1b6f15dc-2661-45a1-9316-53b966b4c353", "value": 849239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785934424, "uuid": "da5bba75-0e09-49b1-aec9-fbae430ee4a9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934424, "uuid": "be66036b-ecc4-4976-9c72-1a818433ab7a", "value": "R.E-LOECHES CAMBIO DE VALVULAS PTK30.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2427c9-9127-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785973236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785973236, "uuid": "07018f1e-f528-47aa-97cd-67665f237761", "comment": "Malware payload (Mirai)", "value": "aa1963e9ed98a574507be71f97b58292", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785973236, "uuid": "78795efa-c168-43ef-a85d-10716f9dd246", "comment": "Malware payload (Mirai)", "value": "7f2f9568ed5c3a32cea5cfb11b09ebc1e3b011c5aec406ea77e268060ec8f318", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785973236, "uuid": "4e7ce986-033f-49db-894c-bfcefa3ea345", "comment": "Malware payload (Mirai)", "value": "d84c297c5c22a07aa74775294f854b66d9f126f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785973236, "uuid": "6d4ff89e-224d-4b5e-a081-083e6ab85b91", "comment": "Malware payload (Mirai)", "value": "5b3f7971f168e68ecb9e0ccb3d64027861506066b5d2e669e0d273c93fc22c7e7314b4688e5eec1e01ab13409fe32d2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785973236, "uuid": "622d37c2-9d98-4597-9dac-db0a1f1bdc0a", "value": "T1D4C329A9F890DE52C6C52676FB5E028C33231778D3DE7105CE109E34F7EB95A0A3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785973236, "uuid": "23eecb8c-ae7b-4e13-9c92-94e308c64669", "value": "3072:GMS8HWIzZvDVsINudJj+3scYEEU3cRE4fOAvLSKykdGER6U1yGk1qf1Dl:GLMnlUQscYEEU3cRE4GsLLVdGM1l4q95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785973236, "uuid": "dedb4f31-7d39-422c-a38a-6ff7d94301a6", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785973236, "uuid": "0b395550-39fb-426e-9c0e-b4df56052324", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785973236, "uuid": "4da92965-c2ee-4c31-9925-63faed9e4488", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff0807a6-90c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785930260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785930260, "uuid": "5790bce9-02c5-42d7-b9b9-4cfbc41cd664", "comment": "Malware payload (CoinMiner)", "value": "3b3982a4f8e3471c611c28b432c97291", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785930260, "uuid": "14300c51-777c-4928-be18-6b716f929c88", "comment": "Malware payload (CoinMiner)", "value": "7f936ffc40d08c305fb98485fcda7ed3d5dbe601d59b9a1a0e6e8ce36e54ebe9", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785930260, "uuid": "178e1dd0-2afe-4396-80da-ad3c22ad0b72", "comment": "Malware payload (CoinMiner)", "value": "5925d0b9b00d30321ca48d4fbb7033143df16a0b", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785930260, "uuid": "c37691c1-7c14-499e-9cce-30bce0c0f8be", "comment": "Malware payload (CoinMiner)", "value": "019590e60f0e8fddede67721d1bac5932aa60e5a6ff562efbcbf6ed82448a93e366f2c09d00dcfebf76938bfc05c182d", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785930260, "uuid": "3b5a729a-ca10-44c2-a4b9-9ddb2556f63f", "value": "T1E2A63366B0AF0ADEC040F23DAD7294127157044494B30399AEBFC35D74E6336FAAF669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785930260, "uuid": "24772759-17b7-48bb-8a05-9fbc7cf1492f", "value": "9dc580b98fdc55e0bc3b6c6f01e8c0c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785930260, "uuid": "7803fd89-f160-45df-9db7-75a538c035e6", "value": "196608:ZEB+eRCVUvGuzlLx9XjRueVuq/augp1/65ma2k7JRjMWpU+pLJXV:ZEB+uCOvXLjRaMaugpJ63xrYWpU+pV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785930260, "uuid": "a955f0d8-2d5c-4ece-b716-ddc0f5490291", "value": 10036736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785930260, "uuid": "c92ec8a1-b7bd-4f40-8c5d-3de52366b060", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785930260, "uuid": "758dc74d-4bba-441d-98b0-56449a712e32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f116be-9100-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785956820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956820, "uuid": "d4bbaf97-3c8a-47b7-8d77-d38f379caa4f", "comment": "Malware payload", "value": "d1e62f2872d761ebf655c49901052591", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956820, "uuid": "7e0dc671-9ba8-4bc2-8796-1d31bd6885cc", "comment": "Malware payload", "value": "805141ec0c6535968b19077ac5b805c3aefc9f426ffa95a85d9401a2f48935f0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956820, "uuid": "ede88d65-496e-47f4-ab64-2adbcee23e14", "comment": "Malware payload", "value": "5b36795c66dee88c2aaf709d67b03a5935917dac", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956820, "uuid": "b4555b88-dc46-4d50-9954-2424a6d4e5cf", "comment": "Malware payload", "value": "f36750e7a43fc54049bf9e0b437fbeb419dce8e504c918a0abae2cbf4f12236afe12a615c322ae2fa2de80646e2fd709", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956820, "uuid": "d9152172-2891-41b0-97f5-8b943a0b1d76", "value": "T18C236C6516857C14AE98C4365C7F2F0CBDAD43E6314492EE7FCE3CF28C4A6ADA20865D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956820, "uuid": "97403145-3468-4dea-8897-ca72d02251ee", "value": "768:ir9NyXsZztCo9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:sHusZ4cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785956820, "uuid": "fdb48313-c6dc-48e4-bff7-bfa57e82701e", "value": 50039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785956820, "uuid": "0b2643c6-6e34-4c9a-9f79-e62d6d02a7d0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956820, "uuid": "481f92c7-897f-409a-b04e-412e470b2e99", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef0e932-90f3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785950902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950902, "uuid": "e8ca865b-e82e-4a42-a14a-35a78309e002", "comment": "Malware payload (Mirai)", "value": "875e98062450358ead5054150ec9bfa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950902, "uuid": "6e6afebd-5078-4308-a718-1679f9d7ca67", "comment": "Malware payload (Mirai)", "value": "805a01d5cda9cf31423b7fc2cc70165098505500c9107bb47b4303c0a60cb208", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950902, "uuid": "d5d48af6-6ae8-4144-aeca-a8af20598c18", "comment": "Malware payload (Mirai)", "value": "d7bfa216cbe2e30e818cc4f972ed7ef31dd0c365", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950902, "uuid": "b0127bbd-4280-43f1-ae97-94d3054aee48", "comment": "Malware payload (Mirai)", "value": "7dd6784b924e92ff10672c53d4f23fb7dd6ca58fa2229426e0c5030094e6994018520c1758097303dbf6c77c74cf49bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950902, "uuid": "44921540-77cb-486c-8ecb-c2cd842c639f", "value": "T1EF538109BF650FB7E86BDD3749A91B1524CC641B21A83B3A7934D818F34B25B19E3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950902, "uuid": "935437b4-cb03-4208-aa04-3636435ce5ec", "value": "768:EJw2XTUg2BJj+jheE2CrM3yjGreY5oIe0eA8eVNEX5HXiTnpQzehfih:EJbXTUg+JYSrPxBF8eNUJehK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785950902, "uuid": "9a3db3fa-6fa8-4b02-96f5-d926cd6334ed", "value": 64696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785950902, "uuid": "ddfe2a38-3b48-43f3-b789-b4f765bbb0cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950902, "uuid": "f3275af8-606b-4d29-9c26-1b87b988e88b", "value": "805a01d5cda9cf31423b7fc2cc70165098505500c9107bb47b4303c0a60cb208", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e32d35-9101-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785957224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957224, "uuid": "576ca7a9-8570-4032-8679-b3e6c3d61b00", "comment": "Malware payload (Mirai)", "value": "b595754af09e457bc7c867f77fdc0307", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957224, "uuid": "b218978f-b2b4-44dd-a74b-81a1f003212e", "comment": "Malware payload (Mirai)", "value": "807885ea01b9f76745f5c6674f643622d0e50c606ec9b0a91b7acf0ab16cc04d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957224, "uuid": "a88b898b-aa11-4971-a100-155f0c923644", "comment": "Malware payload (Mirai)", "value": "caef2b184d4e8cb41884423fecb3974380545906", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957224, "uuid": "09c0e5d2-1d15-4eef-a436-119e699b9e50", "comment": "Malware payload (Mirai)", "value": "51892e3b247dad610ea7ce28ea831b87a9977d122b242abd941a5acc289b4f704a7a12ed49cf6d311b3fbc25339df2e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957224, "uuid": "a57d8c76-0931-493b-beb4-a3529cc54b25", "value": "T11DC32A99F890DE52C6D52679FA5E028C332357B8C3DA7205CD209F34F7E795A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957224, "uuid": "76491c6a-dab1-488a-b44b-566be21a6b97", "value": "3072:3z1ymRPMozi9CuRUQ4g8OwCKcnfdQ/u9hddsWbrf1Dlb:3RrnuRUQ4g8O1Kcn/9hdNr95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785957224, "uuid": "36d372d9-12a4-4cc7-bbdd-2a512cab0a56", "value": 120248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785957224, "uuid": "db544912-88a7-41e7-9e35-c6256c7f8807", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957224, "uuid": "1539f250-f98c-4487-904e-4f5ae92300a9", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2b29b2d-906a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785892363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892363, "uuid": "8c9eaaef-9866-4b68-8425-a90652697a7e", "comment": "Malware payload (Mirai)", "value": "3f659ddc4c4aae7b0fc6fb8428e1063b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892363, "uuid": "2c62ad24-ef4f-4375-8ded-fc362935fea5", "comment": "Malware payload (Mirai)", "value": "808c6fdb337af1c24a141b3a2a1006041575d0bfe260b055a70d003c3806eac6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892363, "uuid": "4c4b2448-9dbf-4650-8cd9-f10774495c00", "comment": "Malware payload (Mirai)", "value": "df2c71afb9d7e020888a551497f8a6dab453bcdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892363, "uuid": "bd31d0e6-0b15-4587-ac8a-9df0c8a14e61", "comment": "Malware payload (Mirai)", "value": "207c82edc84ece1c9eca51d871e10468b63df30ef46687f50a1501462aa7e3d244349bd3bec54366a281219f80b455e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785892363, "uuid": "d7c37988-3567-49e8-8890-923d9e3ffa82", "value": "T17B030A42E651DB06C59272BAFB8E014E37176F68F7EE32359E306FE013825E70939925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785892363, "uuid": "862147c5-575a-4a11-854f-971212513d8d", "value": "768:x5nOr0lyUZ0AbzaFj2cR9D7mRQ4MSiPiyyvFyj7YrTfaKVE/2/:x5nOr0lz0AbzySc72tM9iyyvgnYrK2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785892363, "uuid": "a0bc91b8-6929-4f21-803e-10a9b2f7d63d", "value": 40440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785892363, "uuid": "41420bde-3b62-4237-9671-9bdf75801241", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785892363, "uuid": "13bc15bc-302a-4f4d-ae48-6282359899c4", "value": "main.armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735eac68-90cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785934750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934750, "uuid": "952091ff-e325-4fa0-8001-3c9d1e76b23f", "comment": "Malware payload (AgentTesla)", "value": "764f09821ee25bc9b5367d2c2947c923", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934750, "uuid": "a186017d-9316-45d4-bab5-ef8c6f8bdd5a", "comment": "Malware payload (AgentTesla)", "value": "80bae48ad49efa13dff36a0e5bfb132a3438e40fd922cc26bec53baee9eb5127", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934750, "uuid": "2d518751-6a44-4f4f-8cd7-f7909e14a2b9", "comment": "Malware payload (AgentTesla)", "value": "7549acc7e4f825bcc337f07dc4880c02a7e9409e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934750, "uuid": "61ceeb1b-ae95-4d14-8a22-70256c5c9c21", "comment": "Malware payload (AgentTesla)", "value": "4ae2d597e635ef4c4b5d85adc9570a73762ff01ba87eb79e5839620a6a9c0237f6c253254ed0e8d344653a1a62b43831", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934750, "uuid": "e8dee4f4-4d77-4e48-b37d-5b82fa91de98", "value": "T122E508A11B8895B27720BBAD523AEE35AA0FE05329C1DF00755DE704361CE8F635CED6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934750, "uuid": "09028253-44ff-4b99-93cf-1e9f0c3b2c3f", "value": "49152:nA3nV0Cz2ik8MBnAlnu3AnOernwWOxd+Zk17VYQMUmsdMmRc80qnHAjASU3FRRCR:A3nV082XNBnA6AnRrwlwZk17VtMUHdMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785934750, "uuid": "9e71ae11-3fc3-41d9-a170-1eab5b2ec7f5", "value": 3023570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785934750, "uuid": "4771895a-6ac9-453a-b63e-055cf32e3649", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934750, "uuid": "4780ab6b-c1e2-4156-91f9-2d7fb32989d4", "value": "SOAKAX 260716.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b628a342-90fb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785954619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954619, "uuid": "997be333-9d31-4668-b1f5-b97e9e1673ba", "comment": "Malware payload", "value": "256f604660f12838ead8cee0bff910a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954619, "uuid": "9f1bcbac-3676-4966-a016-3fe0be1f93ff", "comment": "Malware payload", "value": "811a78a2b70523552e1de0e6f85cae81a578b627e41a386c94693f0ee049c5c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954619, "uuid": "60334619-2c00-4262-90a9-285450f31b4c", "comment": "Malware payload", "value": "a702b4727ab713721e93f5aa8c104b189494da27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954619, "uuid": "5e41bd28-8a30-45d4-9592-7ec937d0472a", "comment": "Malware payload", "value": "9fb9c968a9fed3b9e91487e68ce2cdb1617d509c4ebbe9c0c44a7d463ec2daddf9c80723e613da0bffa621b02f00eb39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954619, "uuid": "c79d0da4-d2f3-45c7-b5ca-ebe31f607294", "value": "T13BE50957E49550E4C0EED174C726A223BEB13899073437E36FA196B11F26FE4AABC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954619, "uuid": "0bba9e7d-715c-406f-bf15-de4ab7289320", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQN:cqYUQuVDt0TN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954619, "uuid": "b8ee91d2-dbaf-4511-b718-cb1e42864125", "value": 3276800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954619, "uuid": "52221d2e-4243-4ce9-8e20-e627f0abb044", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954619, "uuid": "ed7038c8-71b4-44f3-ba20-549820aafa51", "value": "811a78a2b70523552e1de0e6f85cae81a578b627e41a386c94693f0ee049c5c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226e4632-90cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1785934614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934614, "uuid": "0d9ee4bc-27f9-440c-b29d-707fb9ef55ed", "comment": "Malware payload (AsyncRAT)", "value": "9140d3c4a064bb256658ca190dd93fe3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934614, "uuid": "6da381de-32e0-4200-a00e-761e6e99c9c5", "comment": "Malware payload (AsyncRAT)", "value": "8139e9db56741ac6fa5ee0749286ac3113a2e6d3af412caad59c0adf6e51e307", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934614, "uuid": "194c8fa4-2fe8-47df-98f8-cdd278b03899", "comment": "Malware payload (AsyncRAT)", "value": "f21955956f4cee04da94dacf045f61e9412ea3fe", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934614, "uuid": "a1637332-bdbb-4b92-bfb8-568019921a71", "comment": "Malware payload (AsyncRAT)", "value": "0b03c2c54a4bd740a3139d86e914cd765b841434cca51005123d74e45780e12d65967fb38bea466d9b73763fa6e8d036", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934614, "uuid": "0e1f28da-a576-4dec-a2f1-3ab9506d336a", "value": "T15A149F10F580913432D3BE7A411EE6DE63235BB416D5B8EA9210FF895DA1EA1C7336F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934614, "uuid": "1b199f7a-3781-4a20-9cbf-e7edcf1aa50f", "value": "3072:6NaA304pWy9hJz306nEpJtzzZv3d2VWH0kAYQh+al7kRNTH9:6gbQbz3JEpJtB0h8Td", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785934614, "uuid": "b96e7233-e05f-4b9a-b55f-64939f15c232", "value": 207100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785934614, "uuid": "ecfcc92a-4f47-419b-baec-daf878bc574c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934614, "uuid": "806da2b9-cc17-4851-b083-304e0d0c5674", "value": "dcDiBBVZWJ.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f9753d-9093-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785909927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909927, "uuid": "0f81410f-d418-4712-8c23-0d3d01eb0f7c", "comment": "Malware payload (Mirai)", "value": "facd0d7cc77d255ce12e5939817af8ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909927, "uuid": "ceea1794-0a2f-43bf-bc1f-7628cb194ecc", "comment": "Malware payload (Mirai)", "value": "81962dbb7118f5b588f9e00f4e11e1842589d54857b861c8e8e9ef15e992a1cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909927, "uuid": "a4cd5457-e81f-4609-bdaa-96b7355f0b73", "comment": "Malware payload (Mirai)", "value": "ee47f695775afc1548b7f469ac5c8725dddcd6de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909927, "uuid": "c5155862-de72-4215-be23-513909efdf7f", "comment": "Malware payload (Mirai)", "value": "9306184114cf8a26fcb72062a1f666fb60b3887447fc5ee786d9e6dfaafd0a2655c7aed06bfb5021c8d96bed227e746f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909927, "uuid": "b04a7dc9-ab6f-4767-8b91-f8542e11c5be", "value": "T1C3F44B02EF445FEBC46ECD70893DC30715FDA9C752C5667A71FC8A8CBA9925A0AD3488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909927, "uuid": "0f3d6210-b231-46e2-94bc-77aafacd798c", "value": "12288:92X5S1+YnjHHz5powG1+hIiAQcpmKXfB/E89jn0uPiMTtM1VNJe9NA9c/rv+Anjk:H9/ZW5ZLUPgIzG6SlDOiJElHVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785909927, "uuid": "fa976181-5480-4473-abe5-daf1aeebf47c", "value": 734056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785909927, "uuid": "3eacb15c-1f18-49a1-a8ec-4488081c6fa9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909927, "uuid": "08f5fd88-d355-41a8-89b1-f504c535dff1", "value": "xd.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e8450c-90d1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785936415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936415, "uuid": "11fdc7d5-f72a-42a9-845c-f68af9a1e97d", "comment": "Malware payload (Mirai)", "value": "ac1b52b71229469fa2a87ea8a11db607", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936415, "uuid": "dc3362ff-1c10-41f4-b8db-1551049aaf9c", "comment": "Malware payload (Mirai)", "value": "81ea2a392b6d71c7cd381f48ebffb992457a1d3897d1484a3fd7823f2e9f69a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936415, "uuid": "8da094e2-da31-46bf-8a27-9e3ed3cb7dbb", "comment": "Malware payload (Mirai)", "value": "537a491b49e4689c71f9d29e491bc69ff7a55359", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936415, "uuid": "6cd8302e-60ae-4f3e-8502-24d444a334dc", "comment": "Malware payload (Mirai)", "value": "040c229fcc3981422ea804f696212228c7f70e7bfc2df808bacf5b4bdf73e6a3d0b269db74135ec1a90d2a016e3ce3e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936415, "uuid": "0a19b6fd-9e86-4e05-9ada-217cf3db0cce", "value": "T196F49F88E2F2F7CEE198E9352205BC065D62863731D37789724BA5B3317A1754BF8B60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936415, "uuid": "4074f9a3-d743-47bf-83d3-386a0f8af672", "value": "12288:x4xXFvRgupko1XXNaoULyQu4wC5iizYFz0T9aLfAEHa9Ss8ptX1y:uRKoFLPQsZizYFz0rwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785936415, "uuid": "b67ce14a-284e-46a5-b6b9-bf58fc8e307b", "value": 727832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785936415, "uuid": "e79d33d8-a847-4b46-8201-7fa057634e7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936415, "uuid": "3907ea0e-e493-4597-9924-c38ce609fa75", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c4e0cb-90a9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785919455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785919455, "uuid": "e7a398e2-e67c-4066-97c8-416a304a3405", "comment": "Malware payload", "value": "49316dcf482517292531bf040e732b54", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785919455, "uuid": "57308478-b748-4dc8-8393-93a9f8b876d7", "comment": "Malware payload", "value": "8250a70c59f1cffd6332014b3567d6fb0c98727819b93fca3a4b4a6abc53f8f8", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785919455, "uuid": "d63d355c-224d-4818-a132-68f4afb6214f", "comment": "Malware payload", "value": "9b4ed436496d1f1e5d1fc7a52715c03a606a73fa", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785919455, "uuid": "574b3ab9-7fc8-4bca-a334-696f3cd75dd6", "comment": "Malware payload", "value": "056a472b5786f81a95168ceb9efb0c38e727717f924cf7b9176e424b38f34a0c16418df47ee6852a7e6c4329bb7741b8", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785919455, "uuid": "28013ed4-ea73-4b3f-a6dd-962c6427a4b0", "value": "T1A574DB34ADEA902A71B3AE5D8ED475ABE95FB663361ED849008303474B539C1DDC233E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785919455, "uuid": "7c48733b-c2f8-4166-a5de-b87a4d688791", "value": "6144:zGYNozNZwfF8TBYPSZSfq9ftY4d/nZewVyKwTpF:zLoz6FWBYPkSfefi4d/nZeiyv9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785919455, "uuid": "22a51682-03f8-4ae1-a662-e3fa1fd72576", "value": 350598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785919455, "uuid": "381dd737-f61c-4a24-ae47-ae13577a11c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785919455, "uuid": "3dbd3e5d-3c64-46ae-adf0-6dfb0c12922d", "value": "Specifications.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac3a1b5-907b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785899356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785899356, "uuid": "bdbdd245-20b1-438a-a62b-7f04520373a4", "comment": "Malware payload", "value": "ab7ef4f6f862458c6343e0d25553b5e1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785899356, "uuid": "19f35230-dd18-4db2-aec1-2152ac6ac3e0", "comment": "Malware payload", "value": "834e241f797dc0f4886cfdd0b2ef6e6fbbb510d2ab5d481fbe55fedb63fd7b21", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785899356, "uuid": "3a5fd747-0dbe-4b05-9b5e-d8915adc0a5b", "comment": "Malware payload", "value": "1f59e8587afe235e5b84f80e074b486352638700", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785899356, "uuid": "ee908e20-127a-4093-b887-f2852f31ed00", "comment": "Malware payload", "value": "747ee9647613d59ed3d6018a8ec875dce00041d312adfb2cbe841947d781f788b78abb318abb9c496f987c50aae506a4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785899356, "uuid": "d9f3316f-fa81-49f1-889d-e466de53cce3", "value": "T15901AFF5A49289353F29CB37B6095985F901142B18B52689B10C9A715F3C9742259F33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785899356, "uuid": "47bc2655-ddfb-4515-b8d0-7c70dc489208", "value": "24:uem9jWhjWg5jWJFr7jS/Y7YLaWcfXsvofYOfHY1IYpYsYlRv:uT9j8jZ5jsnjS/IWcfXffnPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785899356, "uuid": "bf7f1159-fea7-4330-93fd-856379220b16", "value": 793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785899356, "uuid": "7993254b-c1fa-427e-b6c9-b841cecc51cc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785899356, "uuid": "f99000b9-c6eb-4429-bf4a-ee74f171ba6b", "value": "netgear", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b10f85-90a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1785916894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916894, "uuid": "c747689e-e506-4c46-b1dc-1464f674f8ff", "comment": "Malware payload (VIPKeylogger)", "value": "7eea01a331c461ce9933ff2555154e82", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916894, "uuid": "d8c8f1d4-1db0-4951-a0b1-46db6c155d8e", "comment": "Malware payload (VIPKeylogger)", "value": "83a3a40fd28756035e1c1467c3181fd0db83405961f140a3f3478cee76de6dd8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916894, "uuid": "81a8bf2a-54d5-4982-a91c-9434d00d0b7f", "comment": "Malware payload (VIPKeylogger)", "value": "bc0be8bde2870ad7195c01eb9dfb469dd17f395a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916894, "uuid": "cf78077f-b57a-4dc2-8676-acd2e74ebe61", "comment": "Malware payload (VIPKeylogger)", "value": "8ceec736fbdf5d5d3db0d0dbc70848130150b449d53c759d1d623b3f6076367b8c40459f6a25638373abfb28cf69824a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916894, "uuid": "34186cf0-b948-43d0-8184-4be1ee5f493b", "value": "T110059F983F11C2CC2BE8C641BCDA1BE448711927A791CD93907AF7D9076A6BB639CC1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916894, "uuid": "d86d7ec9-69cb-49c3-95db-6636b1645044", "value": "24576:yR3Xg8gCPNw8yLBDRHlmgRhohfcWOqMNa64:4g8nP4VQgRuj64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785916894, "uuid": "508ca5df-8e9f-4932-b8ec-e001f74f5094", "value": 807568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785916894, "uuid": "b1dd31ec-5439-4426-a715-2b7309b2b96d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916894, "uuid": "e3c98f6d-9b06-4891-aed4-9a10ebbad810", "value": "\u0110\u1eb6T H\u00c0NG _GI\u00c1 M\u1edaI_.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4416fdf3-90a1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785915773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915773, "uuid": "817ec245-8604-4a8d-a0de-826168f2f682", "comment": "Malware payload", "value": "0f86c00cb4be89bd807449a3b611a7b3", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915773, "uuid": "cfbb66d9-6a81-480d-b7f2-9bcea9219d21", "comment": "Malware payload", "value": "83ba0872c801fa1703efa222709cc30471ab0eacd375a954b5a66ff87edcfbfe", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915773, "uuid": "92c20131-d466-4153-b240-9e09d5caac4e", "comment": "Malware payload", "value": "3e4d544b85f256a9410f2d37a5af5c8578c922f0", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915773, "uuid": "8def251f-d4ee-452c-bc2e-10160a39bd4f", "comment": "Malware payload", "value": "6dcaf88e7dd9081ac401fcb94a4dc54c8ba8f2a311723812e44fac15e6b6d236a3a84d5c535c78a458d557b738f43731", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915773, "uuid": "6ca5a28e-1450-4e84-afd5-ba97877adf6f", "value": "T1BED312104041B4E9EFFA563B70CCA6B715002E44A9A9D35E6A05FDBD678DC8F234AB8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915773, "uuid": "a0a5dade-63cf-40df-b2c6-9ff5c37bc3f8", "value": "3072:Y1BfIHuR9JEeS4H492ZfzkP8wIsCsM/QJeQrdi:YHnEeS4a2DsqyBrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785915773, "uuid": "e637d7bd-0339-40fe-99ef-f106756120e1", "value": 131491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785915773, "uuid": "702d3376-527c-4197-8c4f-15dcdefcf2e3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915773, "uuid": "de50ec3b-0af8-4906-ae68-86327a46c751", "value": "Simulador agt 2026.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4fae8e5-9103-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785958133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785958133, "uuid": "867476b0-fa23-4c55-9a35-65c1224a0bef", "comment": "Malware payload", "value": "ce922e6d434056d85ca5d482fe07b5ab", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785958133, "uuid": "4f0f6b14-d8b0-4d40-8572-b580e381ec72", "comment": "Malware payload", "value": "841f46b8e84b6f8814a356309ced23a4a6269f351ad7cd50335dadfef2682ade", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785958133, "uuid": "f0ca2548-61ce-4804-a220-94e822774b8f", "comment": "Malware payload", "value": "50576b329a1501c853332dcae4bc36d98329da9b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785958133, "uuid": "e23b3e2a-093e-424f-94ed-bdcac1c63068", "comment": "Malware payload", "value": "ad6cfe662e8cb38a0c3109cd6edad9a346ac54fc04012867116b6e1f7b92820af2366a0562fb62a6582aec76a8d316c7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785958133, "uuid": "66237702-0a99-4fc5-a7fd-fceea7167a47", "value": "T1F8C26D96AA867C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785958133, "uuid": "a7c7ba41-4f0a-4b1f-a7b7-42bcd68805a2", "value": "768:hk8vCB+25j6es8RQ9FYpMSUpi+20qUpi+20YQX:hk8l25JWd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785958133, "uuid": "27d480fb-023e-4dd9-b2ad-f9cb7b82465d", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785958133, "uuid": "b27950ca-9ee2-4ceb-9d76-c5015b8e6530", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785958133, "uuid": "2dbc1ddb-a0a3-48b8-89b3-e09cec95e10b", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6246394-90f1-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785950431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950431, "uuid": "04daffda-08d4-47e7-823f-1b36ad9775c2", "comment": "Malware payload (RemusStealer)", "value": "e8e42a788913d0f97940cb0b2207c9bc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950431, "uuid": "4b7ef994-a2d2-484b-b2dc-072054707641", "comment": "Malware payload (RemusStealer)", "value": "843eec789f90f15c13e6905f36f54c32a0dbf767d9715aef1387d232aa11ab93", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950431, "uuid": "d1764e58-52ce-4784-bc47-e06249178aad", "comment": "Malware payload (RemusStealer)", "value": "a5f3c41ebe0c5df29c82a92a033173a355e91c60", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950431, "uuid": "d9a69894-40a7-4ab1-a996-75f9e434f5c7", "comment": "Malware payload (RemusStealer)", "value": "a0237a9910000d52dab5457d7633494958d414539d8dc33b65a83f2177e73a36ca78f2ee3c4460e0960ce884b7a00598", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX2.file", "colour": "#9FD8B0", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950431, "uuid": "ba72744a-fe6f-41f2-802e-6162eb89f3cd", "value": "T14626332F35211EC0C464D3B36B0CD69A0B7D58B9765AB3C82D1B69AF5E1739D0AF06E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950431, "uuid": "2fb25aec-8140-4f0a-a62f-006ff97e9b9a", "value": "d9c0bfb4053066384ee7484b4c2917f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950431, "uuid": "2d7314e9-7ed5-44b1-9e6c-b846025dd786", "value": "98304:V3pqhtfCamGD0ciGKBS5UMYMxy4BPBbfNoTRxgzmkcLZ+fVt:V3pqjfCaHD0cpXNW8BrkRxYmUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785950431, "uuid": "27e0ab89-cf47-41ae-8766-581281460daa", "value": 4644080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785950431, "uuid": "5f92e19d-89c6-42bc-a342-dc0dcb16929a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950431, "uuid": "9e7e0ef1-610f-4053-b1d5-3f282dc0c74a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fcba033-90b3-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785923550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785923550, "uuid": "e78f2dcb-e111-47be-9207-1b4c95906d0d", "comment": "Malware payload (RemusStealer)", "value": "543cc40cb0be17f918b7c035bd080b78", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785923550, "uuid": "b4afd57d-1db0-4f54-9ea4-70962db25936", "comment": "Malware payload (RemusStealer)", "value": "847d8f4998d22fde37eb76f99b6d91012c42965b741fe2cec453ca5876cdf147", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785923550, "uuid": "a4eea7f8-bdb1-4f62-821f-e69c9121f6f1", "comment": "Malware payload (RemusStealer)", "value": "cf3b18345c00dea9626b0bd27728238baf43daa2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785923550, "uuid": "b405b5ae-780d-4f41-8947-f473051cb234", "comment": "Malware payload (RemusStealer)", "value": "8792bbae68719954da0b7b0e37c4da2a5e0b49c884c8448a893b2cc131c3a3d60e19698a1ba2038e5b2a06cbb666ae9b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785923550, "uuid": "1ffeb728-704d-404f-8467-37637c34f78c", "value": "T17DD55B037D9149E9C0A5A33188775252B774BC498B3533EB2EE0BAB92F727D09E75B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785923550, "uuid": "de61c957-c240-444a-a470-26af2fd85e72", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785923550, "uuid": "036e6e2b-7633-479f-8c4d-315f2e041f9f", "value": "24576:NOikEGdK0TNsce8pJy2rmbOeI5BRNgWPdrc05z33WF2nK9yzrlfJBele5r9Dm78r:NOi7gKMNg822rqVeLeWPS+FFVkWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785923550, "uuid": "eea1aa26-64cb-4b97-bf4a-e08e375e6eea", "value": 2996608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785923550, "uuid": "53c64f61-88a3-43ea-bd70-183dca643a69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785923550, "uuid": "4fc89466-7a99-4931-93dc-89d11e09af6b", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b69fb9-909f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785914806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914806, "uuid": "867e873a-800a-4515-8a69-64c9c286b6b7", "comment": "Malware payload (Mirai)", "value": "a527e8469e775d022f115c757ef429f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914806, "uuid": "7d5cb319-0841-4713-9c7c-90e96244ada6", "comment": "Malware payload (Mirai)", "value": "85a53e328463f0bdd53937585a176b1882ed00c4948025c3c795ed942f134a87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914806, "uuid": "d51248bc-4b95-4266-8596-90fc41a2fe3a", "comment": "Malware payload (Mirai)", "value": "65a08e8052560914684a6dda92aa911d74b8283b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914806, "uuid": "2faeb27a-fac3-42de-8b89-76297068108b", "comment": "Malware payload (Mirai)", "value": "b77a2cf3eba29388480d936b53fe6cf4e7ebabcd347a1f0755d86d24796979e7e1dc21c4e1686201217e29a5f4f2db02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914806, "uuid": "d2dc7ee6-5d0f-41b9-a9fb-34d5df364c48", "value": "T1EF53026AA946A188FFFDC13F080FBA675082D32FF155C4C5CB947A3F47A875D2868921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914806, "uuid": "c6085f2f-ceb8-4364-894a-c1dc5ea6b0c4", "value": "1536:0yMHQ+HXNlzHCa1KrbZNMFLx1ijEY9GwmEOT+nouy8DMj:DMwSNlzJ1Kr/kx1+ZOTeoutDMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785914806, "uuid": "f70aa955-e625-4689-b10b-eeab51a03bf7", "value": 64268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785914806, "uuid": "dc679bd5-143a-4899-88d6-4c038c4f2b40", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914806, "uuid": "42c7016d-1d86-4c02-adaf-ffe0030960b2", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fc6995-90cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785934786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934786, "uuid": "0b82e322-79b8-4335-912d-81297f6bcac4", "comment": "Malware payload (AgentTesla)", "value": "5b4271f6c090034b7c7498fdbc2f0aa2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934786, "uuid": "3901881a-b031-47b2-8126-b9a576b4a1ad", "comment": "Malware payload (AgentTesla)", "value": "86039c48436ab5064a5967fdbed016ef7705c5e79fbf6e414d7bab8515ebceba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934786, "uuid": "cd621cf4-27b2-472e-8253-bde1113da469", "comment": "Malware payload (AgentTesla)", "value": "63b6b5363845811a5c80a42fdbed86f06393647a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934786, "uuid": "cb8c01b0-160a-4ca2-988c-a0eb1c5e0b0c", "comment": "Malware payload (AgentTesla)", "value": "8978adfd96486ab42b076a137515ba87b9d40bfcb90065a5bff453d0feb8db83254e1437fe5abb51e6ded9e29e787939", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934786, "uuid": "2503b6e7-768d-4a23-936b-20d12d8f6258", "value": "T1E6D54A901608EBD2687475BADE0E7FCF6B1EE4236AA1FD417E3E6959928CFC93304444", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934786, "uuid": "f2e4b153-7379-42cf-b6a5-ab92908c97f0", "value": "49152:E/usK6IyMA2SGhdM3QNvUIpy/hSisu3zhE2U5/P/gZ01SMiysZWWh4xmDlBWQKKB:E/usK6I34GhSANvUIYSLu3zh/8QiSMif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785934786, "uuid": "884045a9-c8e0-4c5f-b870-912801381730", "value": 3018106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785934786, "uuid": "2dad636d-2a02-4181-beea-6e774a3194bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934786, "uuid": "f9fe1016-32da-49ae-a905-ca519c42c597", "value": "Sevkiyat Belgeleri..JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a841b0ae-90fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785954166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954166, "uuid": "dba8b2a6-741a-429c-be29-1db8a0a43150", "comment": "Malware payload (Mirai)", "value": "0e0fc9dbecce54ec6a8f1c06ef4dd4f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954166, "uuid": "a7a40f8c-cb0d-4633-9b5f-8ab77f7fdfda", "comment": "Malware payload (Mirai)", "value": "86f28c61145fdec429c12a6529e93254580488322da3be368c3c3da1d7dce16b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954166, "uuid": "a4670a8f-b03a-4870-9469-ed8fcee62cf2", "comment": "Malware payload (Mirai)", "value": "97588051f94e5c0e418928c987739ec0278322a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954166, "uuid": "9192df04-fec0-40c2-9983-ea5ebe7db58e", "comment": "Malware payload (Mirai)", "value": "667f5c0450fba23bbee2f26f07137cc45f5b7f1453ebb61d89f559f15ac67641cf504122a8387096375dbf57b6c97c77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954166, "uuid": "71ca598d-71ad-412c-b7b6-364552c130e8", "value": "T13A734B22BA751D2BC4D4E87A61F30321F2F2478A25ACCA1A7D720D4DBF65A4032577F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954166, "uuid": "a9df7490-08dc-4a70-a290-0c7f3c4f86d3", "value": "1536:nJxSUCuRy82KFEFfktMxQ+tBPznN95YYsP08tu8/1e:JIwaFct0DDNPVSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954166, "uuid": "b274d3ff-5826-4fac-b412-ed22a9fe2790", "value": 78952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954166, "uuid": "638a43c5-a1b2-4f09-a7f0-a56d157e0b0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954166, "uuid": "7fc85b2b-1c3b-44a1-a651-6f6b26ab9ecd", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68106e9c-9093-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785909820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909820, "uuid": "3b59c383-18ec-4800-805c-778a19bdadf9", "comment": "Malware payload (Mirai)", "value": "797f06d7819b9098eb105846bb19c0c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909820, "uuid": "e53e4c71-beaa-4455-aa42-0e76b828edaf", "comment": "Malware payload (Mirai)", "value": "86fa7c3c125361247a86d89a83e4b4cd5e7b1ae18a24b77fd089e913dcb3286d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909820, "uuid": "3a7e5d60-1c75-4825-8137-3e1f51cf8122", "comment": "Malware payload (Mirai)", "value": "972d37d9d1764d83e86c496bfc9f1e5ff7889ce5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909820, "uuid": "3fc5bec1-3325-4d77-8c32-ab3a26a6fa82", "comment": "Malware payload (Mirai)", "value": "64f11fb5b14425f7b07c273cadc5a252db86279f0abea46632af65867e603546cb55d4801c623b26a21319c88d948636", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909820, "uuid": "9373ab2b-803b-40ec-a5b1-251364504a65", "value": "T148C32B99FC90DE52C6D52579FA5E418C332313B8D3DA7206CE209F3477E796E0A3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909820, "uuid": "9857dfd2-1e09-4747-a6c1-a8c926a7ba7f", "value": "3072:zVYbaTroziZTZmUQ4g8O/CBXFrtGEQrNX+spw5mf1Dl:zW+TxZmUQ4g8OKBXF8rNXNqm95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785909820, "uuid": "e4f0a417-54ca-4909-9728-4712d43328fa", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785909820, "uuid": "f5a66aa2-d849-4e39-b4cb-8b0d902bee33", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909820, "uuid": "256b3c40-0503-4064-8da0-a84a1db41a90", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0c985f-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785917690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917690, "uuid": "d3a5cdaa-1716-48a1-b172-18520497230a", "comment": "Malware payload (XWorm)", "value": "a5390aa291718255b0347bbfcd8f6ec5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917690, "uuid": "a4598259-605f-4af8-b20a-56ceb2d99cfb", "comment": "Malware payload (XWorm)", "value": "879dd79d801f244e28d691688434e614a9a871366fe998754cf673ba8fa8496c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917690, "uuid": "af62be09-19b0-4fb3-a2c2-66f61cadf01c", "comment": "Malware payload (XWorm)", "value": "b48e1d4b9b340bd98743ca62fc14cd238a5bcbf4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917690, "uuid": "23415146-0259-4968-8c0d-7513d49b3b00", "comment": "Malware payload (XWorm)", "value": "cded78f9a066d745432a6324c68d0cef8f9e7247a1d01fc7e6ee9adf563208dc9e19d132768906eb3cdebcc9051816a7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917690, "uuid": "ac814300-5055-4a64-a0dc-7ade7b84f7c0", "value": "T157B5C5925B8495B277207BAD52379E349A0FA00359C6EF00352DF704761DF8FA358EEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917690, "uuid": "ce534299-c607-4787-a398-9aad0d73b19e", "value": "49152:mqBDdvr0059YAZAPtYS/QWArQ9TmxZDZzce2JqZR+KKPXYjU/nP8Y22f+2Rhm7c:m6Ddosn+yIQDrQ9CZDZzIJw+KcYg/nPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917690, "uuid": "751f5cfd-5cbc-48d9-bac1-0cbdfedb4402", "value": 2288114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917690, "uuid": "6451e390-a1f2-4bfa-aa69-03f2d1536ba2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917690, "uuid": "9e40dd8d-4105-4b83-9511-b27eeb24229b", "value": "PO-09809-MQQ-09870-08-2026-SP0987.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0fc2bf1-90fb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785954610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954610, "uuid": "810ab0b8-e1cb-49ba-8518-6679bd6dd7e3", "comment": "Malware payload (Mirai)", "value": "7794af09e062782fb12acf1d89d803db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954610, "uuid": "fcc50ab5-6d1b-45c4-9bb5-b6ff650d4096", "comment": "Malware payload (Mirai)", "value": "87da5dd36a95e1c0acbaff137a56d94a9339fdcf42577974b53fbd6f69c11219", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954610, "uuid": "960eb9ab-ad00-4818-a63c-809aac4ee939", "comment": "Malware payload (Mirai)", "value": "5660b08045688ff8998205dcee282f6375df1667", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954610, "uuid": "0db6f804-7887-482e-ba5e-d2fd48f36f13", "comment": "Malware payload (Mirai)", "value": "ad7196a4dbddb5a0346abbe207c8074aa1340137d0dde287934b55bc101b5d324b90eb82d05ee6fc98cb42d9d89e2260", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954610, "uuid": "6afa9cab-ef31-4b2d-a644-958f7151333c", "value": "T13E2309DAB802AD7CF80FEBBE9557490DF621735550830B2627A7FCA36C721954E12E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954610, "uuid": "ba495ab3-0414-4403-a9ce-241cd2f417dd", "value": "768:e9Xp3/m7Fmae1r0m1ZNNewxdacVLRGfxfbg2bWpBYGUc1RmN8381:eT3/mUa4RwHMLR2xbWYGj1R+83c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954610, "uuid": "3e5bfef4-1833-4e53-bdeb-3b424a2cf5c8", "value": 48588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954610, "uuid": "862b4a3f-1750-4a1a-b774-ac339393c512", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954610, "uuid": "35113ca8-044a-46eb-b2f9-1ea357e6234e", "value": "87da5dd36a95e1c0acbaff137a56d94a9339fdcf42577974b53fbd6f69c11219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f519fb86-90a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785917358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917358, "uuid": "fb8fc36c-a369-43d3-b49d-b49363c88079", "comment": "Malware payload (XWorm)", "value": "023fbb4c04ae73335dfd87218b60b6f6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917358, "uuid": "8f934343-9bd5-4a3b-af63-fac1f0020801", "comment": "Malware payload (XWorm)", "value": "881864db117c28b378a64ef0d287af3563325037c448269d33779e2f7ca946ba", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917358, "uuid": "a3ef9438-2c1a-4383-ac7e-5331cb5cbdfd", "comment": "Malware payload (XWorm)", "value": "3e7f806ffcdd16896d2e6dc6968fb41d59699ca5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917358, "uuid": "7889374a-6b5c-4e6a-b937-bf4ed5ce9335", "comment": "Malware payload (XWorm)", "value": "1e8a15acebee173d89fbcb61f63c66db5842fb9fdbb78ce0305d1af9e32d19948ad74ea4ff9896ab78dd770d04ed5a0f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917358, "uuid": "612eeda5-e5f1-4312-a0c4-1d1c71647dd6", "value": "T1FC23172D148D7FC3A335474B747F9608F6E83C28A25097A87E8745A5E00B21DBF5EB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917358, "uuid": "a06001aa-744b-4624-b62e-ffd35c53c3a5", "value": "768:7Dwn+Yx19dvT8lZPdLkmHrymysUBDlHLhwFxB3dcGRN5F5FFFTj0:be", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917358, "uuid": "171b7c30-27d5-4982-bcf7-9c3c41b54bea", "value": 45742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917358, "uuid": "62df3a64-d6b7-405c-8116-8e881b966370", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917358, "uuid": "0d607238-554e-4cc6-b746-675fbd2034d7", "value": "26080511854E_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abd5360-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1785917582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917582, "uuid": "20eb9007-4fe8-42d9-b825-75d24c9c9f9e", "comment": "Malware payload (PhantomStealer)", "value": "05018dccb10d32234dc932e2869e3e94", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917582, "uuid": "4ff17839-520d-4114-aa6b-d8b0f1560706", "comment": "Malware payload (PhantomStealer)", "value": "88a617ff7a8edc3c57b7f990ad362e905aff798654d0c11484f85b2098010c76", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917582, "uuid": "8a768d7a-f5f5-4605-b075-8b75caa065ae", "comment": "Malware payload (PhantomStealer)", "value": "d329fd31648f433e1efae9b8afa8e4417c015a82", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917582, "uuid": "e146edb6-643f-4b15-9d0d-f5a4c83f687a", "comment": "Malware payload (PhantomStealer)", "value": "602f5dbef8e5ce543e4f3430178e0c26ed0f14c2751b9a5e8852b0cfb99d23d52c173ded5288ac99639e40510d177cae", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917582, "uuid": "a93cc976-d71f-4c3a-985c-ba58f474874c", "value": "T1CDF5F69167449172B720ABAD5237CE35AE0FA00358C1EF19716DE308366DD4FA39CEE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917582, "uuid": "693f0fea-d1f9-4617-a577-dc9374219be3", "value": "98304:jwh1gFjGLCkTBvhQX0+0SDLKnr3R+F47W0Nc5T3wR/ZeR8TpcfM:jmaYNFZQdVD2nrBM47W0N6MwspcfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917582, "uuid": "7ff61d91-e675-46ac-aeae-a4a7a30c255f", "value": 3587704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917582, "uuid": "1d807a2c-967f-4e72-a15f-ff15456f5477", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917582, "uuid": "e178854a-1173-42cd-b17d-a03d9e15dec4", "value": "QUA23236(VAN001)_ASTM36_99380.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2446c27f-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917437, "uuid": "f72f4d31-42e5-46f1-b7d6-db05fd73e77f", "comment": "Malware payload (AgentTesla)", "value": "8f4104ce55a055d1a733559a574147cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917437, "uuid": "60673f5f-82c1-4f47-a0dd-6186de719e28", "comment": "Malware payload (AgentTesla)", "value": "8b0c9df448cc639e5c3c9cb460a2887c9bdaabb3c38417f70d106e22bf81db00", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917437, "uuid": "ad0c774e-2562-4666-a7c8-715b5adfe556", "comment": "Malware payload (AgentTesla)", "value": "14121f49681b348b27908bf4100b737dc92eac53", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917437, "uuid": "45ae7514-b024-4707-bc2f-f4d66abbb98f", "comment": "Malware payload (AgentTesla)", "value": "856168b970bfef7ff61a66089a2d77acb6b914d137a1795ce37e6fd4d5c892e86a2a5c68e7bcff6cad94e2244142fd04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917437, "uuid": "238e1e60-7df0-4200-a712-3d0abb646a45", "value": "T1AEE538902508D7C3B9347A3BDD0E3ECA2F1EE1B75A50FE447B7D9998968CF4A3259408", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917437, "uuid": "cd8430fe-a05f-4ea7-a48c-e2229eb3b2c4", "value": "49152:oQP6Y/mhk11zD9OH8wIA4nDZMRS3ufHlx49YoPKVFM7ux6Qn7fX5p5Q2eD/uB3vK:dP6Y/t11zD9OH8wIXD67H7ffVUupn7fo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917437, "uuid": "bbeb50d6-892f-4bd9-937e-6f1fa5bc838f", "value": 3041778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917437, "uuid": "5307b278-de0f-41aa-b911-47a953b6aa34", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917437, "uuid": "db391dca-ba7a-4212-9324-63d77dfcdcc4", "value": "PICTURE DRAWING DESIGN.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2913f9e7-909d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785914009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914009, "uuid": "92c9179c-dc8e-4c1d-801d-d1f4bc3cb57b", "comment": "Malware payload (Mirai)", "value": "5361f8a30f3deac6a4d2735236fe04b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914009, "uuid": "4d554dad-7478-4c96-81e8-d863f360dce9", "comment": "Malware payload (Mirai)", "value": "8b2911a85ee7395fecc976299ca0df7b90fa8898a86c34db2acaf3574cf7f1ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914009, "uuid": "b64ede17-b591-4749-9cf0-4b7fcf030465", "comment": "Malware payload (Mirai)", "value": "4ce0b7b17ac3858bdaaaa3bc8dfab97b7daca38c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914009, "uuid": "2d976c67-7d22-44c4-8391-42487bc70a94", "comment": "Malware payload (Mirai)", "value": "da179e8f134f6bd126b1894ecb84185edbd70b24984b5b7f5b131cda2c38ee66af2548768770978b9c2c0216dcdcf62c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914009, "uuid": "11259ea5-39c4-4562-9846-bdc09d78a210", "value": "T168F3AF67B34B5050C4E44AF41BCF5BAD292721008E7B99E77C6E723A6A775CB28073E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914009, "uuid": "91e18440-bf99-4825-bdb3-d47eaefb9e78", "value": "3072:5xv5yfUhfN8RtoZnGhTNLhs7LTT+RCQX3XqbpygZCBrWOG4u5Ztq:5pEfUhfW3oMJLi7L+B3a9FCBrY4Atq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785914009, "uuid": "c4153af0-e250-4509-a767-0d3d800a3e8e", "value": 157332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785914009, "uuid": "1780abba-3ba1-4597-ba27-108833ea8c0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914009, "uuid": "2d918759-08ac-4442-9035-f0f50e61bbf0", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077b544b-90a8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785918677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785918677, "uuid": "a33a0f83-d4d7-48e6-af82-8e3b7ac4e2a1", "comment": "Malware payload", "value": "354491ce49773b33b62a812e55b7a999", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785918677, "uuid": "404e9266-0f8f-4f87-8189-24d5d75d3751", "comment": "Malware payload", "value": "8b7997218198711334d7f58d646afe5b6846b493e738dd5fdb25ca5753d1d81a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785918677, "uuid": "d6861ffe-4269-435b-b0fb-59ea6b355e9b", "comment": "Malware payload", "value": "a8a4dc0b9a0b0f7ca2ae9ab8d2fdc1917c49265b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785918677, "uuid": "095a5f95-1790-4ce2-a38a-81ed76c7b11b", "comment": "Malware payload", "value": "9e08d977bacabaa58add215ae6cb6de4f3210cc59b6267d20040473f2c31c88255378947d97460516ba3efc1774f7e34", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785918677, "uuid": "9b082373-0f55-4390-a308-d4d066ae7504", "value": "T11EC27D956A867C44BDC94A3E4CBD2B1D6DF5C3D1224982AC3D8B3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785918677, "uuid": "38032f90-edaf-4cff-a77f-b0e8b28a4174", "value": "768:vK8vCB+25j6es8Rm9FYpMSUpi+20qUpi+20YQX:S8l25JQd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785918677, "uuid": "397d7fa2-4045-4ac7-b5ae-d28dc5242cb5", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785918677, "uuid": "d206653e-ad70-4a3a-ba2b-61960dec85cb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785918677, "uuid": "ab7d60fe-2beb-496f-915f-89a8a591ab7e", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5526321-90d2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785937062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937062, "uuid": "a91952c4-f3f3-4efa-b3ad-7028dbb3463b", "comment": "Malware payload (Prometei)", "value": "c891ecbf6df498206c8a6cc3859a6d85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937062, "uuid": "8a801033-1b57-486c-8781-2f48de0d66ed", "comment": "Malware payload (Prometei)", "value": "8bb7c5f5bbdf9d1738a2304d6741ea3613737c563dd5b876e6a89942fa469e10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937062, "uuid": "0e25cfa7-3722-4ee7-a1b7-717186d3625b", "comment": "Malware payload (Prometei)", "value": "7967b6e33e5b3e1efb0972dc313fd22ffafbf7a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937062, "uuid": "65e8fe22-6b83-475b-88fe-4c1adf93e435", "comment": "Malware payload (Prometei)", "value": "e72e724d0a4538a4dbdd56fa184c4d4c9dd9470665f4a88586644036d4d3fb4ec77ac0c6dbf4128b2689c48d4fb2ddf4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937062, "uuid": "26ffb68d-a695-43d3-b3aa-bc4eb8d6a2bb", "value": "T1D3866C73945224D8E1ADC974D5141612BDB83C8B573863CBBAC476F61BBABE48E78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937062, "uuid": "ee661573-45f4-4f22-b251-70d6cfb5b0bb", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQt:cqYUQuVDt0TZEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785937062, "uuid": "58860a13-8495-4b8f-b62e-855896fae43e", "value": 8388608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785937062, "uuid": "6503b63b-ad83-40ef-a2f7-3da94a8517f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937062, "uuid": "c19a8b0b-c37c-4d1c-b424-e2f20d320499", "value": "8bb7c5f5bbdf9d1738a2304d6741ea3613737c563dd5b876e6a89942fa469e10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca733772-907c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785900107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785900107, "uuid": "27691b4b-91bd-47b4-af64-bdb7bb38d41d", "comment": "Malware payload (Mirai)", "value": "ef1c39c21ac6ea4c7bb99d379f0d85f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785900107, "uuid": "8d257a45-2b22-4745-a2fa-44af26f9c4a9", "comment": "Malware payload (Mirai)", "value": "8beb744ad418cf0304095aead056fde47dcb889ed917b78559c8c0c68dffe581", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785900107, "uuid": "1346c35b-7637-4456-b4ea-e95757bd4524", "comment": "Malware payload (Mirai)", "value": "12f04e1ae2873a32a5fe1df0d6e1fe5840ac573c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785900107, "uuid": "8d3fac5c-7aaa-4445-849f-974b72b30b41", "comment": "Malware payload (Mirai)", "value": "978ff1ad8193c4d25ee6f766fdc6ef2982e0ba28336c51d166c325f837eb3167ef54586218bed7319c57ef7b5e2f4a78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785900107, "uuid": "32e84c24-6283-4f02-b091-c43e25535c84", "value": "T13A430262220A7FD1C5932C7BD37EF188B194A97C52B836B1433902D9D165C5B3BFB542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785900107, "uuid": "63f94caa-5fd8-4188-b659-503f0c21bf6b", "value": "1536:5vL3NHASE8G6gmaSZX/NAdPJW1bsg5MDT3l5fZl:5vDNdEcgAZXlQh2sw+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785900107, "uuid": "40db01ee-c6a2-4fc8-b94f-79653f5600cb", "value": 59324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785900107, "uuid": "2aa74103-0913-48c4-be5b-f13bbd8b676e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785900107, "uuid": "50d128fd-69d6-4d36-8dd2-1598907464be", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b164d3d-9067-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1785890927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785890927, "uuid": "6169e194-486b-48bf-9dba-988aa4fb4e1d", "comment": "Malware payload (Gh0stRAT)", "value": "b3c9d1993a05188c4bce23a34aa1d549", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785890927, "uuid": "fbf0fe95-9c4c-4ad7-9518-a9c73570fa88", "comment": "Malware payload (Gh0stRAT)", "value": "8bf367564afbbc28d3101d21124b5bfc3ec006fb32d4a2ba3fb9ccf1414fad8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785890927, "uuid": "4981493b-8b97-4762-a785-30069873db2d", "comment": "Malware payload (Gh0stRAT)", "value": "e71485853edf523fe5a5fb1d6e3b543b65feb652", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785890927, "uuid": "dff5c634-fffc-46d8-b777-439e57f5021d", "comment": "Malware payload (Gh0stRAT)", "value": "eb7b890bf52fc07d687f989a928242b677f59a373ce613b7396f56c328f03aeb27529ab98a7a0f3a77f90d28eedec4be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785890927, "uuid": "e7b73816-0de0-4b76-8d4d-17608a8aefbc", "value": "T110271223F38D653FD05B3E3D663792A4987B76602D128C57A6FC2A8C4F391801E2A757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785890927, "uuid": "ee998a21-a656-42f9-acb0-41360029fbb1", "value": "d9022e87b984803cdab2208819b430c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785890927, "uuid": "067bba69-7131-4b2f-acdd-cb8bea98157d", "value": "393216:mCyLpUDY1B6aZsxSzbNbgbRi1mrZeaACA8Mf0SiNJzgbWA:MGD4NIoA414enP40iA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785890927, "uuid": "be3bbf60-559f-4180-b1e5-6ff1896f6922", "value": 21356892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785890927, "uuid": "d681e1e9-0e2d-4ef8-b8f4-620ce797be74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785890927, "uuid": "d7858932-3a80-4353-bf25-bff0ad36f56f", "value": "rLobO7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87cfd97f-9072-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785895700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895700, "uuid": "a00c8950-68f0-4eb2-9203-a21b35827209", "comment": "Malware payload", "value": "f0c4e39a002352b4a6344126a3f44ce0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895700, "uuid": "31273e9d-0cf5-4b1e-ad20-0a192cc0e278", "comment": "Malware payload", "value": "8c0495b2595aff4244c1c157a3f2594f12275d776509a6b49224f357b88f4270", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895700, "uuid": "a2657709-5437-490b-a1ef-4317a57a5f1e", "comment": "Malware payload", "value": "0d0311c204f5471f5ed5293116d6d4e4f3842044", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895700, "uuid": "37a16ba7-99f1-4e37-82dc-b9139b3f6c89", "comment": "Malware payload", "value": "43e21ace9df188b6d200cbbd85a44a8ade5cd7e48f275e3c4b62be2c0a608a78bb45da01724bad161b390129b6280e6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785895700, "uuid": "23acd599-4d90-4ca7-96c9-479b918a1cc7", "value": "T146C3123A938CE892045AD9BF61AEBB18045FF8CCD098D6E6EF4D097ECD0032455ED791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785895700, "uuid": "31b45ad9-0af4-4016-819e-6b999030ce50", "value": "3072:3PjvN0zkW4C6ZjJAIXOfCUlYKlFyugtAtoutDN:3jN+kLPJdXS6Kf/LoSDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785895700, "uuid": "de90f8b6-b4b4-4078-bb4e-5dc63574f89b", "value": 120396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785895700, "uuid": "8e028333-8e41-455f-9c5d-eef4d1464837", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785895700, "uuid": "a8c3bec6-bce8-4898-9a05-d3b9068aa11a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a549ca18-90c2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785930109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785930109, "uuid": "3075cb30-63f5-47d5-ae84-e1b78d5a9711", "comment": "Malware payload", "value": "4e39b2dca47b21e1a5054245abdfc87d", "object_relation": "md5", "Tag": [ { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785930109, "uuid": "91c2ce5c-5cbc-4ee3-ad6a-fcfbb52e9193", "comment": "Malware payload", "value": "8c79c09dfe20ea867b1c1ef36ab18bde2343b988b0520e9234692e8d53d0bf39", "object_relation": "sha256", "Tag": [ { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785930109, "uuid": "7108208e-e05b-4e2e-8ec4-35df38a61ca5", "comment": "Malware payload", "value": "17322a3dcad64ff3e84e5a570e980b398c213182", "object_relation": "sha1", "Tag": [ { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785930109, "uuid": "21e3198b-b7db-49bf-8088-502711fce178", "comment": "Malware payload", "value": "060c103af9e13e4151a826f8c1e74aed127c46973d33618fa43f82d7ec725657c897a7b884279ac877609b0c045d1923", "object_relation": "sha3-384", "Tag": [ { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785930109, "uuid": "9ee3a124-3cd6-4d6c-a52a-0cbd297f94e7", "value": "T1D816339BD1EFB4F5F8BB10288AD119D183B60073DBC31A2B59D14AE790E0EC5A177A4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785930109, "uuid": "11b66f65-28ab-4840-a8de-e3902e799436", "value": "98304:hO3vV//YLFzke/PTeahQLxXrKM6iX06Xrg18sb7bEU8oDEzYK0aBfy4pa:hO3viLX/PTeahQsMJp72lb7bEtRzLja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785930109, "uuid": "69f8c993-6838-4222-a725-33cb955806f6", "value": 4104717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785930109, "uuid": "9d26ed1b-d80a-4886-a668-cbdf82e6360b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785930109, "uuid": "cf5a8ce1-db34-42c5-a02f-966bd6a4c081", "value": "pfbofa.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a56b52-90ab-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785920015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785920015, "uuid": "598ab225-ca2e-4a6d-baad-0ad28d3d4e78", "comment": "Malware payload", "value": "b04932f8906e68fae9425211b92b70e5", "object_relation": "md5", "Tag": [ { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785920015, "uuid": "2cf1aeb7-7547-4f71-9d93-b9dda287af84", "comment": "Malware payload", "value": "8db6490330bba0c5cfbb1700025b19ea15435ad3ade60ba15f0548584daae0f8", "object_relation": "sha256", "Tag": [ { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785920015, "uuid": "edc4abdc-3afa-4f15-884a-909e4a49042c", "comment": "Malware payload", "value": "c57bd34a5759f0ccc8ca989abfaddad128eee71f", "object_relation": "sha1", "Tag": [ { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785920015, "uuid": "8d2151af-b8d2-46a9-99ec-0136ea52d91e", "comment": "Malware payload", "value": "97952152dbaa91b75c9ab6770a4dc0ecdfbe510e70782bbbb9a068eb4e31cf4d7909396df074a43d6074e9266ddac1b6", "object_relation": "sha3-384", "Tag": [ { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "java", "colour": "#C72829", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785920015, "uuid": "cd83bf26-2be3-4bf8-82c2-5775806ddab5", "value": "T1DE47231EFDDECD28D85760B259C2C157E0A912D9E82A802F16A849855D31ECA13F3FFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785920015, "uuid": "0b43c5b8-646b-4deb-b4a9-c85885a1a841", "value": "786432:nOkr2cdCoSClNDpPKxeKwt2jP0CZIkPJsGH:nOkiwR5lNDExTP0CL6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785920015, "uuid": "0d68521f-069a-422b-bfce-ea76d18e2ac5", "value": 26779174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785920015, "uuid": "61cce2a0-6db8-4f95-870e-86fd74d2f3d3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785920015, "uuid": "69bb1a76-4a1b-4ea5-92b9-0a9635c92db5", "value": "29220745597d.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c3e03b-9091-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785909147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909147, "uuid": "eba191da-9be8-4ce8-a429-3ab65003af89", "comment": "Malware payload (Efimer)", "value": "ea85b1af552ef9391c0fd090c3653da7", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909147, "uuid": "6ed5922b-b6a0-46e8-9720-2fe6bd7bb6ff", "comment": "Malware payload (Efimer)", "value": "8dfcca93187f9495fdd02d155711b5c701e6e3fcd8a3f9851f2ab6b517a5162b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909147, "uuid": "de809cd9-6c4c-4fa1-8ce6-fc09c9a240a1", "comment": "Malware payload (Efimer)", "value": "a8e5b725759f6a5702969325cf51266278d6659f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909147, "uuid": "ec72a849-55cb-4fe1-bfce-f90c9fe185cb", "comment": "Malware payload (Efimer)", "value": "232a955ff92318b5b731be1e97e961a5832df23713db7bf2335ab5bfabc13b5bb872448f9394c13a0ffe3bdb18ca27cf", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909147, "uuid": "8d68d854-23c4-4a46-8164-1336fa216f42", "value": "T17CE6331CA7C101B8EBB3947D8FE115A1F274F8262376C5EB87E846956C575F04A3E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909147, "uuid": "b653a654-05a4-4a00-8ced-61bef552090d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909147, "uuid": "6b5e2581-2771-47ce-a1da-e08724789582", "value": "393216:jGmf7Zb3+iQbqUmspUbX0O+XMCHWUjJcuI3/PGTAI:jGwZjC+UNUAO+XMb8+H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785909147, "uuid": "c4e4d0ae-2342-4371-88f5-0bcbaa5b9dfc", "value": 14289067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785909147, "uuid": "3d422cff-356e-475d-aedb-e6413249502a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909147, "uuid": "cf51c42d-fcae-41f2-927e-8ac292c5137f", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27887c3-9095-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785910884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910884, "uuid": "74fa1b53-815c-4c9e-bc64-8e0f5d8a59d5", "comment": "Malware payload", "value": "c424441c5abd38bb8243d50657c9e36c", "object_relation": "md5", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910884, "uuid": "e80e6c48-9005-47e4-9ceb-9e16ba7148d8", "comment": "Malware payload", "value": "8f600bf37f7bd371953fb0f708c2182d94fd3ea077da9840a01f1f75d7257ec0", "object_relation": "sha256", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910884, "uuid": "91ae7d19-83cc-43d9-8df7-8c3545f8976d", "comment": "Malware payload", "value": "2d4ade3151d19855f94156b38b30d9e89801dfbd", "object_relation": "sha1", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910884, "uuid": "a3614d45-da0b-4858-8a62-ef3dd603c8c2", "comment": "Malware payload", "value": "87798a23128f8c7ea61c96fff29f96eb12f4e9a54522993aa0d61a2bba1d5f25dc78986d9e030147f4fd46aafff82b9b", "object_relation": "sha3-384", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910884, "uuid": "4389d0c8-e438-475e-9697-1688e26b06de", "value": "T130E5239DBCD63971F032C7B7429760FEB1263B85CA658D4E32C86B506E529187C3B34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910884, "uuid": "a604919d-843c-488e-9984-a267c78fdaf3", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910884, "uuid": "5c66bf73-7740-4487-b28a-07197f82eb1d", "value": "49152:6RqbaRSF2s3DUH5L23uibpeqYh/T5+PtCvQw7yTztt5d4Qa9UXGoCu:2qbaRStDBb8baC/76fr4Ty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785910884, "uuid": "18d176aa-cda7-4a69-a8df-58dcdc93c618", "value": 3032576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785910884, "uuid": "b89353bd-5ce3-40a5-9723-b3be67adf80a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910884, "uuid": "d0f0c3e7-9cf6-4bfd-b7cc-1ff5fbc76f6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc31310-90dd-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785941851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785941851, "uuid": "c9ae7f21-59db-4848-b3e1-c262ae5d5746", "comment": "Malware payload (SalatStealer)", "value": "de765528fd27dcd5790505b9bc3f8aa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785941851, "uuid": "3364751a-f3b0-4845-9764-24a2d9c955fd", "comment": "Malware payload (SalatStealer)", "value": "90343ace902ceacf427956a7ce2986dd0e8d3caaf7a7e5e3e0d5534f6c65043b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785941851, "uuid": "674f3973-4ac0-498c-b05a-bc1ddf9a92fb", "comment": "Malware payload (SalatStealer)", "value": "7652586d3e7dcbb4fe86aad246666e15d5fb2ce3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785941851, "uuid": "714af315-00a5-4a43-b9f8-9931ce2ffb05", "comment": "Malware payload (SalatStealer)", "value": "6428039a978ca55957e00b8c0365cf65dcd11bde9a07517b9133f6a66a056ce3c6f72e4e4ebe1541fdbe5a56f19ae1ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalPack", "colour": "#AAEFE8", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785941851, "uuid": "3346a0b7-a5c8-4ace-8ee0-53006530dd97", "value": "T1DAF533B8FC6D5C4AC63143701C3FEA77F9124F8A5A10D9DE9CAEBEB1DA051B522D9060", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785941851, "uuid": "24245eba-e1db-4a9c-b1f2-11b21681d3de", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785941851, "uuid": "09f37181-6bd7-478b-8e01-b9cf42adfd81", "value": "98304:6i5MCleb18SSNWm6POt1TQv3/7GRcEk+zw6:PaC+18bIOtW3/q7k3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785941851, "uuid": "ae610d61-4fe0-48b5-bdc0-0997ba33f93b", "value": 3593216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785941851, "uuid": "a9c78100-9061-419f-92f3-08f645da03ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785941851, "uuid": "e6a39aee-d769-4e18-8fe9-eb6047c95c31", "value": "90343ace902ceacf427956a7ce2986dd0e8d3caaf7a7e5e3e0d5534f6c65043b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f09465-9099-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785912420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912420, "uuid": "bcb6992b-7abd-4d66-ac2e-d04a2ab7c194", "comment": "Malware payload (Mirai)", "value": "b415a9a0be29a1eb4a86d8f7cd3dda62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912420, "uuid": "60ca1192-33b2-42d6-887b-48e878c5f638", "comment": "Malware payload (Mirai)", "value": "90ad629243dacbc20cdb1ca08ecb79361e9d278a851b2f3662dc0f1921976c60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912420, "uuid": "c44f7422-aaef-4e77-a37f-e6545c24f419", "comment": "Malware payload (Mirai)", "value": "92faa322e30958e8796f7c3ceeb33d1a92897b1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912420, "uuid": "bfcfd24e-d15a-4180-b34a-a4de9232d846", "comment": "Malware payload (Mirai)", "value": "d9aac643b9add3f511ade130b95ecce8f4baf3813b887e8e147836fbb8f506467357bdc74e667f71591c74ea235d5c9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912420, "uuid": "87324a70-5f0d-4ae4-9f2e-a06025bcb069", "value": "T17E4301719AC5AF6FC4B014732C3AC2C3390DC9F45A1B75A1A424848CFBA671F6259FB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912420, "uuid": "c886e60c-0baf-427a-9280-6a390d5fd9fd", "value": "1536:y4Yr8Djj7DzqhYZm7ztjmE0Y1ns8gDiROGqUfa:djfqgmXBm7IDZReUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785912420, "uuid": "e4919bdc-e7a6-46f1-8bec-db9b1247c699", "value": 59348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785912420, "uuid": "dc889c4b-ad00-4150-80a1-dbd7d2977c7a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912420, "uuid": "356f3772-509a-4eb8-89d2-e17c7b90b6e7", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be130ca-90a6-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1785917853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917853, "uuid": "2beaf676-5296-4d4d-bc96-7e7563ff682a", "comment": "Malware payload (njrat)", "value": "d073a91ea2a0760a76e642f6d9ac141d", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917853, "uuid": "0958b26d-f2ee-4868-a3b3-a929bb3b7cb7", "comment": "Malware payload (njrat)", "value": "912667faa8f9502abd2f34372cb25e206ceb1983b145b491bb47d034c6061924", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917853, "uuid": "a8c6cd66-c382-4d5e-a850-fc0b762cb410", "comment": "Malware payload (njrat)", "value": "c19a4053ff20126024c56b51cb07bcdaed6aeb05", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917853, "uuid": "ced16d61-267f-4104-937a-105a9de0134d", "comment": "Malware payload (njrat)", "value": "3bcdd4395e6b2685c4d6dcb3286348fa4a31975de50ab830c34f248961fd1299b8d4adb7f7b4e24a33cbb949636a1cf9", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917853, "uuid": "e31a65b9-4969-4c14-934d-8a5b7e3cfeb4", "value": "T134151D5B31E1DB2AA04A13DA1F6CA28840FFB86FE4699E7071E256B7720C44C7711BF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917853, "uuid": "c6112c5d-5c8c-48e2-b666-df69ae7398d6", "value": "6144:7jWQ8+9sk5xQtbVkHA3pZPpYIlc/QuveQiBtt5B5l8wNqBE78VBQ+oe/cu80z6VO:N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917853, "uuid": "48e70aeb-7f03-46c3-90b3-d2b100e0b710", "value": 956238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917853, "uuid": "6383a457-2d09-4053-9584-a1e6992b2f5b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917853, "uuid": "5244dd21-873a-47cf-9c09-f54d4158e0a9", "value": "BANK DETAILS FOR PAYMENT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a9f791-9082-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785902723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785902723, "uuid": "7e0a038d-f4c2-4e40-859e-b5805f005907", "comment": "Malware payload (Mirai)", "value": "e5ec609a9b55791ff3c06948b285be34", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785902723, "uuid": "f80d9429-e0d4-4f99-8153-afc3f4b7d220", "comment": "Malware payload (Mirai)", "value": "913738ca6e5e394e41a9a243e07d7864bf4073fa6abbc780bc0d5c3fd0c4ab28", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785902723, "uuid": "3a503fd4-ef55-43e4-b525-67bf64fdbb6e", "comment": "Malware payload (Mirai)", "value": "fa085d032972f145bd2b521cf42137e5cf9dd4e9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785902723, "uuid": "38358dae-0dbb-4ba8-88a4-38615a30723b", "comment": "Malware payload (Mirai)", "value": "9541d1dad0e9a3b01a63cf5bf9331230536cd398ced51730b96450dde2de69cb1d7917c7b686fbdbee6c0541b0f85add", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785902723, "uuid": "5847344c-d394-4936-bc51-b8ceaed34ea2", "value": "T14601A18926452972CFEC9B1CB8534CF0E08933C9E4D3067894A67CAA1D95B2CBD0BD0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785902723, "uuid": "dbfff273-3fdf-41af-a37e-0cab1edb474b", "value": "12:mSp4RaDKkJQBsUXpIvRffiFl3zUzE1tjhISZBsr:Sa/Qq7yFxdhBqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785902723, "uuid": "464b1ef1-5ed4-401f-8459-3034cdf2c58b", "value": 802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785902723, "uuid": "aa491461-4773-476c-90d9-0b2b93b33232", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785902723, "uuid": "e398d3cd-b276-4a47-a2d0-e0ce279b64c2", "value": "exodus.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73367ab7-9089-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1785905544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905544, "uuid": "de9efc21-5498-4270-b42e-ef55702c0f3a", "comment": "Malware payload (MassLogger)", "value": "2a906ab5f23cfbf3373bcfa4472ef296", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905544, "uuid": "2730f4fa-1d2f-4f63-bd23-5e75bd8865de", "comment": "Malware payload (MassLogger)", "value": "918ef143a0fc3452fd12112b8df69fc7a64ecbe2644e755adabece5e37a8833c", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905544, "uuid": "3cf4b549-6d6f-488b-a0ee-5f27bd4b9872", "comment": "Malware payload (MassLogger)", "value": "c9ff044985e5a300c663e0e4594919e2fe4406a1", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905544, "uuid": "b1e103d3-c9cc-4df4-8dea-b6dced640610", "comment": "Malware payload (MassLogger)", "value": "13a5b64d274c9a5557c22851c8d947d7598d7c94aace1fe6888d77251199d3ea30c054b4d76e67c9ee733b7d1c9b3159", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905544, "uuid": "9681ad4a-f282-4ae5-99a1-4d7107aec1df", "value": "T1497538283DFB902A71B3EE558ED479EBDA5FB7B33B0654691090034A4B13941EDC263E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905544, "uuid": "87b54629-68b3-4a5f-a0ea-1d87a4d50bc4", "value": "12288:2VhvGt6kLUS4yBb683zeejpl8XqdSq0h6p6QZc3AOrLgDkJyHpdOODymvbcW2lIx:66zB05QHDkBPlt2jTKP3KUgKyICsxAaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785905544, "uuid": "f578dc74-e928-4f25-8ae6-59d5312df781", "value": 1609460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785905544, "uuid": "2f83db04-9a66-42e4-9db0-273a4f908df4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905544, "uuid": "9e626a8e-ddd5-4a70-b6db-0a270ac9cd35", "value": "RFQ_983ZPOH0000941.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5c21e8-9070-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785894979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785894979, "uuid": "05e999a9-8065-427f-8b4d-d3308aaf783f", "comment": "Malware payload (Prometei)", "value": "144bb5b02b3b6c4462c7468ac7740fa6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785894979, "uuid": "46480bba-2b09-4f59-884c-33c4989a6fc3", "comment": "Malware payload (Prometei)", "value": "919e2a1a6d1755902e4def4456e6220e9c069efc34d8bfc850f4490a5f88c769", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785894979, "uuid": "24b09f2a-fb0c-4a7b-8e8a-a170507e3a12", "comment": "Malware payload (Prometei)", "value": "c73a9de3ae9f0be76f04d6c3f88f62c4429866e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785894979, "uuid": "4557ae08-f72b-4168-94e9-b58cc9795fe5", "comment": "Malware payload (Prometei)", "value": "b095748126b085b0043e84aca6bf7dec28fc3d105459a124bcb7be9761b4619cfc11ab92cfd9eb6479c06d4d2299db5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785894979, "uuid": "f6b38924-b565-47dd-a7cf-6050a655146d", "value": "T127A423B4F9219E9F6DD769B91B24831DE182C172689D4C1313AE94A34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785894979, "uuid": "062ebeaf-b27b-4e3c-87b4-6938a353af66", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdk:Fs6pyCC/Ya2hpi6T6N4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785894979, "uuid": "78b4901c-7f24-4dea-90eb-77728dee87cb", "value": 449087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785894979, "uuid": "91d292bf-145f-4473-82ff-76e1acef197b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785894979, "uuid": "507c7209-0e12-419d-b5be-9af1bf11b95c", "value": "919e2a1a6d1755902e4def4456e6220e9c069efc34d8bfc850f4490a5f88c769", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed27ecd-90d0-11f1-bd95-42010a9c0009", "comment": "Malware payload (OverlordRAT)", "timestamp": 1785936245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936245, "uuid": "3fb2dda7-61f9-436e-84af-e7ecc9945a6b", "comment": "Malware payload (OverlordRAT)", "value": "d4ecae7fa56d43b1629e963c1d7eaee7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936245, "uuid": "4838f68a-9ba9-45b4-8fd6-8d7da4636280", "comment": "Malware payload (OverlordRAT)", "value": "920f6d5e4fea636959543da0e7f629c045dd4c922d39db887bcf3fdb141cbc53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936245, "uuid": "6d336202-4045-4790-a8eb-73e4d8968ab5", "comment": "Malware payload (OverlordRAT)", "value": "7ef02987ac4907eac9882eccddfff37875dd2926", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936245, "uuid": "b66a68ab-aacf-4acc-830e-1b99733fefaa", "comment": "Malware payload (OverlordRAT)", "value": "c173e1dd92d0acb6f94a0a43cb6599b19f53511a05a50319a70e95b55be72aab122a73c26fa24ae5edac3b056c2bb58e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936245, "uuid": "2bbdd349-4fa6-45db-b2cb-992c38118997", "value": "T178073308D7EB6510E4A44FF044A0134F0A3EBDEA52A5468F74EEF1679632BD426F1B2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936245, "uuid": "3c83a701-8b9e-42dc-a0af-3ea297bb463b", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936245, "uuid": "1d772771-7fa5-4046-8280-41704449736c", "value": "196608:aeCEW2OnF0VphOaivVZkHTNt62bRqxFQW03SwNqlcstFFdmzhuyGJfi5XTJohMIq:aXEW2mFShQa02MHQd3+lc2fT6IG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785936245, "uuid": "da58176f-0538-4be3-81d7-85f661a313f5", "value": 18247680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785936245, "uuid": "708ea0ba-dd23-46f9-9592-6ed18725d9fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936245, "uuid": "5a76eb1d-fa95-4e29-b9ff-e1285ba91cf0", "value": "920f6d5e4fea636959543da0e7f629c045dd4c922d39db887bcf3fdb141cbc53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ee00c3-9094-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785910347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910347, "uuid": "47e1f2a5-d590-4662-a388-78d7c62680fc", "comment": "Malware payload (Mirai)", "value": "c5202bcf8cafd31860c9b70322c721f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910347, "uuid": "f02474b9-afb2-4fd6-b85c-8e01ed9c1446", "comment": "Malware payload (Mirai)", "value": "922023eb78204f41de600ab77d634bcccf2bb09a7dbacd95645722f76f698ed7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910347, "uuid": "d2e7ced3-1eeb-4828-a682-796e0b8a9a25", "comment": "Malware payload (Mirai)", "value": "a48cfb8f189e9aa594802701139bc13a6022dc9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910347, "uuid": "6f8b69ef-ef46-45e7-9991-700f0d97c316", "comment": "Malware payload (Mirai)", "value": "666c185044a5d694fa4cea4b33b383adb5baa629c98e4bdc631f387d872fa2dc23352684f1efb7dc3b0b929e9fbc88b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910347, "uuid": "477b36ca-1b7d-400c-90aa-7fa9201707fa", "value": "T1C56302CCB3A6A864FDED71F124EAE4C0AFC2051DA9964F55818218B9D3CB702B315B9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910347, "uuid": "a9184e70-f393-4765-95c3-0855e1a84ad1", "value": "1536:ermw1LEji6YOn+1fKeJz2m5FUGmnBlMauiORoOiyEGy4u+qgw0ro:CFtEjdn+1SpGWCpRoSER4u+qgwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785910347, "uuid": "dfbfae8d-6c28-47e7-80a7-ef78ad13e68b", "value": 67608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785910347, "uuid": "864b4e6d-158c-46b7-bd1f-1e5f8907b1b1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910347, "uuid": "4936902f-7d65-4e96-9989-d62ee6c4d8ec", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f9eeb1-90fb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785954597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954597, "uuid": "74d5a7f7-5cec-4ebc-a9fa-aebe14fa0af0", "comment": "Malware payload", "value": "b6a73dd854f67bc095fd301e0432bfdd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954597, "uuid": "46a2690a-2499-4cd6-abfb-ba04904fb405", "comment": "Malware payload", "value": "93297673bc6cdff5c54f9d334f9721ba9639f39e33a99938d4ceaa0d25c28091", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954597, "uuid": "ece018ed-7b1e-4167-b147-2d794f5b32fe", "comment": "Malware payload", "value": "04bd432f542462f046edd35719c747504dccf753", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954597, "uuid": "cf44003a-b2f6-4c75-8350-4319588a3b8d", "comment": "Malware payload", "value": "536adf3961013906ca835c7e231c25f0703c2d84519c22e5208e2360c11b287d44b61ece53086c8ec69c09466f98ea0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954597, "uuid": "24b054e5-be26-4c69-9865-986508e363c5", "value": "T11EC68C73914238D9E5A88DB4D11016526DBC388B5738A3CBBAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954597, "uuid": "22d71730-ad84-4fb7-80b4-c9c17ec10aca", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQI:cqYUQuVDt0TZE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954597, "uuid": "aba8b28c-2e9d-49c1-b7d2-2b0740bb9baf", "value": 12124160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954597, "uuid": "daddac0f-8aa7-440d-a0f6-cadd6ecb5072", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954597, "uuid": "00dcdf4b-ffd7-4f72-8e80-e08fe2954895", "value": "93297673bc6cdff5c54f9d334f9721ba9639f39e33a99938d4ceaa0d25c28091", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94fbd13f-909c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785913761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913761, "uuid": "624d09ad-c1d2-4b66-9db6-d73a65bc96e0", "comment": "Malware payload (Mirai)", "value": "24fef176c17b684f56f3c454a677a58d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913761, "uuid": "944ae24f-c66a-4aa0-9529-ba1c4cc3f43a", "comment": "Malware payload (Mirai)", "value": "93319e1fdba72960c5a4e69f2eb12a15abd755520812d76ceac6f53a576cb8b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913761, "uuid": "b5d229ed-1e6c-4828-b5c4-1e8cd269a221", "comment": "Malware payload (Mirai)", "value": "330a08702b4f4c593ebf4f227210e4d8232b90bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913761, "uuid": "4d48774a-3480-411b-a006-15aacc24cced", "comment": "Malware payload (Mirai)", "value": "20866e5b32137389f3c469a213ff91c28cb4fba52cec046d0eaaa0f17ffdfccca6ea2b89bf12fc934f436a562628d8c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913761, "uuid": "d4815b3e-15ac-441c-be40-4f34d21a142d", "value": "T14F83181ABD409F15D4D526BAFE1E434933532BB8E3EE7212DE146B2527CB91B0F3A406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913761, "uuid": "e5d8ca38-b54f-43f5-a37a-d0222cfe6d7e", "value": "1536:5Cn1+UtiI/E+7i5Tli9NIk3vhtP6Y8YK/6TecQw0ArdllCi610jhb0:+QI/5mMzP6Y8n/6TecQQ9k0jZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785913761, "uuid": "ef9f7b55-713c-4325-a1e9-6013d9b03f48", "value": 85436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785913761, "uuid": "7e69ebf0-768a-401c-87b4-d8b562c286c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913761, "uuid": "2a994436-b921-4e1b-aecb-056500bbd60b", "value": "nW2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a95753-90fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785954053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954053, "uuid": "ccb758d3-ce41-4c8d-80dc-1840db80882d", "comment": "Malware payload (Mirai)", "value": "8262bc0bfd9c434bce89b80091628862", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954053, "uuid": "2acd35b6-268d-40e8-91d8-8dcea9dbf1bd", "comment": "Malware payload (Mirai)", "value": "934d0acf5621f7cab4631eeb91a84d331c26a3c34b06dcda7098a8318249db33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954053, "uuid": "8f49bdfe-22f4-49e5-b236-796012854514", "comment": "Malware payload (Mirai)", "value": "cc9eeef8b86ae9e9a85b22a67d73cacaba44d0af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954053, "uuid": "5ea329e2-197d-4032-ab86-c326717f96d2", "comment": "Malware payload (Mirai)", "value": "14df446ce9c5b6a68d6cc2c6473820cec83f0d00d89bdb7b2c6632ea1f65e4e88dac663d7c64c3a869e7f496215bc48f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954053, "uuid": "9f40b116-190a-4cb0-af27-16cb8de4a4c0", "value": "T17BF2E195C203A726DBDBAC30BEC4C7E273851A0F386BC8D2F8D8DB4185266736846DD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954053, "uuid": "ffefaac9-0deb-4a83-9e62-ec38dfc35070", "value": "768:viO0JN+KwVapoXGVTHu5mwmbBW19j4uVcqgw09R:viO0HwVcoyTHZV8Lj4u+qgw09R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954053, "uuid": "c8ee919e-1183-4f7a-8ef6-1bf53d18f7a8", "value": 34556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954053, "uuid": "5e321798-014b-48fa-bd0d-7853c01dff45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954053, "uuid": "391ea4c8-9b68-4491-bd33-46fbb6f52c31", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6767b4c7-90ff-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785956205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956205, "uuid": "e714d8cc-77b0-4889-ac5e-e1be17fe9678", "comment": "Malware payload (Mirai)", "value": "52399f0e53029d6e664cbd91ad7c2987", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956205, "uuid": "a5df62af-fe68-41ae-a686-82be9b442518", "comment": "Malware payload (Mirai)", "value": "934eebec48d7aaf9ecbb2f2856747ca462a21afc8c47a0b22c5afb15f9d257d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956205, "uuid": "c4027191-b975-44e9-a225-b62211a13c32", "comment": "Malware payload (Mirai)", "value": "723a71343cfcebeacfc4c5d33dd91a45dcecd1bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956205, "uuid": "aad5e985-9081-4a5a-b95f-ed2d4360c201", "comment": "Malware payload (Mirai)", "value": "2bc357521afaae208d2d1f920cc730be9150315a8f1c2951aebdcfe25c60c620b5fc69361150ba5b78eb6c6935c5c278", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956205, "uuid": "f6dcb982-51e1-4969-8684-e7832c2f54a2", "value": "T18463022A08034CD2EA5DB57D31104B66CD395BB2C583E91EF4D1C5461BA68FA3F4FA98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956205, "uuid": "59e0c47f-1a78-45d5-b210-788fc886f7c2", "value": "1536:0V3FCjDGAiXd8DW3iJ2K6k3YjsQrXp7gYuu0bNpGV1ch:m2GA+dEe813Yjss7gru0XGV1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785956205, "uuid": "1ef098f7-6b7c-4642-98cf-9cfb978292ea", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785956205, "uuid": "4b7a893a-4c30-465c-adf1-8dbcc961b26c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956205, "uuid": "5449073c-c3c0-40a1-be4c-e05a5cd91389", "value": "putita.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7edce3-90ce-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785935227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785935227, "uuid": "84f64cf1-7d08-4527-be10-49505c973091", "comment": "Malware payload (Mirai)", "value": "d89d8e459a222f3135991b823b0fc028", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785935227, "uuid": "daa76e69-ba8e-4edb-8ac6-3407c9b526ff", "comment": "Malware payload (Mirai)", "value": "93ad001ca5182100bbfca7140863fad0e18e8022c9f162d2c7aeaf524c59871e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785935227, "uuid": "cdcbdf69-293d-411a-b681-d8bd0f63491f", "comment": "Malware payload (Mirai)", "value": "70170dbf415ca28834fe35205e9314405c7b07f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785935227, "uuid": "c3e87799-a9f1-4141-ba50-76d4fad21898", "comment": "Malware payload (Mirai)", "value": "32522f6f7e1f6d94ce1ec2f80d0cb7de6a44fc115609d753e4f9ebdf66ae1da2f308c241a6c81f0b57ab0b7c9d0e713e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785935227, "uuid": "4fc7fee7-72c4-42bf-9baf-553a655aac16", "value": "T1B9262850FACB94F6D9031D3140ABE2BF67316D054F35EB83EA547F1AE97B6920932218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785935227, "uuid": "e9f5b180-264d-48fa-a6f4-73919c8251e8", "value": "49152:dltEpu9VpmchmwuFl6vNQ2sbpk6TVX+n8zD65vw/mxjIHQq23Jgwj6+WTwz/veJe:dbEYjsUEl6t8zD65vwGQmve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785935227, "uuid": "44ea1e6c-1045-4ccf-a642-7a17a659ff79", "value": 4505600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785935227, "uuid": "1c40dc77-3135-4d8d-bbb3-3a4f1c6b71fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785935227, "uuid": "2dabc83d-1eff-4829-aa88-d552e19d9539", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4af66eb-906a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785892366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892366, "uuid": "13b92fc5-ac2a-4cd3-b0e9-7fc1285a3ab4", "comment": "Malware payload (Mirai)", "value": "5b40c59005833724c2010b8965a13362", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892366, "uuid": "91b7fb27-cd04-44eb-a1c3-e518a13f68a8", "comment": "Malware payload (Mirai)", "value": "93fd29a33fb0d14b9b55b6b8cbbfab61bae8dcc14745d03ec7138207cc84b9ad", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892366, "uuid": "3589936f-e1ec-41a5-9fa1-9aeed88e1160", "comment": "Malware payload (Mirai)", "value": "1bfea71935971131204f626dd3ea92e34b65244c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892366, "uuid": "5788ea41-69c3-4a28-8acd-af6d8530d24c", "comment": "Malware payload (Mirai)", "value": "1b0ca13333af9efa7f2ec470da71cfb9660d35df7291892fee0e0f6772968f988f412aa74b71910fe0c13a46a0414bf6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785892366, "uuid": "be07b39f-8d54-4bb6-8d81-d3aa1b4537ab", "value": "T17D212BB090905449DD24E44938FA040872259AA261717F05BC9C2EFBEEDB9A4F53F7BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785892366, "uuid": "149b8284-0d9c-4452-97a9-b600bd37d287", "value": "24:h0XZH9SJBCPi9NWxuWctYJl8YJltuLoGE:ENfi9N0uWctYX8YXwLov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785892366, "uuid": "e667b1e8-680a-4ee4-a5ad-5d53238da4e6", "value": 1178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785892366, "uuid": "1e35de8f-f479-4bd6-9195-0be6244d8292", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785892366, "uuid": "ed64c954-db1b-46d4-8c44-4df9474ea4d2", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d079736d-90a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785916867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916867, "uuid": "c73b2ffe-1926-41ad-baa4-57a8d7650be9", "comment": "Malware payload (Formbook)", "value": "6056647a51732f60bbd3309722e15462", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916867, "uuid": "fe00bfb6-b424-4639-9c09-f92ae726df16", "comment": "Malware payload (Formbook)", "value": "94be3d9f80cb97d4fde39ac795f50d4810d909ecbcfa1cf5354cd85acd8f405b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916867, "uuid": "25d2c37c-4aa6-4ada-ab7f-80ca1f6bb82e", "comment": "Malware payload (Formbook)", "value": "2f78dc5ed271a03a894898fc32dcedee07395d16", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916867, "uuid": "d755641b-655a-4c30-9938-523a283462c4", "comment": "Malware payload (Formbook)", "value": "64820d8f3eabcb8734f7b281b09a395a83c7c368b4cdc48a3d3e815a98dbcf79878ed7f16e48ef50044ef12bf73de567", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916867, "uuid": "180371bb-8cc6-4ed1-b3cf-11aa404632ad", "value": "T1DB23E78F8DD584B35DBC9C7C583C26396333930EC96695CA907C9DE0A60B54BB8E3399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916867, "uuid": "247ccf29-d986-4e86-9746-311e0fc434b1", "value": "192:Xj+X4AWPBiapegzHHsZGnuyJyMDxWxUmuKtE6+C5:XjWWP0apegznsZGnuyJNKUmuWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785916867, "uuid": "f8e2b580-4fb5-4519-a09f-7f55fbebb6fc", "value": 47186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785916867, "uuid": "2ac6deee-8ad0-4725-87a1-86fdbf42c537", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916867, "uuid": "1f17f039-64e8-452e-8897-8eea1f88fc7b", "value": "854f1e97-5dbb-4a87a5PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b509601-9065-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785890096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785890096, "uuid": "892cd183-684b-4e71-91af-3881f284355c", "comment": "Malware payload", "value": "004a9b30d096ea79f8350e4013fd0e38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785890096, "uuid": "20ea6e3e-4a00-4abf-b947-0fd8520f8358", "comment": "Malware payload", "value": "951c35be1ee761f7ba5c95ac29d4bd5b623b62d947276133bca63871844dbf63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785890096, "uuid": "2020a7d9-30bf-48d3-9275-327eb279940d", "comment": "Malware payload", "value": "8e1bdae4753611c5ccab2a3e6e0d9f51ab9eaf15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785890096, "uuid": "d9ff1383-1ede-4060-a9bd-f2b138fab6c2", "comment": "Malware payload", "value": "0146aab9865e70b3702aad8bf1e5af53de330c6a79bf3a9c8edb4db9cefb08a4d6607640a480dd4c1bd69b2da8b735bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785890096, "uuid": "20755da6-d57b-48d9-8648-8f5b522b49a0", "value": "T18FA5C0C3EAF289DCC1638C3C5AADA113E136390D865C477BFB9D29503F2578AB464B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785890096, "uuid": "f0388ab2-ca7a-456f-bc92-4e9ad69c758a", "value": "de85a398477c39117ee5fd3f2278b959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785890096, "uuid": "84ede006-ad55-4d1d-bca1-973ceea360a2", "value": "49152:HXAbqCrvUt2o428iiUv+vQSsy18RNajVEtAtReHO+geiHieXD7d:vnTDJFCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785890096, "uuid": "d9302af0-34fb-4e68-982d-c7dadf1cee1c", "value": 2226688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785890096, "uuid": "975cceac-b207-4e82-8f16-d99f41fd7ec1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785890096, "uuid": "d9912936-f0ab-459a-9134-608dfa3c7c76", "value": "SecuriteInfo.com.Trojan.GenericKD.81024962.25068.1356", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e23d0cf-9099-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785912300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912300, "uuid": "a078e1ad-bf72-44ca-82cb-928634d612b2", "comment": "Malware payload (Mirai)", "value": "bd30cd7889a185e48f81fd1ac8fb248e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912300, "uuid": "c3dc2bd4-d399-4728-b931-4684f16fb007", "comment": "Malware payload (Mirai)", "value": "959ac5d9ec4571e62f86d477a55d596b0d3ddce27c805743967efa47fd5a0324", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912300, "uuid": "257aacd6-92c9-4a08-878d-8368a3cb38c6", "comment": "Malware payload (Mirai)", "value": "7b4daf86044fd1bc71701ecb51180aa93be17512", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912300, "uuid": "688b156e-0aa4-4c9b-a3c5-a82d04d7dfc6", "comment": "Malware payload (Mirai)", "value": "01668441dfa93a672b85fa32b021adb7fe387de94bd9bf521cb3bb5c55587daf0e3f06bd7d58af8221a4212e57cd2779", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912300, "uuid": "f73faefb-6cc6-44fe-a67a-b49a65dccc1c", "value": "T1667302C46F5492D1C96091384BA40758CF7D2BAFCB4081C92D255B8BFA2938F66EBDF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912300, "uuid": "06e61808-e254-47ce-bccb-889284dea11e", "value": "1536:978OGareVo7rXd8ZyL6AxGTCgYvy9d6N8oc4/EZmTpOltNOL7jm3QV1cul:97lsVA58Z1YGGD+oI4/EZmTpOxOL//VJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785912300, "uuid": "38b186ad-a577-49a7-8bec-7967f9c55c3c", "value": 75184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785912300, "uuid": "a1f77cb8-0b92-4e17-8fd3-b2157faf4b97", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912300, "uuid": "28b71cd4-5995-4ba5-b2f9-e148597f3b67", "value": "putita.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b4af4d-90f3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785950905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950905, "uuid": "6edef048-fcc7-45ca-a8e9-e4bc7bdca4c0", "comment": "Malware payload (Mirai)", "value": "348c045658281db8980bcad87f6c4d79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950905, "uuid": "9f22d211-2d08-4c9e-b71f-c76b87504da5", "comment": "Malware payload (Mirai)", "value": "9600dc90de0e5b779cdb592b7bb0b0574c48e1c9f3843c93359897122c441034", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950905, "uuid": "563adbeb-b4be-4c55-a5db-f380fd442bcb", "comment": "Malware payload (Mirai)", "value": "727f37ba5ead2a7b0ec3b4b6b3149cef19ba667b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950905, "uuid": "9e2c435c-319f-421c-a107-fde018c2accb", "comment": "Malware payload (Mirai)", "value": "2bb2cd3f5c7cebea2811d6735af2624593fd07f183326f013d870cfb5624de6f957109b181b0db593027193a1b3ff0e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950905, "uuid": "3ba0f462-7dbd-4ccc-931f-6b06687db291", "value": "T1B953A70E3E258FBCFB6C863547B79F21964833A226E1D545E15CEA011E7034E646FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950905, "uuid": "29811b82-96ab-4161-8975-c664befe6fa2", "value": "1536:M9iYiurYvVzXTLXJlg+UcxG9Rx8rYg+Wv:aiuMvR3U9P9Rx8rYl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785950905, "uuid": "cc874868-5d88-4fee-be21-c52e0b1ad0cc", "value": 63320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785950905, "uuid": "18e417ea-4d35-4768-ba87-9cf982d710f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950905, "uuid": "d1f810a1-1568-4ad3-8562-cfd92f6b9e0d", "value": "9600dc90de0e5b779cdb592b7bb0b0574c48e1c9f3843c93359897122c441034", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc03273a-90e3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785944374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785944374, "uuid": "0af6ba6c-0277-4bed-b785-9955d9bf77a9", "comment": "Malware payload", "value": "437e81f59dd6bc34a3bc4e50bff3c608", "object_relation": "md5", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785944374, "uuid": "2b41f8a4-fe60-4e5c-87d0-d12aa3d1ada8", "comment": "Malware payload", "value": "9682335b3bcca4f720c3716859a80087d289996b620a6a2ff0beaf7a64036877", "object_relation": "sha256", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785944374, "uuid": "51c73408-38ac-413f-9713-ee92cadccbc2", "comment": "Malware payload", "value": "0615c135343365e5c176a4ebd53ad9f026d19647", "object_relation": "sha1", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785944374, "uuid": "0f6c13d5-1857-470a-85c2-8fb36ef9be05", "comment": "Malware payload", "value": "47f8a5552401c537d9a7b8aa1523eca85d33cdd0305ea947027615fc7dd56a38680f59e4bae8382463da6bada85ed150", "object_relation": "sha3-384", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785944374, "uuid": "47d3490b-5490-4cd7-b1be-5b8e23e97ea9", "value": "T168D523CA35F26934C477C7B28F93E86D70A8B7814A218D0BFACD6E109E521546D3B3B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785944374, "uuid": "438be379-8622-450b-ad34-3afb2f18aa58", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785944374, "uuid": "048c30d7-d190-4081-9760-795c18af9c27", "value": "49152:UjGdTO/Ry7EX94mEogZ5VnT0MK/MJNlUxdE0X3JMUGmafDnz30xdIkQXLTY:UwTMRyIXmmEogxT0MZJMxi0X3uNnz4dJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785944374, "uuid": "fa914599-1c24-42f2-bb35-7b32070ba900", "value": 2916352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785944374, "uuid": "e8048c9b-1a69-449b-8411-94e8bb1eceaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785944374, "uuid": "0f44f542-d80b-4e3e-bd7d-cb1c88a6b728", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf76fb1-90a2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785916271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916271, "uuid": "66c34e90-fc6d-446f-b3af-0bec6f3d2ce0", "comment": "Malware payload", "value": "6988ed538b6bd149096068e7aa46bcae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916271, "uuid": "672d560d-5ffa-4ade-b448-1c3eed021e85", "comment": "Malware payload", "value": "9839f9ec79e7ecf2f4a58f672700f4f6a0f5efd63ec53bfe86dfccb53fdd56ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916271, "uuid": "1956ee35-6a7f-40ca-b228-e13936333b11", "comment": "Malware payload", "value": "251ecb01a393dd1f842c1b52d5b3fdca2537fde2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916271, "uuid": "0c0673bd-f9b1-47fb-8e96-f60626f70fb8", "comment": "Malware payload", "value": "3b6a972d9470eca12310128b6660857a2f3cf388020c6a6d52944d60838c35a4b8cc2d48a3b78a3cbe259ec8f920ff4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916271, "uuid": "091f401f-75c0-4c6b-94f9-19dc4132661e", "value": "T16BE52388B8D672B6F076C3F743A775DD71293B918BB21C9E31C94B605D128282C7B35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916271, "uuid": "6bc81de9-1fe5-4c3c-a3ae-b0f374c3ad13", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916271, "uuid": "79ef1248-db2b-4bad-8c9b-23621f8f5c13", "value": "49152:TKDiiORB/ria9u2HsveZyBOW5iXr6Befo02NpsCgDfbkaaaFbZSPpal:TKDihL/riaXxp402wCkfbkaauVSB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785916271, "uuid": "6d0c17f2-33b7-43e3-b43f-2bf4b01607fb", "value": 3041280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785916271, "uuid": "56345fe3-075b-409f-9055-56b809833f9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916271, "uuid": "be51f9b4-f4fd-49f8-84c3-8a9ec50036d8", "value": "gM9anpOuZNKX8zHj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac8c846-90ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1785933608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785933608, "uuid": "2a643980-e13c-47f1-ae2b-f38745194f83", "comment": "Malware payload (ValleyRAT)", "value": "e078e0a7efd6c0fd792a5f185b38e1c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785933608, "uuid": "3b749e0b-83d3-450d-83ef-f5c2006d4431", "comment": "Malware payload (ValleyRAT)", "value": "9861f8da59b81d1c6c1f4dcd223ac281dcbdd96580eeaf5b769086a02978a141", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785933608, "uuid": "6c4a4c17-aa68-416b-9739-ffcb91a9014e", "comment": "Malware payload (ValleyRAT)", "value": "99cf7b37e2eac763c1a443c98a4c62c3c6f89ba5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785933608, "uuid": "4d809d00-511f-4ca1-bf93-d31057fa5505", "comment": "Malware payload (ValleyRAT)", "value": "3e17d605bd619d1da237d01f781a6cd9ba34adfc3e437aa291be19a848eda7dadf5c805a5e1dad16d39d846214b2f210", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785933608, "uuid": "7778bec2-6a7f-41a5-885b-4d6f17ac6093", "value": "T178F58E3A5A6D02E9D0FB91F4E52A6667E178B414233056CB138047FC6F23BD1AE763C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785933608, "uuid": "776d0e42-c4d5-477a-94fc-ca4e61172493", "value": "4c9310f9eae240dd43fafc0ec9c61c79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785933608, "uuid": "0b8b9139-5b82-48b3-8a07-d783e8882cbc", "value": "49152:FV7uFQ8tAq8hg3jZfBmll0sLSsmxy39qZOey8sey0trvktKqiUJZ8l:FEFQ/hg3jZfBmllbfqZ5ox0dkgqiUDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785933608, "uuid": "c34555d3-cd68-4690-b1ff-6dcf9065abe8", "value": 3646584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785933608, "uuid": "fd4653b2-2d44-4404-adf8-2b12e1df179d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785933608, "uuid": "cd1e50dc-b876-4a60-b3c1-e44656084e75", "value": "2026.08.05\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848WPS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31943c51-90d2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785936787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936787, "uuid": "23cd12d5-e736-4aaa-ac15-3faff567ea97", "comment": "Malware payload (Mirai)", "value": "833a416ebe7e2dd26be8d525278b0ae1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936787, "uuid": "74783f00-1f89-4d6a-a4a5-f9585456f7ac", "comment": "Malware payload (Mirai)", "value": "98994017c070389b3ddfe557847dc6aaa00ce7bc79760faf3dcfe68036b56431", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936787, "uuid": "48e21466-5c51-4ea8-b150-b76b13be74e9", "comment": "Malware payload (Mirai)", "value": "05ec4a98792c58b7289527c74fd3c82eea785ffc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936787, "uuid": "f8e752dc-80c1-4f9a-b2c7-35c4d648fc90", "comment": "Malware payload (Mirai)", "value": "1c37f6f5b5e2f1ff9343a1d8879ea99a27382f47289fde2a4e3e496bdcf3e0eebb68559297239c817c6e8c256886818f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936787, "uuid": "b6a35425-e365-4a2d-8877-792546195d99", "value": "T13D458D45F72882A3D5535DF0163F1BDAF7212A1310F6A11A330FAB632372A3A99CB755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936787, "uuid": "29d46c91-befc-45eb-ac15-ad3c9eb9c219", "value": "24576:JQCYsos7ILx7gweZYxL2sXCJi2ZPqSvnNQSaia:2Hsos7ILx7gweZCqsyJ9qS3aia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785936787, "uuid": "a49e7adb-a39a-4988-827b-5f736b7f3bc6", "value": 1185928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785936787, "uuid": "42d27119-8fea-43d3-aaf0-d3659f46f05e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936787, "uuid": "f10f0278-8a63-4047-8267-a9fa1ba6adc3", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6628d142-90a7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1785918407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785918407, "uuid": "17cf800c-97bd-458a-b965-bed4dae46362", "comment": "Malware payload (AsyncRAT)", "value": "9734e9cd44c3e99341c97b49bcf86189", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785918407, "uuid": "533496fd-f230-49e1-af27-4bd642dd4cf8", "comment": "Malware payload (AsyncRAT)", "value": "98ae3f60a6f753207f4880cf211c155677c2b1725e0911d0eca3ccea97a199bd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785918407, "uuid": "da1b77f4-6dc7-4a4a-bcdf-2659b3148f0c", "comment": "Malware payload (AsyncRAT)", "value": "3097624ee15a8034cb961155286207ec22e9299b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785918407, "uuid": "f4ee8b9a-e21d-4074-8c61-f95967864b14", "comment": "Malware payload (AsyncRAT)", "value": "8ff6c20a047fb2ef46dc82aeafe0a254bb797285ce2195394a01823def06dd91735fde40d970311d2ab4a493517cc7ee", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785918407, "uuid": "236d6c5e-e46b-45fd-b0bf-2d075d5bff7e", "value": "T1471595874109EDE1C213FC75F681A6C6AE9601079E6BACE37D171AD8A032F7248DDE19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785918407, "uuid": "27d1a906-df89-4a4f-b502-3a75c65ac584", "value": "768:S63BkWSDawU4SpWDaBMFpZVa2IQMd/jrCzONxvNa2BcwvdNpRJgPqy6w75AWcYH5:zAf0NRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785918407, "uuid": "60b083f4-f4bf-4c21-a1b4-b842bb723db7", "value": 908911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785918407, "uuid": "72f89ea7-49e2-49fc-92fd-e0f8696544b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785918407, "uuid": "93f43ec8-c172-44c9-8e9d-e76d7d269289", "value": "Copia de confirmacion de pago.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914f495b-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917620, "uuid": "d71f22c0-0659-40cf-9e38-d791ec5f28a3", "comment": "Malware payload (AgentTesla)", "value": "db863603fd19e8737abcb2b0fbcd83c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917620, "uuid": "d15e7186-cae1-4570-8524-2597df357b3d", "comment": "Malware payload (AgentTesla)", "value": "98b345d171d2ebf1105b033729ef580541226b3a355957e6e03a852c7ab36615", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917620, "uuid": "65f4f694-1bee-46b0-88be-2cfeed3bb07c", "comment": "Malware payload (AgentTesla)", "value": "aad65f18dfec552d36bad3939b234170ec913954", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917620, "uuid": "941b917f-0fb8-4474-b100-c4e86acd5892", "comment": "Malware payload (AgentTesla)", "value": "85e6322f8ec56eac444b23faedc92cb8b55997ac5329effcf771d2f98bed4b24cf5ee41308145309d0ff41eb97ddaf38", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917620, "uuid": "8ad9f205-bead-4abc-b9c4-41c674e10b4e", "value": "T169E5F690530899B27A2C672CE137DE244B1EB01351C5EF5D377CA608B795EAF638C8E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917620, "uuid": "768fb672-d1c6-4f93-926d-4cf17624e9a7", "value": "49152:x4e/1ugw+XK5oeLgUBZYnzxC/TP+4ulBxfT3H+63aw5JjUag4505I5pN4M7rWjnV:JNug7XKSeL1BT/a4u3x73H+63aw5JjHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917620, "uuid": "f89e9e5d-cd5d-45c0-ba58-a5c52cdd3c6f", "value": 3043594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917620, "uuid": "b5861e82-7c2d-4335-bb8a-fe4579cfc905", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917620, "uuid": "ed2f8bc3-67c0-44dc-8287-d1d013946533", "value": "RFQ-1579.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3779015-9094-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785910349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910349, "uuid": "f64d20df-4d77-48ce-bd7d-1a8078361510", "comment": "Malware payload", "value": "d9a91341fe7c7544a5cc669267202a1d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910349, "uuid": "08e35fa8-d435-4aa2-a147-0a1ef06e1bfb", "comment": "Malware payload", "value": "98b611f76688d044be307474b3b84fab26e47a1b7ba5a0efc8dd7033e48e6d6a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910349, "uuid": "f2ade841-dbd1-4996-bfc1-919a4fa28c65", "comment": "Malware payload", "value": "2b65a3fc3822acf49a09fac2e89d5c366c83b91c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910349, "uuid": "12ff9982-398a-453d-bae4-ef3580222d4d", "comment": "Malware payload", "value": "e0aa17d0e1dae586fe46744137891a264ee07f6581f459aa8f2737138c9fc9b2e67663c701ac4d96c741f364c44276a1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910349, "uuid": "225a52a4-ccca-49cb-9b72-d7085fb5e17a", "value": "T1AD3149FF0211AA231500CA0BF3B514595644D5DE7E9BE7E8FE4C6C29B24E18C72B9E47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910349, "uuid": "8946995f-9e95-4dca-bef7-f57c9cceec3d", "value": "24:oQyEIjkQCFjNeVBQzNd7u5lM3qYv2aI/6K:aEIjkQeAVBQzl1Q6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785910349, "uuid": "7080148a-128f-4d8b-9faa-180be8129fc4", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785910349, "uuid": "8814bbaf-72ce-4635-8c5f-379cf4393f11", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910349, "uuid": "79fca789-c17c-4f91-92d5-682a9816efe3", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0670211e-90a6-11f1-bd95-42010a9c0009", "comment": "Malware payload (DonutLoader)", "timestamp": 1785917817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917817, "uuid": "a33a7967-5931-4333-8519-37a8b01cc6ae", "comment": "Malware payload (DonutLoader)", "value": "09e954b7c78e91fd319a5083e1ed1444", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917817, "uuid": "ca6d0b38-2ab0-473b-a52b-2ff86b469a34", "comment": "Malware payload (DonutLoader)", "value": "99158b6292e3e4d785e0351b8c5f75a742d1439570a4058ad74e6179d8d8c8d3", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917817, "uuid": "b40d07e2-9add-4d5f-b469-45195c0fc233", "comment": "Malware payload (DonutLoader)", "value": "c35047c5cf489d9f79199f0dc3fa0e0ab9dae1a6", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917817, "uuid": "b35a15bc-bb19-46f8-b640-47f3e04f3d5a", "comment": "Malware payload (DonutLoader)", "value": "20e5acbad7879e0afbcca93ad55aa5755701c89c234dd94f82164b212c4ca84c2f04fb23c31e9e1913d187001d4a4744", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917817, "uuid": "daa2e43e-7a21-431e-9b14-bb9f5864e11e", "value": "T1CD41631C634D63B2E3F34A33469DB320CB62BC03A992AF5B25E4028D5C03600BE24D6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917817, "uuid": "f5edf6a9-1351-42fd-96f5-9ac887d850b0", "value": "24:8A0GFMSEzogW1P8wJB3U/+/F1iE6JY4I0cl4o0F1EC5gqyDOF1tlB5Cv/MRht1dI:86rEZW13Jhj8E6pI8oSl5gqyDq1/Vf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917817, "uuid": "27b6dbc3-8b58-45c6-8c02-6b94960ae305", "value": 2370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917817, "uuid": "20669c45-a1aa-4a8b-80b4-b2b9d230cc45", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917817, "uuid": "1dafd13a-c3e9-4134-8408-aedc1c5aa4ae", "value": "Store ID FH3H38472J9DJ4.txt.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d502235a-90a9-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785919452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785919452, "uuid": "d3f69ddf-1e05-4b8d-a0e8-e8b00926894d", "comment": "Malware payload (RemcosRAT)", "value": "480c179d25278968be1632923586f87c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785919452, "uuid": "28302db2-6833-4897-804a-6939319553fc", "comment": "Malware payload (RemcosRAT)", "value": "991a7ad5c91fdd0b64b3d76426659c2bfffc539117cc92b2aa0ad62cfb59beca", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785919452, "uuid": "fcb5b093-6dbc-4a11-b14a-e7f43b8608e8", "comment": "Malware payload (RemcosRAT)", "value": "4c764616bfae27566034ee62b7c2f2d4fe27277f", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785919452, "uuid": "ec3b3ab8-5555-408e-a173-f648ac1fc3a4", "comment": "Malware payload (RemcosRAT)", "value": "c275cc86044e929e0a2807c3a8cfdda226e1d3ac16061bbc4ba5c4bb2cfa6b9aee9f6ee8c0b434d17f98b806504f84e5", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785919452, "uuid": "014786bc-3938-4ddd-858e-b86315b41783", "value": "T1A015CF0E0DED5F1735F7A1F6056A7D92B19C2C321BE33B4318AA9F5880346CAA9756CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785919452, "uuid": "e025735c-d6e1-47d2-bebf-780625836e83", "value": "768:BUYLmoqJWcYvdyHScvjjY0mf6vU47BmxUutz3sYeYg0bHo/B4YHYqFAXfWorYQel:V6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785919452, "uuid": "ac46ba39-b95b-4740-bba1-b092984863bb", "value": 943626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785919452, "uuid": "87205e79-debd-4973-90e2-3b2635b661dd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785919452, "uuid": "fce0f752-687b-4218-95eb-8576d5086cae", "value": "IMG-20260804-WA00065-.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b10045-9103-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785957952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957952, "uuid": "cf4df5b9-9d6f-4151-9d6f-3ac125ea38fc", "comment": "Malware payload (Mirai)", "value": "2bf83d53b9a9677ec8eb417110d08ecd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957952, "uuid": "d405f223-f971-49c2-8b51-3fd3a4d204a6", "comment": "Malware payload (Mirai)", "value": "99c94aabd8660c3927ad6182bb0a789866c950d654c93697c5bcbaef70388b7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957952, "uuid": "384bb50b-a920-42a0-955b-af25cd211af6", "comment": "Malware payload (Mirai)", "value": "b74e68ae85753bc5b3b48641bebcf398ec5c30cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957952, "uuid": "8b0aa11e-a608-45d1-af1f-e408a3304738", "comment": "Malware payload (Mirai)", "value": "7b8992a7907c31cc5abf72a8593e8502f2f3779603faae67adf12a8be3d3647302629460864a45a2e8700f6c6f0e95be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957952, "uuid": "eec1a621-38cf-4b2f-a6c3-7fb006e01ed3", "value": "T19D04394E7720CF21C769C53105B3CB8656F926522BE28849F36CDE04BE65349B92FED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957952, "uuid": "57cffa4d-bc73-4f71-b786-557e3693c842", "value": "3072:qCq2/LbMQ9oAIth08OP1ibNYIXSB1DTEj+QW:q1s3MttcPwCgSXHK+QW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785957952, "uuid": "c79e933b-b9a8-41b0-8711-bf9203cad7d3", "value": 180924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785957952, "uuid": "25702850-7963-41e0-8ae7-7f8c05de748c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957952, "uuid": "ddb86cc0-d281-4014-8dbe-b992348393c4", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8437cbee-9090-11f1-bd95-42010a9c0009", "comment": "Malware payload (LegionLoader)", "timestamp": 1785908579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785908579, "uuid": "c8716226-1f48-4944-81aa-a8c0fcdc869a", "comment": "Malware payload (LegionLoader)", "value": "4eda71d90d7f683fa53ede2ea3de3668", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLoader", "colour": "#426886", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785908579, "uuid": "ecb1fae5-e822-43e9-a17a-75b812b8efaf", "comment": "Malware payload (LegionLoader)", "value": "9a59f072a34bd7b6254c69710bafed27752e2fac1a292eb5a9cba1a52c55c316", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLoader", "colour": "#426886", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785908579, "uuid": "5a1e0afd-a3f5-4ceb-8978-c706d5eb9e90", "comment": "Malware payload (LegionLoader)", "value": "e280f31c2308c931ec6e41ee0ffc60c5b6ca12b1", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLoader", "colour": "#426886", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785908579, "uuid": "37923e2f-8049-46b0-a23d-e1322efcfaed", "comment": "Malware payload (LegionLoader)", "value": "9d5c9da9eac74b070212bc54b42f295ea36e76bb9358c7e01a927137ec813fbf4fbebd15294345794de47fcb13a2a626", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLoader", "colour": "#426886", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785908579, "uuid": "5433b46e-b87b-4c3e-b72b-65b490b89fbc", "value": "T1C4E54E59D6E196B747D25F267EA6FC2A0680AEC3A5D8E551B3300097827F38EF4233D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785908579, "uuid": "05d53dbe-6548-4528-8d35-06ba2fe533a9", "value": "e0c5df6940f38fca3c0c0c22d7bffedb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785908579, "uuid": "1cf6b35d-9001-4274-a6c5-b7194ae9de3d", "value": "98304:Kre8l0SOXLWwoAgGny/rNmeHRK5jAVBgLlqbToE:Ie8KNKwoiy/rNdcJuBgBqXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785908579, "uuid": "1c9bcfc5-aff5-4e7a-8a10-4abb9452dcc0", "value": 3312128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785908579, "uuid": "bc0e1ca8-c7a8-4250-9763-4ccee606abf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785908579, "uuid": "78e28fbe-7b02-43a6-ac01-b75fb15e4729", "value": "wyhrytj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d36b030-90fb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785954577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954577, "uuid": "d6b36e1f-b94a-4b89-9d17-48ded314eca0", "comment": "Malware payload", "value": "a9b775334dbdd07937ed1dd6a4322a97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954577, "uuid": "033335fb-4cfd-4610-b83d-8a0e53098ffe", "comment": "Malware payload", "value": "9a5eb81590bac1ea12976511270bdbb6a21f425f3359fe4e422e4dbf5bfcdd5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954577, "uuid": "94f64746-ad39-4e96-b9a8-ddba0b12d689", "comment": "Malware payload", "value": "267c06929876abaa8d8c7f4aee618c9973c36360", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954577, "uuid": "72340a9e-fbdf-43f9-bec5-f2562ef1f71f", "comment": "Malware payload", "value": "862585c3b44fea700ec05e97f0af9fbe028cd9dcd077c658e14bb6bf50e6ce17463262cda87b1e0905b7ef98cc201324", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954577, "uuid": "2db27163-79c1-48df-8a71-76b4a44852f1", "value": "T12495E757E49590F4C0EEE174C726A213BEA13499473837E36FA186F11B26FE4A6BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954577, "uuid": "1fd1c86d-5828-4b35-a15d-ea800f859816", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzy:cqYUQuVDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954577, "uuid": "a07ef579-a7fa-4c0b-9bad-674ddded4da7", "value": 1900544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954577, "uuid": "e1c7b0e6-d001-4448-a4b5-0bf8dde21d04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954577, "uuid": "4a9b51ed-ccc7-4564-847b-c47be5b72b14", "value": "9a5eb81590bac1ea12976511270bdbb6a21f425f3359fe4e422e4dbf5bfcdd5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86fcd048-9072-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785895699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895699, "uuid": "42f91285-ee18-49e9-9604-65e0ea41b883", "comment": "Malware payload (Mirai)", "value": "44d564b267fa8a53297a937a89309315", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895699, "uuid": "0cffacf8-cb78-427e-9526-b4532222bb0a", "comment": "Malware payload (Mirai)", "value": "9b1c0cb8ac7704452f06292398a65ffe9b3c901329f93ac716d7486ed8798d94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895699, "uuid": "c33bdccf-355a-4785-96eb-bccbdd7e6371", "comment": "Malware payload (Mirai)", "value": "1ab9d5072f8c6a1fae5163519a359614fd2447d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895699, "uuid": "6f8879a2-540b-4ce2-9096-cc2a6c5ca0a4", "comment": "Malware payload (Mirai)", "value": "93be48c039c52e13507191d5ab40b699e4bf14879536e37110ceeb0650bc6585c052f8a3e8d15d23f616a4a53eccbeb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785895699, "uuid": "80f85699-dd45-487a-b0c8-71cf12278dff", "value": "T1F5D3125D6C333B59E865393678EE072ACE9110EE4B21877E8BFD494A206FD873906473", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785895699, "uuid": "55603f61-73bd-4f91-af36-b7555a5137c9", "value": "3072:2lbKL83FTLLrdzvfO4+U6V7ya1viLBWITLWaV1LDMypzSAj:2BKm1zvf8V7D18BJTFTL3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785895699, "uuid": "0f787411-328d-4dd7-ae4d-4d09c364f36e", "value": 138728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785895699, "uuid": "c2b03cc4-df0b-4027-b85d-64a5205cb0fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785895699, "uuid": "44c057c7-76d7-45b7-b704-bad18139be00", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "238437ec-9100-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785956520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956520, "uuid": "86be6feb-bb7a-402a-8d67-a4c964d39d84", "comment": "Malware payload (Mirai)", "value": "517b8032294252d4b51447f05a0ca58c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956520, "uuid": "4dfbfdc8-2b63-431d-b47d-3b4b11a1e2e5", "comment": "Malware payload (Mirai)", "value": "9b1d8b897f0ce98d70bcfb875696e718f5a283dc388a43568c811ab0e2f25f49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956520, "uuid": "2d8b7ee7-971e-4752-8cb3-7b8324e5405a", "comment": "Malware payload (Mirai)", "value": "e388c53bc7af930312c4560f2912555b1e8d7de4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956520, "uuid": "a9052b53-da65-4aff-b8f5-5a2111b3afca", "comment": "Malware payload (Mirai)", "value": "163282ea14bcd42130b3d7934f14ee24e6ed254647569ef43aaef4a894d723e225ff1bb2a954ff8e4401e900d1e20d2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956520, "uuid": "963ae72b-add2-4243-bcc5-523c8a74ce5b", "value": "T17AC329A9F890DE52C6D52676FB4E018C33231778D3DE7106CE149E34E7EB95A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956520, "uuid": "515bfbc1-bb1f-48c8-b233-7de8ca859de9", "value": "3072:I85FjA5l1pSzeFMyD1IekcYEEUw60MW/NwhrRtYaPI6NeFFJduVf1Dlg:IWdUieD17kcYEEUw60MW1wXiaPcT8V95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785956520, "uuid": "f98c83ba-bac2-48d1-b395-0bc5b0623a0f", "value": 124340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785956520, "uuid": "c1314b4a-9d41-447d-a3b1-192a8e7e00b5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956520, "uuid": "d9c852ee-497c-492c-ae75-42c588b32879", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5bf0e20-90fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785954162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954162, "uuid": "3c8bdceb-82db-4d0c-a291-bee293b86439", "comment": "Malware payload (Mirai)", "value": "aeb89f9c86c9ac33a2e63681a64826b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954162, "uuid": "93c4824a-ea40-483d-98bd-ae11fa285689", "comment": "Malware payload (Mirai)", "value": "9b71c6bfbd2d9741ea03b03afa8683df6681da4936cdafeebc217ab8c9bfca8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954162, "uuid": "451384d1-de7b-4cfc-83cd-b2776eb92d5e", "comment": "Malware payload (Mirai)", "value": "de8f0c0d4e45d2fe782dc36e43598760014a90fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954162, "uuid": "d74c315d-5bff-4ba7-99f8-664c7ff8a51b", "comment": "Malware payload (Mirai)", "value": "0b8f177a208137e0e4032fa60796db0cedfb2e76d7b17d70f693e78ff01819becaf24cc7579a2efcd93d9d50f7b1d0ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954162, "uuid": "817f321b-88e7-4b98-8e65-e1ce4dd7dc54", "value": "T124F2E0BD8B012E9BD46AE4F80D714FA00DA91372A4029C0B7951DBA67E576873FD39CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954162, "uuid": "daa182ab-8f9f-4a26-a06a-48304c82f152", "value": "768:fNyVDHF/qHyD4DhJr04Qp3hlQU3sNSO6JgGlzDpbuR1JBX:lu/qi4DT0dXlVVJuHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954162, "uuid": "caefe0a9-3863-4b85-94fb-da0986322774", "value": 37280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954162, "uuid": "1f98553c-9c55-488d-a55c-c3296ff3991e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954162, "uuid": "818238bb-2696-4081-9dab-49f65c78561d", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b94306-908f-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785908076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785908076, "uuid": "8dadb3f8-8208-46b0-8a27-4c5df1f871b6", "comment": "Malware payload (AgentTesla)", "value": "4270d0a56a4eee1d54d147e28a61dc3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785908076, "uuid": "949077e1-dd99-4f48-8c14-41eacd2a5450", "comment": "Malware payload (AgentTesla)", "value": "9c073e29ba0b9a714320a82a64929a47d7f91c0edeb9569f76723fd91f717107", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785908076, "uuid": "d2000754-3ee1-45d7-9069-f7b708c39195", "comment": "Malware payload (AgentTesla)", "value": "d8582e83898c01977ad789fad52488357f3fed9a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785908076, "uuid": "2232ce15-260b-4eea-b464-316614d1049f", "comment": "Malware payload (AgentTesla)", "value": "d7f52d8ce24ad19d73dbde36ecb27366ee56b3aa6f009d2073c6d2d48d209cafbcb91d144ed7a56fe3aff0b84bb04f5a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785908076, "uuid": "09957268-dc19-4020-85e9-a611c63743d3", "value": "T1EFE517A29308A6B07A3CA73CD9365E140B5EB01712D5FF0D766C620477A6F4F638D8E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785908076, "uuid": "e920c1cf-cf25-4a53-9964-4b348beface5", "value": "49152:jJ0mWNUrSIyaNoNmhpPbs9XaqkP2l/jHrztp4rCQYq3NdXlX00FgFdcjij7GLQ:jWmRrH1oNSpPbscq6+/jHrztp4rCQYq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785908076, "uuid": "3487e9c1-552a-4504-9d3f-a2a35bf754be", "value": 3041778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785908076, "uuid": "3082c783-16dd-4264-80fe-bc568d505c59", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785908076, "uuid": "2ee625ce-1459-4468-9a0e-864bd78d4fe7", "value": "Purchase Order.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd72dc72-90cd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785934982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934982, "uuid": "ce66f6df-7604-41ea-a0cf-2d8f674775be", "comment": "Malware payload", "value": "f49f0d5f42d01b6e6a2513a9a7355696", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934982, "uuid": "5452f82f-bcb6-49da-b2fc-9f8615f8cbc0", "comment": "Malware payload", "value": "9d3ad7a907f963aa4df9333267dbcfec418b9469d513614397879e1dd7ff7d4f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934982, "uuid": "3f21a574-8022-43b8-b69b-100bb5ee8e70", "comment": "Malware payload", "value": "ec3642f07f5c2cfcbf66ec9e23e4b60d49b4cfe5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934982, "uuid": "a57b41aa-3573-41f4-ae5a-7543ae442984", "comment": "Malware payload", "value": "605a580d3ac7e5d14e7ed3e78d909955e3429f3ad688d456068bfc5e2ebee537db0598338aefafaf5712d6a2cd8dac0e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934982, "uuid": "e5362b65-b055-49ab-aaad-1ff548f0af29", "value": "T1620161E9E4D284313F0D8837551D4CD6B246182B14F82ED8A15DA9625F0CA6866AEB33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934982, "uuid": "08e454af-d497-4062-9065-0c5f98dc822b", "value": "12:ZPmtD9jWijWr5jW2FFl7jN/OQaC5haHHYXqiCgENDNaQ4VBFHKsoRE5YXmY6uYCS:ZPmtD9jWijWr5jW2Fr7jN/F5haHifMDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785934982, "uuid": "c7293a19-b7f5-4bdb-aef1-b7b9e7437028", "value": 740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785934982, "uuid": "f4e10cd1-cf69-4217-abf3-113437ab7564", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934982, "uuid": "4e7bc2de-f5e8-460c-8a77-1391cff09dea", "value": "sensi.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4192b7a-90a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785916873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916873, "uuid": "e6a337b6-9e7e-45b6-a031-d5fa563bc6e3", "comment": "Malware payload (PureLogsStealer)", "value": "151c07488bb26ba0edf1afeac26edbcd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916873, "uuid": "81cb66d4-8114-4e3c-bfd6-f1c361d9b923", "comment": "Malware payload (PureLogsStealer)", "value": "9d3e9cfc3ae89f9c3370248abf19c906660d47d24d6548a0915643fe0fa31bd5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916873, "uuid": "1c92fbae-4595-4a78-9934-2750312fc5f3", "comment": "Malware payload (PureLogsStealer)", "value": "65f07423dea210dcfb7140a25d6fd75aae5ef846", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916873, "uuid": "c315f3e2-7717-4a02-89b7-af76eafecc5a", "comment": "Malware payload (PureLogsStealer)", "value": "b20023c026c134827a860fad55aa5c11b79a8f5415b1b8ead43911db428a173d276cd8984b6d4757c386db196f0734bd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916873, "uuid": "61838b9c-d114-4551-bd46-ee398ca229c7", "value": "T14725EADF6BE33A4C2808B75A89F9BD8C1842CCA50452A079BFB417DAC51D7416F8D7A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916873, "uuid": "91bb94ac-5ca9-46c7-9855-70297d72395f", "value": "3072:UUbTdddfYH3kzmeT3kZNcHNukZxB+teYnA35Oo9H/FkuPjYd4x5:U8Tbd80hnfZfh9HXY45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785916873, "uuid": "e10cd825-35ad-472a-9821-20ed0a5b00dd", "value": 1022475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785916873, "uuid": "55c0c6e8-4258-4159-82fd-58f6e253d6e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916873, "uuid": "e710044e-c12b-4b78-85af-f3c879f703bc", "value": "Order_Summary_&_Specs_2026_BFMP Group.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b65afaa-90d0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785936052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936052, "uuid": "14091439-744d-447e-86c0-40c587ec5e45", "comment": "Malware payload (Mirai)", "value": "9d754cdf176c21649645444b56cb0e0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936052, "uuid": "b872c154-25b6-4344-8776-32dab9afd28c", "comment": "Malware payload (Mirai)", "value": "9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936052, "uuid": "34f5c58c-7a9f-4a92-8ba0-2e50ff0fe110", "comment": "Malware payload (Mirai)", "value": "ddd07abb4c1077a6b6e54d61a8f6026360ac6379", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936052, "uuid": "51953b4f-2085-43fb-a8d3-ef5845d79e8d", "comment": "Malware payload (Mirai)", "value": "6d17ece16b2843c7263a1deec53b062f5ef4dd75d4338f9d766a57795dd4f22e66c6542568cf9f8f514b48664dbdc0f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936052, "uuid": "fc98416f-193a-4ef8-8592-ed3c0ef5868e", "value": "T19B555D49B2F3B0FCD167D430435BEA239C35B47621237E7B61C59A322E62DA01769F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936052, "uuid": "fcb82c42-d3dc-42da-bdd8-00d314786a98", "value": "12288:sVXSFdbWwUJtGOlYFMSJagDpIThg3zqImQH34a9egmyBtaLPXnvP5kr:DbWwUJtGOITJagDpITE5h3h8Rzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785936052, "uuid": "2cb3f542-444f-4776-8a47-7a4a82667cde", "value": 1357648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785936052, "uuid": "9322a14e-a6e2-48ff-a81e-b1c03b93da00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936052, "uuid": "60d9c4f2-8152-442e-9204-01f8d2f020ac", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac99659-909a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785912885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912885, "uuid": "1aa60f63-9a6d-4968-9db3-7a92c317530a", "comment": "Malware payload", "value": "fe12ca160d907b07619a1771397d9393", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912885, "uuid": "aea48a63-b5b1-4794-8025-1eaaf7671139", "comment": "Malware payload", "value": "9e5083a2ff3def9f24aec82abca32d7ad144907fecb8403a174d9329fa767208", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912885, "uuid": "8477e0d8-a61d-4249-bd7d-2e1bb15bfad9", "comment": "Malware payload", "value": "7298160c7a53e01e1abde998ac1ad34c4d4c539b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912885, "uuid": "395bd0c6-cd00-4cc7-a025-a8834da6b5fe", "comment": "Malware payload", "value": "aa8bba818d096f4bbb47350f137dd51526a2093e64a0ecabfb2195b139c94fe9931382e7420a17425eaf64fe803550cb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912885, "uuid": "42b4cd5b-1ecc-4b5c-962c-0c73aa734b38", "value": "T1B7C28D956A867C44BEC98B3E4CBD2B0D6DF5C3D1224942AC3D8B3C719C15F9CD618B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912885, "uuid": "37c5cd72-ab79-49d8-8430-ee9f6b29acda", "value": "768:T8vCB+25j6es8RH9FYpMSUpi+20qUpi+20YQX:T8l25Jhd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785912885, "uuid": "82514d83-72d9-4fa4-a73f-ce83f05a6485", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785912885, "uuid": "460a01ab-6d6f-4a61-b95d-acd17c56cc3d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912885, "uuid": "b6b6ca19-d5f6-46e9-b667-2e7bb587f5c9", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03d4947-90d4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785937966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937966, "uuid": "2cfd3ae1-9313-49ce-8117-9c17d1af00dc", "comment": "Malware payload", "value": "85befaaac4c76b7d0a4ec1f4311b0fbd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937966, "uuid": "18c37ef3-89ec-4cfb-ad1a-05b8394e6af9", "comment": "Malware payload", "value": "9e528850660884bb05f848372d93838356960a149acc887ceae1bddc57f4dde2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937966, "uuid": "7d55fba6-03ef-431d-9c32-51022c320b9c", "comment": "Malware payload", "value": "66e384220daaa53acd15c1abdb41aeba2202fd47", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937966, "uuid": "86344f83-6c92-457d-b50b-9c187c0cdbf5", "comment": "Malware payload", "value": "fbdc318c8f014de7d9238c16fa4e935ffdcf562fdbad7e9231e31f4053b799b8bbfa953735c095bc5876f43bfc60b8b8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937966, "uuid": "bd4f0214-52ce-40b7-be65-0e58117da7b1", "value": "T12D236C651A857C24AA98C4371D7E2F0CBDAD43E6324492DE7FCA3CF28C5AA9DD10871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937966, "uuid": "19e9c08c-0833-41ed-8cc0-409b9fe2a2f0", "value": "768:hXRWNGxVo9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:blxPcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785937966, "uuid": "4cbf2fdb-ae74-40c4-8392-4ffbaaeb0e31", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785937966, "uuid": "2a249333-f03a-4d32-97c9-4797aa300eca", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937966, "uuid": "b06b9aa2-d81b-49e4-bb4f-51dbed582236", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e7b3472-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785917535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917535, "uuid": "bd4f725d-5465-432c-bef3-2602ffc314da", "comment": "Malware payload (XWorm)", "value": "d063063ced3242786366de60434cc502", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917535, "uuid": "8e0dc732-ce14-4abc-a578-8d433cfa2f7b", "comment": "Malware payload (XWorm)", "value": "9e5ffe5dbb14f780a6051eaba02ddf4e5a723f3cfc517fa3ee2934f51563162e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917535, "uuid": "1eb69245-48da-49e3-b4c6-b985868474ce", "comment": "Malware payload (XWorm)", "value": "147410ea00af6e2294bba427efda8b839ae0645c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917535, "uuid": "91cd8a25-2f31-466d-a509-021833d47025", "comment": "Malware payload (XWorm)", "value": "14b5beacac2d6c283685281fb089fb21b64b5e8733e8100abcecf3749bd8681543f10a6ffd18752079ea42605f4d359d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917535, "uuid": "07d17846-5e68-4267-9083-b90fafacc68d", "value": "T10AB5D6509708E9B0792DA72ED1325E254E0EB10752C5FF0D3A7C6604F7AAF9B234D8E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917535, "uuid": "49a09b4a-29ca-4d1e-b7d1-29b4355635c3", "value": "49152:dfMGNpoRKqXUV8AVwbzDSHxyXg2I+G9Q/2YSkhj5S7BLvVAuVqr:GGNpoR88YiSAwn++Q/2YSkhj5S7BLvVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917535, "uuid": "0f8fcf0b-03aa-4e45-ac79-54ebe4575139", "value": 2291754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917535, "uuid": "f46e67a8-a7a4-4f0d-8f2d-a65cbbf826f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917535, "uuid": "48f3957c-f501-4ddf-8e84-1c2e0f188798", "value": "Quote Q2026080145pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e35f4e0-9101-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785957102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957102, "uuid": "31975cfd-a034-44ae-bd78-04c985aba975", "comment": "Malware payload (Mirai)", "value": "274498d095d23f7959b4fd3b0caa2b66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957102, "uuid": "a3bb4297-4564-4faf-8eae-92a6dcf6337f", "comment": "Malware payload (Mirai)", "value": "9e966b85bc00a124a69addc5dd676cf54fe0dd4649b1a98a2bd9c447b852ca55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957102, "uuid": "ddef5f7b-d995-4062-b8c9-bc8161a53093", "comment": "Malware payload (Mirai)", "value": "e1fe0e20ee82c80041a65a4701d87d1629ff391f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957102, "uuid": "0c39ca7f-420a-4c1e-9958-8dc5f907288e", "comment": "Malware payload (Mirai)", "value": "d49b67c25f0d43919cc9a5e03b7c6aa58971a8d2e790df47e5e9427ddcdcfb7babe7681a9e1c2002516decd73e6097dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957102, "uuid": "aed23ab6-51ef-47ff-a0e2-16a975641b1f", "value": "T1ADA34D02A49080FED4AAD170879FD137EB32F88A52347B5F27807F711E36E526B5A691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957102, "uuid": "c5760b8f-e3eb-4aa0-b572-1aed20af3d00", "value": "1536:p7hAa3ZXMhXdnFpD7gtEOvsspH9uR86ewZWBHzppxdxjHWMbKn15NLorp:v3dMhXdFpOZteve1tLxLZb81I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785957102, "uuid": "75250599-2768-41fd-9895-cfa6df1fce64", "value": 104568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785957102, "uuid": "1f4e1b74-4540-454e-8cc0-cdf202655649", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957102, "uuid": "d6625c15-8006-416f-8bc5-698306b7b0b7", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa37a8df-90fb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785954599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954599, "uuid": "8ea46ebe-ae9d-416c-8482-4c63137a8ce0", "comment": "Malware payload", "value": "6a55e7aae749820e02dca30b81708b17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954599, "uuid": "48aa8274-6469-4116-9d9b-65731e027258", "comment": "Malware payload", "value": "9ecbeee2c88e701fe3d39e868c0a102cc77c033775f8fa9625ae83e9150a2a50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954599, "uuid": "0f3c66dd-eef7-4249-bd8c-002c1355ab56", "comment": "Malware payload", "value": "b231f6d3fab974fd07aa8e9d55a8d53436ca2f91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954599, "uuid": "d4fb2aee-5b49-4cbf-8ada-1d0bb264855b", "comment": "Malware payload", "value": "4bdb1f01cf648a258e59ef8494c6c065a87a865fe001ba728e6c0a30e2c2ca44526c3e1ed8c2c5c2454e108a202f740f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954599, "uuid": "57aaace4-5405-43ec-996f-0e498c43443c", "value": "T14925E657E89590F4C1FED134C626A213BEA13499073827E76FA187F11B26FE866BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954599, "uuid": "2d3cd64a-96cb-471e-96d7-666d448f443c", "value": "24576:ci3nHRD3wC7g9rb/TBvO90dL3BmAFd4A64nsfJ7FOQzjFyaZ:c8nxDgC7g9rb/TBvO90dL3BmAFd4A640", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954599, "uuid": "9e3aa4b6-604e-46c3-adbf-3e99106e9ed1", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954599, "uuid": "396bdf30-24fc-4e98-85cf-62165f167332", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954599, "uuid": "06fa1c67-d46d-4619-ac43-798709f1b7e2", "value": "9ecbeee2c88e701fe3d39e868c0a102cc77c033775f8fa9625ae83e9150a2a50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f07218-90cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785934430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934430, "uuid": "55efb44f-6a12-487f-b0c9-36e0b0613303", "comment": "Malware payload (PureLogsStealer)", "value": "8939944d8166c83426cdfe1abea64520", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934430, "uuid": "e8442f89-255f-48c3-b5c7-162ec5fe3fa4", "comment": "Malware payload (PureLogsStealer)", "value": "9fb63f6266dfbc7b3cb527d19134c13f51c2c3080c5242756296f2a7a090a200", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934430, "uuid": "c97a317e-3ece-4042-b2b7-36f9bea73bf3", "comment": "Malware payload (PureLogsStealer)", "value": "eea496d870cfb52b959313edd3278e0682aa9ef0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934430, "uuid": "b31de144-ffc7-4203-8c1e-a264d1b0c7d6", "comment": "Malware payload (PureLogsStealer)", "value": "ce4fda10aec680d0ffabf133813b9598887a37f799215e5e3e8b7723017fc0f30b47576293fed26bf52ebc22a9926eed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934430, "uuid": "1f733069-aef9-48ef-93f2-41e887129701", "value": "T16605AE6A76924E21D24A5372C1C7890087E6964736ABFB0F31C803D719437EEDE4A7DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934430, "uuid": "6b4bf03a-3bb4-4c9a-a491-69764aef66cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934430, "uuid": "1f26fdcd-e94a-419f-a660-2d9056bcebc7", "value": "12288:PNUplz80dKBPWk87r6Cb+Uwmr+5uMiPYd03tPdMLf:PNr+cIUk+Q/EgdMLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785934430, "uuid": "a57d0534-ff1c-42d2-944d-29ebab92ec9a", "value": 826880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785934430, "uuid": "6fb08db6-dbec-4ae6-8d43-61cbfc3d787a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934430, "uuid": "77837b2b-8f4d-4fad-be07-30731922eacd", "value": "Phantomx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6773e421-90fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785954057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954057, "uuid": "f8875320-9eb4-42df-9df4-108c01b72c63", "comment": "Malware payload (Mirai)", "value": "9143a4129611b9acba4c11142932e592", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954057, "uuid": "3955a7dc-8c4e-4dc7-b37e-f505a77203eb", "comment": "Malware payload (Mirai)", "value": "a1293c050fb0edb87c2cfe9bebf1b65e4c926325042a2273b8ce78d961a3efd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954057, "uuid": "5b545a3e-0ba8-4d5c-bd2b-9ade439a7dc8", "comment": "Malware payload (Mirai)", "value": "0d7418ad07cf82f3409e5f599d20866ee7707088", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954057, "uuid": "ad531181-2907-46a2-8867-192fad223a05", "comment": "Malware payload (Mirai)", "value": "d76e3ef8d66f2976f23b0b44b76a74d58994c5f4faff0a00e5e4d093a20773c5494a503f62be4cc11a1cdc8e2fad5059", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954057, "uuid": "d74dc169-74d6-4b5c-af56-cb84406d4e30", "value": "T14B4302E812A9E82B92B51E73DEDD044AB3E6293CD05F31258414679C71B874EFB9C4CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954057, "uuid": "db13eb4b-5e58-4bfe-809b-84621f199164", "value": "1536:GHaCyU2IB/u+YxICoo1baLFeSaS8SBlJt:GHatOUJHbaLFRNHDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954057, "uuid": "d28fa6ce-682e-4936-9f8b-3beabdd7cb44", "value": 60356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954057, "uuid": "5488c252-5868-466f-a64a-9ab6a24a99ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954057, "uuid": "4853cbba-fd21-4b3d-93a1-926636a96b5e", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a62e812-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1785917635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917635, "uuid": "d2aee1dc-50cc-4022-99d5-35c41da7c79b", "comment": "Malware payload (VIPKeylogger)", "value": "5aa2afd13dc3392b4b51c0220525a153", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917635, "uuid": "376c9403-c1b3-44f7-98df-32c16bd56b42", "comment": "Malware payload (VIPKeylogger)", "value": "a12d266e81b197674e3cb495b3971a5b10d024b9ad38049151225c2f4400ed96", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917635, "uuid": "2bd618ba-1448-4463-85e7-ffdfe58e12e1", "comment": "Malware payload (VIPKeylogger)", "value": "5a92300172510177df9b995df24472cb4dcebc50", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917635, "uuid": "1f099239-0a6a-440b-a8dc-32089a1b8791", "comment": "Malware payload (VIPKeylogger)", "value": "d4ca4d83d4a4765bf51f86136a3936186b3ec248069a5842e60bde36855f3c014ee8af77b3d69e420d7f30441e735ad5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917635, "uuid": "5c4e65a2-0ee8-45fd-b74a-68d4a543fde3", "value": "T105E50781178491B37B25ABAD6636CE319A0FA01325C6EF00356DE308365DD5FA36CEE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917635, "uuid": "7ae23f8b-3358-4e06-bd71-417c9545e3d2", "value": "98304:9ES+cGp7MBZCnFsIz5EjNxm+bO2C/UkQamflz/06lpzxB0kia9SZRHF4N92TzpD4:8kZuFBgHH62C/UTac/0679akiLjy92Ty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917635, "uuid": "eb0efcab-d6cf-4307-9c29-3b8b34e4561b", "value": 3154642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917635, "uuid": "738b2ee3-304d-431e-841c-1070c39cba16", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917635, "uuid": "eca743d6-05be-465c-9f3c-da4a4d8ee418", "value": "RFQ-PO-0809-QT0958-08-2026-M08600.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ccaabe9-9069-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785891709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785891709, "uuid": "ba8cc4b0-b5b3-467f-ad08-d0e58b9c9bbf", "comment": "Malware payload (Mirai)", "value": "5a5a3a3e3b119acc87697c4d482d7fd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785891709, "uuid": "9ec68f4a-0af2-4451-9e22-fa1570ad3919", "comment": "Malware payload (Mirai)", "value": "a1364a57e9114843e6a6707b196d5b824d48737abb66d6f3621215b6b0ebfecc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785891709, "uuid": "1aa625fd-1c66-4094-b606-2cce142d4449", "comment": "Malware payload (Mirai)", "value": "5bc9caa11427abb1a0e04b709075c397ec666f5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785891709, "uuid": "1adb5be3-a0fe-4c5c-9bf8-5c6d87605d80", "comment": "Malware payload (Mirai)", "value": "2bb08bf76fae66060787d8f14769914cb30f19f3d4e6bec3a30432f945aeca92530f9ef91200bdba901e9716bc3807a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785891709, "uuid": "ece51846-a143-41e5-ad87-de04aaae0d13", "value": "T145935BD4E643D8F5EC63053621B7FB3B9E72F5BD2128DA43C3A49676A823541C40AA7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785891709, "uuid": "1993d009-243e-49d9-9745-766e99e6c497", "value": "1536:WzF5mW9HVGK8nO3x3gXJP7TIbzGdHFvqZQcxrrwxFy/vZyt:s51VL3g5TTIvG1FWQeYFHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785891709, "uuid": "2e33903f-6d96-4122-867c-08609ad45569", "value": 95508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785891709, "uuid": "dabffdd4-7a5d-4b58-9af3-a9eb11ef4e60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785891709, "uuid": "4881af3b-30a6-44a2-aa08-b665447c1975", "value": "d8602f06298cba1a8fbd4c3a2ef8f68cb3e5b07f7d933bfd0e6184b4e683a1c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc3f1d2f-908c-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785906982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785906982, "uuid": "4c9f3d4c-169b-4af2-8539-eaec50b6471f", "comment": "Malware payload (CoinMiner)", "value": "b2b974505a22a1eed4dbc13351fe384d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785906982, "uuid": "9044265d-bc4b-46ad-b7bc-832f3317af19", "comment": "Malware payload (CoinMiner)", "value": "a1458a1071048fe2344df2226aaa74cd5e74e681d9b15500fd25b0d9f681b3e2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785906982, "uuid": "eef1a705-f586-464c-8cfd-d2d35b3c5d4d", "comment": "Malware payload (CoinMiner)", "value": "42d1df220fc41058b18abdf8e99fbe0215016587", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785906982, "uuid": "43f2e96f-b7c6-4798-bf0a-5139a2a8cce5", "comment": "Malware payload (CoinMiner)", "value": "24a9c839e6a0c37532e246d465c7d7b2ce0b6b2f2e79c847b6b15e2afad78c9bc9378cf886be53cffe2c3ab46d5f8af4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785906982, "uuid": "b7c6b8c0-5dc9-41ae-9c08-156f844c4689", "value": "T18432292A7E4A0331D3A049F85479428F653D6533A387E3EBF773955D4BAA2048840EBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785906982, "uuid": "57d31c66-03ba-461a-9680-db4f6598fd18", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785906982, "uuid": "51868522-80fe-42ee-b659-57ab43c5b55c", "value": "192:JNo+WGsTBMHx+ealq50AI50EPFJxTEZmFhSac3:JNo7KwpeWPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785906982, "uuid": "19326952-48ea-4d14-b28c-533dec233db9", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785906982, "uuid": "d0ee8da3-f592-4a03-83dd-7dd361d0f694", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785906982, "uuid": "a25c1722-b9fe-4500-b0c5-461167be1a4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa87f8b-90d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785937339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937339, "uuid": "6f1d0b02-f636-4968-a8b6-bbd6f4d1bef9", "comment": "Malware payload (Formbook)", "value": "b8748a4a21ab0a7e259de103c860800d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937339, "uuid": "cd1a174f-0e76-4dfa-97ea-afc2e600234c", "comment": "Malware payload (Formbook)", "value": "a1f37819e6cea4628b78e45fd5494075c1bec9289bc72b51bab984f7cda7a1df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937339, "uuid": "2abad64d-67ac-46d2-af92-01759b4e136c", "comment": "Malware payload (Formbook)", "value": "a8e089513933600280e3d72fec0018be51bdae55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937339, "uuid": "12dddcbe-99f2-443d-aa30-58d7d464bb4d", "comment": "Malware payload (Formbook)", "value": "9607cf105e84800c348d2df2338ed1cfc638c53043fded78aa7b58fe2e490bb0fbbea9ae139ad9363f7d151cc293f46c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937339, "uuid": "51c9572e-fa31-41c9-ac18-9e390463e8dd", "value": "T1E72512286396CE22E4EE87B51C76C37503725D9DB416D3299ED9ECCB3621B085C847D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937339, "uuid": "104f97e7-218c-4918-a6c6-9ec96b9ab3e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937339, "uuid": "c70b1373-44fe-4575-8d7a-c35182cbd12a", "value": "24576:UUhOb85LbBLjX+GKXPGp0wC+PoT3CJk77xt2zEV2vsm:U5w9B/X+u/m3h77KE2v3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785937339, "uuid": "d9143585-d53f-4c36-acb7-e2e146a38207", "value": 1027072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785937339, "uuid": "50091300-a34d-4bd7-a543-5c3fa27edf3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937339, "uuid": "a04aa112-d032-43b9-8d4a-25121488a322", "value": "k4aVruZ1gk0AjWh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded82199-9095-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785910878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910878, "uuid": "cbbd0bbd-4906-41b5-90af-b336619919f6", "comment": "Malware payload", "value": "c919dcd9b0fb3d0c2cf38aec85096df8", "object_relation": "md5", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910878, "uuid": "56cf95d7-0363-4df4-a820-4417dda52c8c", "comment": "Malware payload", "value": "a302fcab4d90b6101ac2a2ade6f424977bfd59967b142921280084c7d1179d00", "object_relation": "sha256", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910878, "uuid": "64c45905-08aa-45ed-ac29-97ef10663b03", "comment": "Malware payload", "value": "a8e4fe39178ee7f9a0881b50f16a2bc2b8ab681e", "object_relation": "sha1", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910878, "uuid": "4e5f10d7-91e8-48d9-8ec0-4d33ca06baea", "comment": "Malware payload", "value": "0e5fd2545a16d545f104800d23f35eee5acb0506e25309128ea771c328641b5b61854961c39df9869da27dca9d7e83d0", "object_relation": "sha3-384", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910878, "uuid": "a00902a2-fece-48cf-a6d0-75a3374868e0", "value": "T143D5238E7DF71AB1C837C3BADFC3E4AD71157B844B618E8A7AD968008E119581C36379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910878, "uuid": "beb16c69-2488-412f-af77-87e1f0d71687", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910878, "uuid": "54d2ad0b-3e15-4dc8-b1b3-5854070693ea", "value": "49152:Bc0QxAgxd8g8tyuCnspFZFkZyB0cV9ivmxu7pCevJeDJ75/RVHlKckuYRoEQYRe5:Bc0Ad8jXCnsb3kZyBZ9ivmx+p7vON9Rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785910878, "uuid": "f1a2cb42-907c-455b-80e9-c0e2fe506d46", "value": 2985472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785910878, "uuid": "c7290ffd-2395-4952-9204-275a0c5d2499", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910878, "uuid": "7a66202c-019a-46bb-a08d-736d8534ae20", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29df2468-9071-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785895113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895113, "uuid": "ddb7823c-964f-486a-939a-02662a549721", "comment": "Malware payload (Mirai)", "value": "bffbfc243a228af9ea95ccceb3e578c6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895113, "uuid": "1c237ed9-dbe7-439d-9b4a-77d396a9e789", "comment": "Malware payload (Mirai)", "value": "a374f3ebc886eda122ca1229138b8a31ce0758addb60c0dd38052e5a95b3d37d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895113, "uuid": "07303db3-656f-490a-aa3a-01a114ac225a", "comment": "Malware payload (Mirai)", "value": "6f7e5aa9716ac19035cb2a42edae24b6de44307d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895113, "uuid": "8a4027fc-d696-4b73-84a0-a9d2b3d41495", "comment": "Malware payload (Mirai)", "value": "c79f02b46013680236de09ac6d94ef29afda0562d5ba4c83a6a1c627302075b4161003d35e6eda4de85eae63a7f8595f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785895113, "uuid": "4ef26c46-2424-4d15-9b67-5253343d3d1d", "value": "T1EB01AFC9C400AC0090AA9E5D26E75554F810C3CF1A9A4FB9BF9C6D3EFB88D14B066F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785895113, "uuid": "f163006b-9f1b-44d3-9678-3f034b93e4ad", "value": "24:kXCKysE2hi0ziQvZoha1M1prF1fbnte53X:e9Qp+Mse1dF1fbnA53X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785895113, "uuid": "f55e02a3-0785-4fc1-a589-561b7b13407c", "value": 844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785895113, "uuid": "60b9b417-7094-4284-ae98-7c021020760e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785895113, "uuid": "28d1081e-185e-465e-aa9d-5c6bb12977d1", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2bf7fe3-9094-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785910348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910348, "uuid": "ba2e6964-a98c-4d35-8f0e-89dd351d5b2a", "comment": "Malware payload (Mirai)", "value": "2f13b930507dd0d3a6cd0006f9ca2da5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910348, "uuid": "828af891-c6f0-4109-970f-f95319dc529c", "comment": "Malware payload (Mirai)", "value": "a385a0c2b4c7f355d083864e1fa0ed1d15b2dc3c316aa26da6609354a9821bc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910348, "uuid": "b3781648-3111-48e0-b315-c2026e4219d9", "comment": "Malware payload (Mirai)", "value": "3d963ae90f8076c649a94e318de37c0c8bba2fff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910348, "uuid": "8f9f7cf5-12c4-464e-8770-d0856cef8c93", "comment": "Malware payload (Mirai)", "value": "ec534a2aafa1ca53e04afbb6425425335395af76c8e5195f33eac52c3a15dd050c60c647660909391b5200525f4364f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910348, "uuid": "6b2d2809-9852-4506-b290-59543a7cdbfd", "value": "T10294E05AF7572E42C9C7D635188551869B4CE4A733F383463B46A9BB38393368F283C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910348, "uuid": "f4c7ef7a-dd16-43e2-8e9f-6edf3e903492", "value": "6144:mAuBXllWaOzRIbXYM08oieaOthcFD2+PQmGvguNk3yfgpW1H8pLj/0:8lPOzRIbXv08xLQtgue3yfgyH8pLj/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785910348, "uuid": "5e96c91a-3a48-4334-9e2f-f886e5ce3f6c", "value": 432528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785910348, "uuid": "a24a7d7e-d76e-42ae-b56b-5f2a90d70133", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910348, "uuid": "26f92c9b-7e20-43fa-9f7d-054083327eb3", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5349be3a-90a4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785917087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917087, "uuid": "ae862f55-e346-4fdd-ab63-d59940f1a283", "comment": "Malware payload", "value": "a6eaaa8227e12f68d35a2bbe3b48b5c4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917087, "uuid": "7cf1b165-2c82-42a6-b019-3a6620a4e7e4", "comment": "Malware payload", "value": "a3f4345550b41593dcbf1f5e353b98a7cdafec3d960a7defa9ad0cf2da5fd292", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917087, "uuid": "3e8457d3-7f6c-48c1-b59d-1e3a3ceebb9f", "comment": "Malware payload", "value": "d58fe21354552084e11e9ff6f19cb8a6f1c3d154", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917087, "uuid": "1bf74ef9-3f10-4198-ad22-2b324ecc6eb0", "comment": "Malware payload", "value": "9661f20955db0cc4ea10fc9b841394ceb43f33c1d73d66704c596dff7a64c7eb34aba9b3111ee84494d857c38a5d3cb2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917087, "uuid": "86057b1d-7a05-4ebd-a98c-e7a461658430", "value": "T16BE3358DBDFB2412562370399E7F8408B1394947502CCA5876CC9290AFB162DDFA7EED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917087, "uuid": "4ca83a30-481a-4f84-8826-019a7a69e18b", "value": "1536:YWVJfZKqR2XyFXhRf/QLxsiXXo1N49fE/bamVrezGsBDyv9:W+bmI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917087, "uuid": "65668905-adc2-476c-8b08-2d7fb36710cb", "value": 147949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917087, "uuid": "41a74f30-6ae9-4d02-a42f-93b3e1ca41af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917087, "uuid": "f57b6db2-1240-4f02-9ff2-042d887fac91", "value": "chunk-GC5FLHL6.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aacc77f4-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1785917663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917663, "uuid": "f8c0f969-4bd0-43ac-87bf-e481ae27d0c3", "comment": "Malware payload (LxBaseRAT)", "value": "c10ecf6d85b582b5fa07f94fcf81970a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917663, "uuid": "1cecf6ba-2bcf-432d-92a9-6c997166c68a", "comment": "Malware payload (LxBaseRAT)", "value": "a489011e9d9032bd18b8b553fdb9f483e8f525d6e0211673172369d2792852f8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917663, "uuid": "76f73c61-db79-4d14-b615-92478b99c5ad", "comment": "Malware payload (LxBaseRAT)", "value": "3ceebc228e722a955fb933ea6131b254caf20023", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917663, "uuid": "42b68d22-97ba-4581-a74e-5212e0b60347", "comment": "Malware payload (LxBaseRAT)", "value": "1d2776a73ad8054af87949793fea4c375d865bfebee97b41085d8f5eeac924babe8b0601c0d4386da78526cd1ed4c8d1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917663, "uuid": "48e4f6dd-94df-4e47-ada5-a1f9a027e8d2", "value": "T1B2559E4B1969713D176109FB9F34B879E2F4877812E28BE272F65300B6B5169C183CFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917663, "uuid": "d9ed0330-2b62-4835-8bfe-3fde07493beb", "value": "24576:ACoLNQMoNXyXWD+93W1JRC4TmhlIwSJZy2klkIt+z6f2ZE6eFT5I1cjyReZbT2e:iL6lNXx+93WXRC4mlIwUy2klkI4M2ZTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917663, "uuid": "ee8d6a5c-6774-43eb-9cdc-5cb6b863abdd", "value": 1398661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917663, "uuid": "db3300a6-dc29-43e3-b367-8bd38aeabe1a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917663, "uuid": "1b1c8fad-0818-45e2-b40f-23f20bdb8f94", "value": "ORDEN DE COMPRA_.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932ae614-909c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785913758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913758, "uuid": "24bdca16-2895-416f-8028-95f1084be287", "comment": "Malware payload (Mirai)", "value": "0fa245782802ac5a5233a91449fdd8bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913758, "uuid": "91fe6aab-3ce7-480e-80ff-9bc2ae0221db", "comment": "Malware payload (Mirai)", "value": "a4f3037f3fadc5c722347e10fd0570109fa7a9630519985f675943e6eae10db7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913758, "uuid": "518e8879-fc48-4960-884f-5b4fc056eb02", "comment": "Malware payload (Mirai)", "value": "9cc445f65aedacf5b9de5c5b3fc3aa3a4fd89a7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913758, "uuid": "dee6626c-ef5a-4f2b-8233-162de7ea169b", "comment": "Malware payload (Mirai)", "value": "ef834a983da2ba1116503502d88c62ea6f92980865f7d9a38b97f1293795f6bf7e104ab062f797fa9934d7f46bbe7cd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913758, "uuid": "dc7d44bd-bd9c-45aa-b723-75ef77243764", "value": "T1A5732A2ABD518F19C4C0167ABF1E534D73132BB8E3EE7213DE146B24778B56B0E2A805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913758, "uuid": "214bda87-442d-44e7-999c-f1433c6b0587", "value": "1536:rznoqFOHkfR13QBmjyGRH9G+4GcaTYYjzAIXiqAuKJEBEM:gqF+0ewBuaTY43AuKJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785913758, "uuid": "102151b4-6744-438b-a886-1672b56b5d8a", "value": 75468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785913758, "uuid": "270a9c12-40ed-42a6-8e7d-5d84d3597783", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913758, "uuid": "df808b92-a66d-4309-8fca-c140aadc047a", "value": "6no", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26f02c2-90ec-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785948277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785948277, "uuid": "5320294f-7958-49e2-a0b7-e86151a06119", "comment": "Malware payload", "value": "70ff5b719918afe2538d3f062ffc39f5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785948277, "uuid": "ec08d804-481a-46bf-a156-4ddb310d0cfa", "comment": "Malware payload", "value": "a5f5b7f2eed63b2fad2962b3a2077ddb38530bcbf49e7ad6cd70addefa573958", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785948277, "uuid": "2df16da9-e3f5-49b8-9d64-3f3d0f2bf8d3", "comment": "Malware payload", "value": "dad0727ccc9ef373f30e636613599ae3d070a652", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785948277, "uuid": "b7b5c6a9-b7ff-4784-9d00-1740bdac2f51", "comment": "Malware payload", "value": "30337c1866d832ab30d493fa034f7b0267168a72aab463b647148725c2be083f18ea5ac6526ca43b4735621e55793054", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785948277, "uuid": "ce2eda80-96d3-4ec5-a04c-7ca7c83c3eb2", "value": "T1920188C58210694080AA9E9C22975059F411C3CE2E5F8F68BF6C6D3DEB98C14B036F8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785948277, "uuid": "9b857169-d8a5-4e98-a3a5-67022ae13fa7", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaeC8F5CPFU8CjSIbT7CsWiRFCEI5fBX:kXCKysE2hi0ziQvZohaeN5Qbm7FF5g5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785948277, "uuid": "061861b3-5480-4cc4-b19c-6e27bfb62771", "value": 852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785948277, "uuid": "391f48d8-5f70-45c1-b286-7c8f96c2122c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785948277, "uuid": "2f411e82-2eb0-4283-aaff-5cf93d7cdc17", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4596be-90cd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785934797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934797, "uuid": "b9ea1ad5-0611-4e05-9fce-9ef42502e82d", "comment": "Malware payload", "value": "57c0126a498c8e0ac144a6336b0b26b0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934797, "uuid": "9c499282-cb49-429e-a5f3-261be109686b", "comment": "Malware payload", "value": "a689980d9b3fa814dd089beace69787c6d95ab8ec55067cdee09fb7aa753ab93", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934797, "uuid": "2f4f95a5-a661-4fe9-b977-97f863b99b6d", "comment": "Malware payload", "value": "20feb98c15cf5ee8f7b7e078f75fe8192da43231", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934797, "uuid": "bc6a4ecb-71d6-4f99-8feb-adcc35deac12", "comment": "Malware payload", "value": "48cd1fb4c894ff03090c7dce3944eb2960148eaf38eeff8cbabf8698703c3892de7277b5fdb8a50ad22c653145146376", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934797, "uuid": "34655f3e-7a6c-4413-a053-1ad6429b19c6", "value": "T1BB93027CD212A86E2847DF22E940CC6CB575B0509903B827C94D7BFEFDA517423BA627", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934797, "uuid": "627a4178-e144-4ffe-b1e8-3159b1806980", "value": "1536:U2Td7QJeVkzTOSv6zN3YSSuCwww1E01bw4pznMPphfgRRE4lcbzc:YuCwww1E01bw4pznMPphfgRRE4lcbzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785934797, "uuid": "a7a5c597-508c-418c-848d-d445f4f614de", "value": 90478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785934797, "uuid": "567de23b-2b4b-4730-b44a-b74bdadb4180", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934797, "uuid": "23a1f3a8-0b01-49e5-9ff6-280e1f7b8af0", "value": "Document_20260500077.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba2d7cc-90d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785939408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939408, "uuid": "5498ce0d-a126-4ba3-bd18-34b3f68cb9b9", "comment": "Malware payload (Mirai)", "value": "539cf4ef1e4469d47bcebd2275c3d95c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939408, "uuid": "b4f3483a-dc49-4fe5-b143-b1a89ec8d0a0", "comment": "Malware payload (Mirai)", "value": "a808d20075435a81c2e0bdb07266af18906418f5f0726d86f33ef6d663102cfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939408, "uuid": "0b0781d2-e0a1-4567-bf71-ab5aefdcfa21", "comment": "Malware payload (Mirai)", "value": "58c7cdaecec4c177af77bb750e04da308d2be581", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939408, "uuid": "3aee59e5-7e98-4581-8d4e-d26c087994cd", "comment": "Malware payload (Mirai)", "value": "99e976d92444a02c96f325fa019ed0341b40c66d2842ddb22386aeb01d40783b41be6727cf2670bed69d0e0ac98f2e95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939408, "uuid": "6aed313a-f79c-4a43-86b8-15f01be8eba1", "value": "T1C925A08CF6AE7D86E3CAF7389709E661652B35B1F25360A33547521EC2D72D4CAF1820", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939408, "uuid": "6b9b188f-76c0-4ab6-b699-4d7c6a0f6895", "value": "12288:63nz33klgdBwyRJU5u7iyjhMu2dt2K7qCyqWYwBH5tF35OjX1SM/aHyob9a9yjPm:6TTBwy6uXhMdCXtF3k7cM/aHyHQRod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785939408, "uuid": "16de3517-4703-4a21-bb75-8cbb124a4a0e", "value": 1014440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785939408, "uuid": "1f62fe3f-19bf-45b1-9658-32f4b9c2a93c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939408, "uuid": "76ec5597-3a87-4936-a7cf-8cbfa246923a", "value": "bot.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad9dc92-90ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785933608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785933608, "uuid": "3b65a72a-5df3-45de-a171-8f40c48341cc", "comment": "Malware payload (RemcosRAT)", "value": "6ba3fe34b8f8d531b3d711ef8663de70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785933608, "uuid": "8a64814b-44f6-422a-857a-e1e5026cdb2a", "comment": "Malware payload (RemcosRAT)", "value": "a82ab47795a1a4a04da0b73a9597a58072fcb05ce9ac83ba8f922c11d74b8457", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785933608, "uuid": "0c43c233-0322-47c6-8fde-5d22ca54852c", "comment": "Malware payload (RemcosRAT)", "value": "39d35730483dc30b8e9f11135e51648065a92b88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785933608, "uuid": "20ee1309-a143-4d4c-84d2-c146c95c1b79", "comment": "Malware payload (RemcosRAT)", "value": "26b2cdc0b5691a94d2482c3eb92884f63fd009b1afb8641014c651b1fdce8275adaac459dc3eb8f133bf7db1ed52ff7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785933608, "uuid": "2999ddea-b82e-46d4-8a15-9f061cc0e42e", "value": "T1C1D47D4AA3A441F4D077C235CA838537E6B2BC056670862F13D74E5B6F273A15F2EB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785933608, "uuid": "4f948129-1c29-4bd4-8f96-f46d70a8a436", "value": "0cc8e2c6f08a90a370d78009080edfef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785933608, "uuid": "555bfdcf-c6f2-48ba-9dcb-22f5576241d1", "value": "12288:oZL8K7flZQP2MfAeWoqOKpqs3+Jt6eJcJYYoF5Zr:OQKjlZQuaVWoqVpqsuJt6YcJYY05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785933608, "uuid": "4a1eaad3-80ab-485e-8c93-de04d4658943", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785933608, "uuid": "cf89c4de-329f-40c0-9348-8a5cf4ac3d49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785933608, "uuid": "ea674a8f-6ae7-4f50-a9e0-6034e2acd131", "value": "64bit-remcosa.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a310c33-90c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785932533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785932533, "uuid": "3ba6d8f7-4933-44ca-8492-d098ad73b996", "comment": "Malware payload (Formbook)", "value": "6e8dc746e0f36cf511000b784d8a73f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785932533, "uuid": "2349d923-1f8a-4c58-a4bd-3f4d59ca8b3f", "comment": "Malware payload (Formbook)", "value": "a82ac9bbd0ca656a30fc08280b2a997d648c93dff8783c49510b8f5d8c6ba821", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785932533, "uuid": "d38debdf-7252-4844-a5a7-47a2d27c626b", "comment": "Malware payload (Formbook)", "value": "d2630878f04fe84fc7393a6643f0215cba06dd28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785932533, "uuid": "9144658c-5104-4605-a0c7-72feae1d3bad", "comment": "Malware payload (Formbook)", "value": "c6c97937ad4e9393305688b76fd1ba00ab2fbd2dccb12e296c73187f639a188ed8b54580b7970d52a9050ef0343744d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785932533, "uuid": "b917ce6f-6ad9-4e8b-9286-d0ebc9ade325", "value": "T18AE51A40570998B17A3D673DE5376E201B1EB00751C5EF1E36BC6608B3A2E6B639DCE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785932533, "uuid": "7ce7c8d1-04c4-450c-b02c-61a6f3af01ca", "value": "49152:a5jwDAR0wbsMVT421omoyrNIGF7jEz9s2aPQHG2CKmiWbSASYs51DA8TTYIWqBWd:apwDAREMVTfomXryG6z9snG/miWbSASm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785932533, "uuid": "fc4519c4-14cf-4a4d-8395-915dfe4e2c5b", "value": 3092552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785932533, "uuid": "e6ea6380-2560-4823-8558-332c188e9870", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785932533, "uuid": "011d0473-d9c0-43ca-9481-93bde0e962c9", "value": "A2026_ORDER.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de03556-908e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785907548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785907548, "uuid": "e54362b9-a67c-4c96-b7f5-71d6592470e5", "comment": "Malware payload (Phorpiex)", "value": "a0f59c023d0939cd5d905499b40d0ef9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785907548, "uuid": "d912a951-277b-4e14-b7ab-18e5a48e55f2", "comment": "Malware payload (Phorpiex)", "value": "a8f34e6c23dd2704852855eafcc55cb2d5e300dbfa6cb596d44578e689f0239e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785907548, "uuid": "0147968d-5ed3-40f0-b409-5964c89e0b86", "comment": "Malware payload (Phorpiex)", "value": "cf67886b0702e67bdb39d0dafdaef34bbe2064a6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785907548, "uuid": "fbb9b02a-29f3-43e4-8e54-0b08b9291b10", "comment": "Malware payload (Phorpiex)", "value": "2a5a7c6d6265543809f42430ba9ee8659062561dd0420c26212370949fba74d2531d1779933dd9234b3d9691896b1367", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785907548, "uuid": "9a7a3e28-7caa-45ac-a715-0ddf4215ac03", "value": "T1EE824A0FB9424226D0E110B09676967BDA79A87633C414DBF7E48AEE0A6C6D1FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785907548, "uuid": "0a72cff6-7757-432f-8eca-131a4e9c9947", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785907548, "uuid": "ffd9ec16-0111-47d2-87b1-81d3951b15a3", "value": "384:RL6I8/V6l6Vqo0HlmLu94gXTcolmxav8U9ccbl:RLf80Ht9j8a0Ub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785907548, "uuid": "0a4fa4c4-541d-42ca-9242-78167601d0ef", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785907548, "uuid": "a6123ceb-0299-4bbb-aef5-068b97dddb29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785907548, "uuid": "747ca8b9-7581-479b-b450-a1fb1c8e314e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93399d9f-90d8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785939528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939528, "uuid": "9a6a454f-e47b-4f15-9d4e-d65cc3ec154a", "comment": "Malware payload", "value": "7c0c54316e665402119cf4d2efc19de9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939528, "uuid": "3f3f2959-b7c2-4258-9765-d8bb80193ea8", "comment": "Malware payload", "value": "a9409f293295847a21bf52c691c29405e098b46480cc5c25b3bb2f81e72ccc82", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939528, "uuid": "7d770f23-e372-4a6f-acab-30579fc38d66", "comment": "Malware payload", "value": "3107a80f3a83dc75e90749aafaf56f741a53c524", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939528, "uuid": "df656534-d609-4171-889d-756ae05668e1", "comment": "Malware payload", "value": "b1afc7520d765525eb8655ffd85e7161d6adf1c3e888f1dc555ac29fc8a2f162df4701315a2ba125406ccd78c95435cd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939528, "uuid": "67faacce-9ef9-4d11-bcb0-74a049acd5a6", "value": "T118236C551A857C14AE98C4371D7E2F0CB9AD43E6320852DE7FCB3CF28C8AA9D920971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939528, "uuid": "2171fb52-38e0-432a-942b-c6a13189b20e", "value": "768:ZVEJVIhtMv9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:3EJ2MIcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785939528, "uuid": "b4f76037-8c1f-4ab3-8662-287682b39117", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785939528, "uuid": "1e67d1ad-f0f7-4695-bcb6-18ed50d93eeb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939528, "uuid": "eafa0881-1d43-4161-ab4d-565fdd0c6e45", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70662d7d-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917565, "uuid": "8d109a1d-481a-496c-8aac-b9fce459e562", "comment": "Malware payload (AgentTesla)", "value": "de9af8ff80ae361cb67c55e6f0f584c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917565, "uuid": "8604b038-af9b-4500-9e9a-66bd29884c21", "comment": "Malware payload (AgentTesla)", "value": "a95d05b4e65068bbe109159b532397dff6b83e171aa160a2dd59992dfe1570cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917565, "uuid": "e4071841-4ab9-4a0e-8c9d-bdaccf5b712e", "comment": "Malware payload (AgentTesla)", "value": "4fdcef4ad4eddd627a36d13fdad9c4f7a9596cda", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917565, "uuid": "3b3f76a2-a7ac-4c0c-840f-90da517752eb", "comment": "Malware payload (AgentTesla)", "value": "05a03a5b511ec866dd0262046d3b31009fa581f0ab771c743b0b10a698307dc2dba476c07d38839bcf25f7f7ff3d6848", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917565, "uuid": "b5c14696-a9d4-4e9a-a501-862d6b37cafe", "value": "T1ADE5D5D11788A1727720ABAE563B9E709A1FA01319C2DF00366DE604771DD8FA35CFE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917565, "uuid": "a0ce6177-f31c-405f-8f45-9238ae494990", "value": "49152:y5mvYXjro5DMHPA7VisydFKEiAi2vgD9KKjQqEbVWKuYmrt/vN3732htfZOhluLa:mX34MvmKdwEfi8VKjQqiEKuDB/vNrGRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917565, "uuid": "57f827e1-3b2e-4a83-a3bc-55bd667a7306", "value": 3069080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917565, "uuid": "1624e743-6129-465d-9760-a62953300aca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917565, "uuid": "7ea2a39a-6747-44e7-9bb4-d7bf4e3e9def", "value": "Inquiry-IA04.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f284fc-9072-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785895697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895697, "uuid": "4504ef63-a8b4-405d-8e17-b6366fb4b35c", "comment": "Malware payload (Mirai)", "value": "db7eede4f6d1c21472c98bf96cc58502", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895697, "uuid": "84d7e42e-bb58-4423-be18-9eca1b8d9fc3", "comment": "Malware payload (Mirai)", "value": "ab1b6934bc586d442ec14067cb8075b94f66e0981c41fb308758ba7949eaa437", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895697, "uuid": "07dbe944-9307-4fdf-aeb9-08e3c7c10e20", "comment": "Malware payload (Mirai)", "value": "6e7fddff494ca0be5191d02548b7aa771fd9bd97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785895697, "uuid": "4d8c59b6-922f-4ef3-9ff2-bc047a1d018c", "comment": "Malware payload (Mirai)", "value": "a5f89ae63610d403451692e35f3b2ea060332ffa78ebf2d2fb137544c8c8683d848dcbdaa30d5224afeca8a80ba33845", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785895697, "uuid": "bb8d2188-28de-4948-87f9-f0297a9c2a2d", "value": "T172D3127FDA79083BD5399074A99A23A56E7D69F7B003F4562E4AC3224C70F2933532C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785895697, "uuid": "e50b802a-345a-40f6-89cd-3dbc39ca6dd1", "value": "3072:R+kzsw8M5Ppwa3YT8htu9s4N3Bj5jVD869V0yJIjVM:RLzswL7Iutb4N3Bjh98TyJIRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785895697, "uuid": "d9168ec0-a80e-4a71-99f4-0321f7df0709", "value": 132316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785895697, "uuid": "f5439d77-5221-4ca3-a5c4-a94120254118", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785895697, "uuid": "02ddc5c6-e9ac-4269-83a4-fbbb3e0cc267", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d06d8da-90a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1785916754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916754, "uuid": "8c3f5d98-e912-45d1-b150-8f3e94a3564d", "comment": "Malware payload (AsyncRAT)", "value": "4ecd704a047acf343c07692c4effb6ac", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916754, "uuid": "22c6398d-63ab-4f21-9238-e2a9064c371e", "comment": "Malware payload (AsyncRAT)", "value": "ab5989434d881ee820ab8b03af8ef256561428fdb4b3efa99e4c7c5f238f6ff9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916754, "uuid": "8dedec57-af92-41e9-bd5b-c3fe6823b998", "comment": "Malware payload (AsyncRAT)", "value": "3a21e9eca2de6e6fbb7a6531abe13ac2c0ea7308", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916754, "uuid": "b17cdc48-efe7-485d-8f62-8f7355ef46f7", "comment": "Malware payload (AsyncRAT)", "value": "577d05d3610dc39b8771964eb2bf3d2a4ebf2d48e37fcaa95cd2fa7d78303ef61658e0716291bdab53a947a25d19e18b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916754, "uuid": "06cb4990-2c9f-4bb4-b1ef-a6d7def87c91", "value": "T178248E57631A1DB40FC2EF760B4FB3EA198479384F3DA4DEB288F39162D9AC1A4D6414", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916754, "uuid": "12d75f90-6c8f-41dd-81c2-1acc033f2d64", "value": "3072:QjZdlLJreZBkR0psctntt75L8zlwsTKFxesa80kaniYcc2IpAbKhBwi3yf3ZlN:QNvQIgsmXVLCugGjRQniZxmhBwi3yvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785916754, "uuid": "a359eabc-46ed-46a4-b0ed-b0da5b26c7ae", "value": 212551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785916754, "uuid": "fcab7b29-59f2-4bc9-8bba-c84a932f6d4b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916754, "uuid": "8f85bbf6-956d-4ade-8a56-be3a56832e44", "value": "Account_details.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d6f3d1c-90bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1785927063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785927063, "uuid": "b8dc3422-566f-4dbf-995c-b1318b07cd5c", "comment": "Malware payload (AsyncRAT)", "value": "139b69f60d72fff883de4e0a24a1530c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785927063, "uuid": "eb68d222-fafa-49fa-864f-20ad50780a4b", "comment": "Malware payload (AsyncRAT)", "value": "abb9339b50965790e597dd7989e008bcc887c12b5f73d9c7cecae8e35a571d58", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785927063, "uuid": "c86a189e-5771-4000-91e9-413dde771547", "comment": "Malware payload (AsyncRAT)", "value": "323932bfe3d0c2b1baf6ca1f4070daa22ee0259b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785927063, "uuid": "1c1af769-4cdc-46bf-9f9c-62e5e9647251", "comment": "Malware payload (AsyncRAT)", "value": "af14a1527aff27398360f7a17a9d3673242b7062263d8198cd928640c2f5e53cdc17363f51f715ab7222c022909f16db", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785927063, "uuid": "9e14853e-f80e-4d42-a833-969abe3a407b", "value": "T1E3050BA12BCF70415726772A91489894CB1BD43A4642F5C670EF05849F6BC8BFED0EBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785927063, "uuid": "14a5e41b-6648-4223-be7c-8f6ba4517d7a", "value": "12288:2/clm40LSLbR+TsLxrkbYCk2mLDhpIOG0QevagRND:Q4oSbRos1gbDqIRRevagPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785927063, "uuid": "0f0c9813-7028-4138-982e-4e624a5f6755", "value": 839794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785927063, "uuid": "e032c26d-2764-409b-aeca-9df65e2ecd33", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785927063, "uuid": "ee5c1c4a-4736-463f-8795-570b89de79e4", "value": "Machine Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80774dd3-90fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785954099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954099, "uuid": "99c5e874-7a1d-4db0-a799-3e2ae99449c1", "comment": "Malware payload (Mirai)", "value": "8bd25429d82a50141174ff38f070c12e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954099, "uuid": "fc28f866-ffbf-4959-a349-14b0d6e56493", "comment": "Malware payload (Mirai)", "value": "acf82de8cda10bbb86cde11f8f589fce1edb24b1b2a5f8a30a39f5147e281916", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954099, "uuid": "c5d35785-2499-4132-85a5-e3d7beadebe8", "comment": "Malware payload (Mirai)", "value": "e104e813a2d0779bd7081b38c6677847107fc678", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954099, "uuid": "9005208a-17f1-4ca3-be2a-6627ff028f41", "comment": "Malware payload (Mirai)", "value": "fa0a113e49a0a75ef973e7626f556999d46e1f7c68a8c59f7b28867a642e938585412b131044d4836c6415bdd8a17296", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954099, "uuid": "f1d16797-fb98-4e8a-8825-3d9e7eeb01a1", "value": "T163634C42B31C0D47D1635DB42A3F17E183BFA9A120F4FB89651E9B869276E321186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954099, "uuid": "ce6cb80d-bfe7-485e-9b29-a4b4b49d6818", "value": "1536:jIODpMBfPHVlAJ5kw4TvFQLPXsWfeeIF+5yryD/Fhqs/n+5:kqeN2J5oENeeIY5Ly5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954099, "uuid": "686bc0a3-b58e-431e-8bf3-50831d238b66", "value": 73292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954099, "uuid": "28818848-d065-46e2-9a5e-0d7ecdb2bb98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954099, "uuid": "ba5e65a2-b18d-42e6-9e6a-84ccb7eadbd2", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a5e44d-9089-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1785905353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905353, "uuid": "c6c58d5d-83ab-470d-b234-b18f2f0bb45a", "comment": "Malware payload (AsyncRAT)", "value": "895613a0ed1a6190d3aa352852ebf7c5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905353, "uuid": "d38ea8ef-73e6-4639-8e0a-c5a1b7adacc5", "comment": "Malware payload (AsyncRAT)", "value": "ad6aae00ed364f056b66a28bf14678cccd0bc79c68cd132717c9e1d01a81253a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905353, "uuid": "74759e9f-c72d-49ee-ab4b-190d2914c73f", "comment": "Malware payload (AsyncRAT)", "value": "3a3fe2f977bf1e7944a08b88b4882bb1164bb002", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905353, "uuid": "f116614e-6c29-4a8e-a5d7-6bed661c02f5", "comment": "Malware payload (AsyncRAT)", "value": "f98f5f304139a6d291a39ae9d067075feaf793e4eeaca19eec938fd0dd91d99ffbae8476d12d70c739d8206e63c6dec2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905353, "uuid": "2cdcde57-7a9b-4aa3-a8ad-0b80421a1fb1", "value": "T150575D1F98D8BAC6D5B14C7FF1745FDB0C3E2DC813E2E076158866B938E289A529025F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905353, "uuid": "4961043e-4dd7-45ac-ac9e-bebcab5b25bb", "value": "192:Joqt4fgDkGzX10K8zVyQ+JA1qF7ZlZm8/8WEkuHfX/3N7De0+NXgggJocggYk9UY:B2yZwt+Yo2HWWoyXceg+t2ee8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785905353, "uuid": "24f74d20-8887-41b3-80fc-7d9b8a0e2859", "value": 27547088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785905353, "uuid": "338e2137-0c30-45d4-9b6d-ab3ab65dc400", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905353, "uuid": "2109ebb2-4239-462d-8de5-fcf688915913", "value": "eds kairos -confirmacion importante del soporte de pago -estacion de servicio el kairos.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ba34da-9101-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785956982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956982, "uuid": "779e4f75-0d4b-459f-b9a5-08eb92f1ac8a", "comment": "Malware payload (Mirai)", "value": "eb0f7075efdb0a6e8cc8e0ca218886b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956982, "uuid": "33b566d6-00f0-462f-878b-5796002f9fbd", "comment": "Malware payload (Mirai)", "value": "ad90f50613ddb906e0d714b168614380c24bebd640f4062f0cb2f9277a48caaa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956982, "uuid": "c76a7a30-f53c-4050-b061-7169f77ec850", "comment": "Malware payload (Mirai)", "value": "7cc7c43c8d9defb0b7d62c1ccff22a086d27d81d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956982, "uuid": "08a1bb89-c865-44ea-9f9f-c0efdddcb85e", "comment": "Malware payload (Mirai)", "value": "8e7a157c8d21aa291259d1e01f8249490248a66b960e091f11d38be727ad8f633d70a35746fa68989a462771c8eed8f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956982, "uuid": "9744fded-a0b5-4d36-887c-80c9a54707c4", "value": "T13CF32A89EF650FEFD46FCE30021E132719ED589B92F16336467CCC58B69E2584AE3858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956982, "uuid": "603a4557-13dd-4aac-a862-da675d325940", "value": "3072:Uio4wQ9vIchp9wsJqRgc5a/a7pKrlFIpkgW93vJAMsRGyEJLLfAZeUKl6QaU4:5o4wQ9vIchp9wsJqRgc5a/a7wFgW93W9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785956982, "uuid": "87d90eae-60a1-4d34-a2ce-e7b90a9f8ff0", "value": 167012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785956982, "uuid": "9cc0ff96-d19b-4d10-9f68-553fc03daac3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956982, "uuid": "67fc8c69-8a35-4edf-b000-fc7096120d3c", "value": "killbotx.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3770010-906a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785892364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892364, "uuid": "3d224e43-0bca-4e4d-8f09-8960bddd9b73", "comment": "Malware payload (Mirai)", "value": "ca759b42d58ca63e704a66d6ab213bfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892364, "uuid": "7dc564c7-ced5-45d3-b929-af0510a985c0", "comment": "Malware payload (Mirai)", "value": "ae2a66ca651b574132c6d29b0bcb714bc2b2855d52f139fcd4d03e1e5d3c12ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892364, "uuid": "fc15383d-872e-4a42-a935-38baadd2350b", "comment": "Malware payload (Mirai)", "value": "ac3b2442d0b52192a9bbc6cbc6212d6157023de9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892364, "uuid": "6ed929e0-68ce-4998-ac83-b60bc48882f9", "comment": "Malware payload (Mirai)", "value": "bbc345b59ea4470671abe02b20846244085c125c14b1083a38b1b266c06abca1e70322786db2c7d458f373b860b5a669", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785892364, "uuid": "0d953195-bb75-48c2-9880-628ec55c8db2", "value": "T1DF03E943FA5D8B07C19271B7F75E429E3A2E6D79A3F932119830AFD023C65F11939226", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785892364, "uuid": "915ec2e8-674c-4f92-b75d-6fb538e9bf19", "value": "768:IcI1ft8nn69IO8edPqUsoIUJFL3dqIQNTKEUOfB27:7I1ftey8eVlso1FrdqTn527", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785892364, "uuid": "46b46a74-4124-4687-9f8a-7500d5c9d970", "value": 40080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785892364, "uuid": "7bc495bc-26ba-4127-aebf-c67cafd26a07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785892364, "uuid": "d9208d87-6d91-40bb-8c0f-10e330343ed0", "value": "main.armv4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0a7808-909f-11f1-bd95-42010a9c0009", "comment": "Malware payload (OverlordRAT)", "timestamp": 1785915192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915192, "uuid": "ce18a847-e1a9-4f3c-a2d7-39ee14cb7d5b", "comment": "Malware payload (OverlordRAT)", "value": "b5d652cbd5d543a76a4b75bc23c51c14", "object_relation": "md5", "Tag": [ { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915192, "uuid": "137332b5-3b84-4337-9fb3-a1b5dd3c6f6d", "comment": "Malware payload (OverlordRAT)", "value": "ae63b978ed0fb657301215221dfa96def5a269596ea7a7e30d237c0927a37b97", "object_relation": "sha256", "Tag": [ { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915192, "uuid": "7032c078-97f9-4df8-ab54-f81f00cc9529", "comment": "Malware payload (OverlordRAT)", "value": "6287f00a2fa24c96dca5fa143708c846cf3b1f5a", "object_relation": "sha1", "Tag": [ { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915192, "uuid": "32aea213-c56c-4b9c-8c05-1ec362bdac3d", "comment": "Malware payload (OverlordRAT)", "value": "a39bde5de21eb0cb827ff35ec102672da999ea5de0486afe67757cc88b3a0e0a1945353677ffbff5d833e22bf3cb5e7d", "object_relation": "sha3-384", "Tag": [ { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915192, "uuid": "f9861818-e762-4135-950a-9b8dd6996d1f", "value": "T18F963A27FD9968E9C0ADD27089329212BB717C490B3123E76B50F7246F36BD46EB9350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915192, "uuid": "ca106a6e-b41e-4ba3-ae0d-7594affe777e", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915192, "uuid": "9b81e4c7-bb92-43c9-a4fd-d5ddd81f70fa", "value": "49152:SSQYEctipwWumUpMPAd4BDwNewy8Pm5QyOtF1tlSSZPtkcCo6HsP5GnrQromWHj3:SSQqqzhv2djkZCcHwDjZWV0rE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785915192, "uuid": "6ddb3806-9628-4625-af48-c61df6d6ecbf", "value": 9312256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785915192, "uuid": "b9c45cd1-912e-4b61-84a3-61fc07d1e4df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915192, "uuid": "0e43f610-21b3-4e2e-bbc5-348b962c4f36", "value": "WindowsAudioGraph.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892c37bc-909c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785913741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913741, "uuid": "bb8bbba1-93a8-41bd-aeb5-abae4445a6ef", "comment": "Malware payload (Mirai)", "value": "34e781b134f5520125c56992e1afc5e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913741, "uuid": "63331020-d5f7-4a9f-b235-5c6b2ab03dd7", "comment": "Malware payload (Mirai)", "value": "ae9c890eb876f0c8fc70e44111a57687339c2f446e16ae3e41ab15a6620456cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913741, "uuid": "54cd7099-feb4-4f4f-9d90-ac0c35afa0c1", "comment": "Malware payload (Mirai)", "value": "67cdc3c1a8f55021eeea3e765854504ef018ac59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913741, "uuid": "d0d77cac-d784-40cb-9c02-309305e4f2df", "comment": "Malware payload (Mirai)", "value": "4d8a285bd973e154666cb784805070b2b5ee1cd97d519abb74597ab4bf63df5903309e250aecb19ac2ccd4d361fc519a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913741, "uuid": "65eef8c4-ffb9-4489-b572-137c8c380cb8", "value": "T103040A41F8144B57C6C22BBBBB9F439D37335B1897DB3301AA24AEB42F8679C1E29511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913741, "uuid": "054126f4-f2f6-4b04-abb7-af782fe721ba", "value": "3072:TDfwbxgOGFc4wKdEJER2CRtR4HSFXBnOOvzBGwoUZaErar/nHUXD:yxgfFc4wKiJopRIHSmOvzBGwoUZaEraK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785913741, "uuid": "036554e9-23d6-4834-8514-fd2842c9584e", "value": 184928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785913741, "uuid": "fa61de50-924b-4abe-875a-76562c97311a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913741, "uuid": "ddf54b88-f83e-4528-af25-5e442751bf76", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f9574d-909c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785913759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913759, "uuid": "0bd41bd3-029c-47c2-b8a7-f93fef35dcca", "comment": "Malware payload (Mirai)", "value": "ad00d65c25deb321dc771c0ae8da9f1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913759, "uuid": "28213da7-aa9b-4a04-9d47-bd2e40ad24aa", "comment": "Malware payload (Mirai)", "value": "af1a68672c90273fb8c692812951385242185f4a821faf4585e9ac3b74fb6f4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913759, "uuid": "e4e20b36-c24e-4e9d-a22f-071e48ab1ca5", "comment": "Malware payload (Mirai)", "value": "4028871033581af3ee00c1d38bf4abdbcd3ccad4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913759, "uuid": "37194710-062a-436b-8d6d-7e0a62fdd9fd", "comment": "Malware payload (Mirai)", "value": "b008cb52a2001ed791cd72aa391dce3275ae963a9dbe561b1a2c2cc774009d8c5e06d63ffa82e978bcc4af15996c7cbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913759, "uuid": "cdbdd84a-5468-4a89-b8d9-5a983fc65a59", "value": "T182A3D90ABF611DBBD81BDD3705A9064238DCA60771683B753634D92CFA5A90B8ED3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913759, "uuid": "951cdcb8-6df5-4914-90b7-086a09411267", "value": "1536:8SsdgqObfKNxqBqruJh6T+B6uoL8r/YAoFnmbNgP/vi2D:PsKwNx0qKF66bc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785913759, "uuid": "39910117-3a77-4f8b-b276-c86b5f99ff2e", "value": 105152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785913759, "uuid": "fa70cbde-cbc6-478e-bcca-be205d1934c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913759, "uuid": "d30d0720-c22e-4682-8cf9-3d9575dbea7b", "value": "HOJ3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727796f6-9091-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1785908979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785908979, "uuid": "edf62649-7b29-480e-95c2-6c5170d5fba7", "comment": "Malware payload (Vidar)", "value": "564ec4dbc0fc42f205c01c43ee6dc57e", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785908979, "uuid": "02760f55-5ef1-4735-9b72-e62343ef5539", "comment": "Malware payload (Vidar)", "value": "af3ef660ee97d62ccc7d0685b66be395ae0304a2daad6796b04520fa018233ec", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785908979, "uuid": "1834e233-a982-4cd0-9a99-7ebdea3455d6", "comment": "Malware payload (Vidar)", "value": "4726129cd82c2dd289fe693a77eff966556e48e2", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785908979, "uuid": "55650e35-c7ff-4bd9-bf08-31a26b39a7d6", "comment": "Malware payload (Vidar)", "value": "25b2ec760f09d9678a55342c5460a8e7f299684485bab02bc34ea2e06becc9f11717e8a8c5c0984f236a9a1decd544da", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785908979, "uuid": "dccf9de6-b8a7-4e76-9812-f26907a8f778", "value": "T1D7E56B07BD9149E5C096E33188775251BB75BC498B3533EB2EA0BAB82F723D09E75B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785908979, "uuid": "b625cf53-e45a-445f-ab14-dfeaccbb7feb", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785908979, "uuid": "8e720f03-af62-4012-aed1-5c8875e84f4a", "value": "49152:HAbN2e0aQ48V/wzDoeTqQBUGQIiWyHwbjHAaeksV:HT+DIyU/IRyHwbjgHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785908979, "uuid": "166228ba-8523-4d96-96f3-d51514fd55e5", "value": 3120496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785908979, "uuid": "e3171460-d156-4571-b8ce-3a1b4044d7a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785908979, "uuid": "5de943ff-5bc5-4c2c-929d-93a5105757a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2a978c-90a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917214, "uuid": "cf408312-8db7-4474-9b9d-2113ba36d2f0", "comment": "Malware payload (AgentTesla)", "value": "64b7bffe22d6fb8481079ca14a6e5149", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917214, "uuid": "de6047f4-d336-42b9-80e3-4730074b783b", "comment": "Malware payload (AgentTesla)", "value": "af7265bec45dd99e6ec185dc8fde31dda019dedc5460749f8f1a4ae9dc3ade51", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917214, "uuid": "9ddabaaa-9d5a-491f-8b3b-72384dbb5bb0", "comment": "Malware payload (AgentTesla)", "value": "0e3c5b59e40f89e6f87e44e7ebe8546a8ce85657", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917214, "uuid": "96b42d08-57c3-4621-bccc-6e3c7a1f978f", "comment": "Malware payload (AgentTesla)", "value": "547a554f12e04fddbd971705e3c0186fb23604101139162e812ce7bc8906c238a5c6bf01930e1a9b7703b64068432142", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917214, "uuid": "34c68daa-227d-45c4-8317-7a947a09c188", "value": "T1CFD5F7912748D1B2B720AB9C913BCE759A0EA00354C2EF16316CE309776DD4F639DEE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917214, "uuid": "2a0e1b95-ba6a-4421-99ab-73af71271281", "value": "49152:nWOwC55wmBhwcUDhRrAx9SAALm+GuVH2P34aulEkixS+oP5cISI0AinkSkg:WkvXhwcUDhRw9SAIm+GuVH2P34aulEkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917214, "uuid": "6017a507-dc53-4a8c-ab2e-1e289901155e", "value": 2961466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917214, "uuid": "ff6f815b-b6a5-4503-afc7-18aa52577c5e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917214, "uuid": "c39b9a88-b2e6-48b7-81ba-15e64ca98a7e", "value": "RFQ-3194- PI.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb3cb00-90cd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785934980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934980, "uuid": "94301607-e980-4903-8599-0404b2313f0a", "comment": "Malware payload", "value": "aa301683c22458cba4d19f5709cd9bce", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934980, "uuid": "77af1fdc-d5bd-432c-b966-0d3f02f21697", "comment": "Malware payload", "value": "b023342470f6039514572e2a876a2a5a0494a570abe0d5e750f4fb0465579b51", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934980, "uuid": "13d1a0ff-165e-477a-a4f4-2a9c198e88c5", "comment": "Malware payload", "value": "a26db7007e3cceccbf7f54f0bed43b73685e66bb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934980, "uuid": "03a2c370-0662-4452-8ffa-41f00dedadcf", "comment": "Malware payload", "value": "3ddf1eac6a9224f78b329241f19b4a2c6dc01f56617599c3528380de8c52216d86a891149e09780dffd8be5cceeccf2e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934980, "uuid": "a29a726e-5917-4ede-90dc-dab505cd35e3", "value": "T10F01B1E9E4D284313F0D8837651C0CC6F206182B04F83ED8A14DA9625F0CA6862AEB33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934980, "uuid": "ce8eccfa-4e6b-449d-af99-0b0f9aebf4ac", "value": "12:Zh2tD9jWijWr5jW2FFl7jN/OQaC5haHHYXqiCgENDNaQ4VBFHKsoRE5YXmY6uYCS:ZgtD9jWijWr5jW2Fr7jN/F5haHifMDsn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785934980, "uuid": "b28c5df1-0957-4065-8e0a-d5779fbb8ec5", "value": 742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785934980, "uuid": "85111fba-63f0-47bc-a6eb-b1db7773d1ef", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934980, "uuid": "ba943fac-8281-491e-af44-24478826b679", "value": "realtek", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef81b97-90cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785934420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934420, "uuid": "0dcb9fda-cc79-4b79-b986-2f96870524d4", "comment": "Malware payload (PureLogsStealer)", "value": "b5b43df99ba2876b933b13fd8da9284e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934420, "uuid": "832d8e89-93bb-45aa-83dc-672bb53bb96b", "comment": "Malware payload (PureLogsStealer)", "value": "b1dabbfe2c04844a66af86cee2360fbe2468a1fa1e57f18cff30f3daeaab3005", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934420, "uuid": "828e99b9-0735-46ad-b1bb-ac47b4381ad2", "comment": "Malware payload (PureLogsStealer)", "value": "3d500e804716ae080eb8e7c67b572346f204dfaa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934420, "uuid": "a5f17303-9b21-4782-b0c2-246f5de798a8", "comment": "Malware payload (PureLogsStealer)", "value": "33e02e0b76198dc27ad7cb48169ff2b8f001f0f29a0f67a9193d0bf1eabc544b1ce8769d383bc48a356bfae8575446e0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934420, "uuid": "02c535b1-7cd1-4e46-a81f-3b39a6611f95", "value": "T1EB7609A473BD525244283F2DA48D2E0D1F6FE0642A8325C8F4CE9BE4559F9AB316C47F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934420, "uuid": "6b355a31-8fa6-4e25-8f01-f0fe8e17a912", "value": "24576:yXTjGZekTrO4BX94Z+KoKuEDWMeyQsgPVJpicneFRxvP+pkenjOcHmNDLumZ//J1:yj2KR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785934420, "uuid": "ceae5cb4-8aaa-494b-8d84-3be4a0deb47f", "value": 7677277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785934420, "uuid": "f5a6d5a8-c43b-4f69-8e11-325e651a4175", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934420, "uuid": "b991faec-626e-4b9d-b8a4-ed0fd217f565", "value": "LOA-AD-142026944-7K.Rivera.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3ca02b-908f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785907945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785907945, "uuid": "576dc7da-8a30-49ae-95cb-a16651769c61", "comment": "Malware payload (Formbook)", "value": "97c2752311f769c2002a937805634f5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785907945, "uuid": "6d198f2b-dbc2-4552-b0b1-fddccfaded7b", "comment": "Malware payload (Formbook)", "value": "b228e371e64bee4b19c26d66b5a1ed819d96aa462ae0e9733127ea3612d00665", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785907945, "uuid": "62ea227a-0600-4bf7-8ea3-312f0e16c14f", "comment": "Malware payload (Formbook)", "value": "1f0df08682a72f7176c7645699df902850171b29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785907945, "uuid": "03f20a3c-df47-46c2-a19b-4e0e0951805d", "comment": "Malware payload (Formbook)", "value": "23898808f263e8be26790e0682b99cfc59059467e60e3cb726853890719238b353906aacd7ced3c6e6628f63ddc3b599", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785907945, "uuid": "96cb8e2e-3f43-4c46-a91b-b578f7119c07", "value": "T134251328B7A9CF11F8E94BB24977D3741339EE8D7024C32B9BE99DD73112B186C58681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785907945, "uuid": "51882f10-f4bd-42b3-b792-2a2c2cc3f58d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785907945, "uuid": "6f0bc876-249e-4539-8a09-6d1506639d8b", "value": "12288:TBGuZkCkHbsm92lO+y19EaP+ZaHDR8QPzKOHNPqh15oGjvf7LmdVsSeUE5:/Z4sm90TaPWauyeOHNP6Df7LmdmSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785907945, "uuid": "780f236f-1ed3-4b36-adb6-5578337184b5", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785907945, "uuid": "2469d917-5f49-4162-9b36-d5560977a24d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785907945, "uuid": "c2e1bb7c-de5f-4314-a221-92a0620a18f3", "value": "DhpA5sRIPpKBtGr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e9a2886-90fb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785954579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954579, "uuid": "5c8ad46c-89ad-4831-86fd-4b34b127640c", "comment": "Malware payload", "value": "dd935a44725605b4df792ecc99c30630", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954579, "uuid": "baebad18-d648-464a-8992-df5495d842f9", "comment": "Malware payload", "value": "b24813aa304464c2463d52dc2d2da13774bb44ddd6bfe3fb4d6c9dabf1948e9b", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954579, "uuid": "3acc81fe-2d9f-46fe-916b-36777d191072", "comment": "Malware payload", "value": "5878d2a5b4b50fa1ee03e1479fb45bb6a9ed8659", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954579, "uuid": "74c6f73b-f1d6-4944-9047-a63e61bbda4a", "comment": "Malware payload", "value": "6db3ab6e12a6540ab277fff6f7e3c02bda738afa4793de5fcfd71a10607a1f5b2f2730a3ecdd673b89877f5d4c027ce4", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954579, "uuid": "612f7e37-0273-4d1b-9993-07b9193ea7bb", "value": "T120E633A1A7491C46F66FE720BD131CE57AEA306A8E8274C22603505F2FDF5C8435DDEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954579, "uuid": "34e1a12e-4bb8-465c-a27e-856bb6efb773", "value": "393216:CUWoecenr4O2n22/n4fG0WlXUu+pjhYqCujS5sqR+KmU:CToejMO2n26nUG02XUpmsK+KL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954579, "uuid": "ee2cc392-fa80-4bae-9926-c45828e60c73", "value": 15114135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954579, "uuid": "85b01967-cbc8-458d-a162-2822648b8bb2", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954579, "uuid": "77232f1d-a681-4b08-aa3b-c66c2415636a", "value": "b24813aa304464c2463d52dc2d2da13774bb44ddd6bfe3fb4d6c9dabf1948e9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abbc5d6f-90fb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785954601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954601, "uuid": "60540a6a-73ac-408d-9436-2bd61d32749b", "comment": "Malware payload (Mirai)", "value": "68d028800decb2ba231682fdf1884ab4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954601, "uuid": "b304ad92-94a1-4b09-8f88-088ad8e74bca", "comment": "Malware payload (Mirai)", "value": "b26f0922377fe34dcfb3df39c497b5cf4bd491aa2678196d976586adef85ac64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954601, "uuid": "806fe95d-3038-4f95-8d55-e68795098b63", "comment": "Malware payload (Mirai)", "value": "714f76c0ba22425c605134e39cb962d67e115286", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954601, "uuid": "4b1947eb-a01d-48e5-8ce5-8bce77d7a708", "comment": "Malware payload (Mirai)", "value": "c0358fe2a46bad11a470094c9b074f322aeb5864248c12575e1abdc8211cee2d75af1e8da5cef25da23dbf500e174282", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954601, "uuid": "bab22387-e593-475a-971d-99d21179a5f2", "value": "T14543F946BC819A11C5D813BAFE2E118D33136778E2DF72129D106F2477CAA6F0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954601, "uuid": "359e160a-1f95-4548-a251-7e24621df251", "value": "1536:4dn500VLhz2IvzWVbBJQCC66I9xm3GOpCiRLU/gQ:oV5vz6rQlDISlLU/gQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954601, "uuid": "25a9e315-1fe0-498a-9052-06891482a8e7", "value": 58496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954601, "uuid": "ae24db63-b054-4c86-9c99-686c4022894f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954601, "uuid": "820b4e70-ac1a-463f-9f03-818c4d2311c2", "value": "b26f0922377fe34dcfb3df39c497b5cf4bd491aa2678196d976586adef85ac64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74f2dd3-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785917738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917738, "uuid": "257dfebb-4574-4632-80e4-05189050f6df", "comment": "Malware payload (Formbook)", "value": "3f0bc0a27f43629bf148bf0148212256", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917738, "uuid": "1960bc4b-ef32-4956-a992-ef41dddac4d7", "comment": "Malware payload (Formbook)", "value": "b2921bd743c2b8be848c8c42e7b13c8d3d13920e2fa79f0491df7d3a2c248585", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917738, "uuid": "a403b43d-b895-40a7-9731-ee53ebf506eb", "comment": "Malware payload (Formbook)", "value": "46a8a34cbf66304350eba43c70f5f8e8c00fee19", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917738, "uuid": "34df728f-d1e0-4ad4-bd8b-50993653d210", "comment": "Malware payload (Formbook)", "value": "351a87b4c91bf9fd53d2189f3e24506022188f13cfc9e79763678db6b9cd0c6de9806d3484fe326627260af772802826", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917738, "uuid": "718e0cd9-f343-4153-975b-cd84e3ba6664", "value": "T167E5E94017C6A5323371BB9DB239DE30D58B49136485CB0235BDE6283B6CE8B9754BFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917738, "uuid": "3834ac24-79a4-4e07-aba5-4fe1528e6049", "value": "49152:g3t/kC1+PtJH2g8ojawSndXxb5XCzOs1BawaTsLxqzHA5BHgVMF+MjJa2h4pe4t3:rC1+PtJH2g8ojawSndXxb5XCys1uTsFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917738, "uuid": "48c1e711-8e68-442d-8dcc-63044e70287b", "value": 3117252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917738, "uuid": "efafbcca-1c7e-4b94-9645-5becec1e20c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917738, "uuid": "62788549-03e4-46d9-983d-57db6107d4a5", "value": "jkgtholb.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ea7a53-90a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785916692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916692, "uuid": "d37a8e69-9379-4be8-b449-70c04026602c", "comment": "Malware payload (PureLogsStealer)", "value": "fe3340d2d7ecc179e03c1f208a820ad2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916692, "uuid": "199c025a-55af-4599-a459-9bbcd310fcc4", "comment": "Malware payload (PureLogsStealer)", "value": "b34de3893018fb1e29e598d817e29b1a61b8bb8ffadddb6239c959d14bcf7839", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916692, "uuid": "88c10d44-0411-4dd3-b970-235d4ce8cf0b", "comment": "Malware payload (PureLogsStealer)", "value": "1cce6864e8ccaa622abde8627cb2ba217679457f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916692, "uuid": "9f686c6f-c293-4df6-97d9-33078d125261", "comment": "Malware payload (PureLogsStealer)", "value": "9df0012d9ca7fb1e6b91324929579946c7ec5a1af78380eae740e639bcf7c59cbdbe525d16a6bab674f6309065670295", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916692, "uuid": "2528b8a3-2d54-46d8-a05f-a3935cda5b50", "value": "T175D5A77D9B2A393637A1206DDCB765C01F583996C0F3A0A1A0A97B6204A35F8FD73537", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916692, "uuid": "87ca1feb-8510-4475-9a20-b44897764c6b", "value": "24576:uZvdHkDFp0y+msHfK7ehDzUS7BVQJFcpmR+1jczmEeG7u2d3TY7G8J1V3SVknEeI:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785916692, "uuid": "365ff636-92ca-47bc-9e05-ac206d11795e", "value": 2896928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785916692, "uuid": "0cddb00f-085b-4e7d-913a-ede5f5d07803", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916692, "uuid": "95e886ce-8754-4d67-adbe-065baa96d0dd", "value": "ORDER-SUNNY 59181940.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ca6d84-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785917383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917383, "uuid": "f764da80-fa91-42d2-8a34-ebf9bba41412", "comment": "Malware payload (XWorm)", "value": "d9eceb9e50f7f6bd52da41f8d8e77648", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917383, "uuid": "3e0cd485-5923-4164-8e62-e8d68c0ebb05", "comment": "Malware payload (XWorm)", "value": "b3a39c622d5d5cb415ce6605717e21c4e3e3cab932e4084fbe3a06708c09b174", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917383, "uuid": "95c07d49-9ce6-4a15-ba5e-4546ebb30696", "comment": "Malware payload (XWorm)", "value": "39b341e3173d7c016c62333ae3dc3f40d6ebb167", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917383, "uuid": "cfffb68c-c4ec-4813-a3f6-c879bec4728a", "comment": "Malware payload (XWorm)", "value": "1a5b55fb7713cb93fc897650d5a4d7bd9b22eaddcfd2256ea9135b5d37a2791bc92a57d9077e9bc6ac2600ca9889a2c8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917383, "uuid": "77bced24-588d-440a-822b-4d1c2abd2ce6", "value": "T1B0157AB78AB3931D8A4553D0ED73D5F0792A043786C70AAEF407D5C42173827AB79A2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917383, "uuid": "e7e18203-e952-4a6e-bf9e-117d0f6cd234", "value": "768:5TTH3dt3ctTDhOTpnHH3EDt3cdhw3UV5ctTDt3cdpbObO3tH3pTVhwD1HTddVtTO:gFU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917383, "uuid": "5949f801-7755-421e-adea-2a4814b2c4b6", "value": 958129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917383, "uuid": "8513e9bc-e0c5-433a-84ac-bd151f184eca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917383, "uuid": "9efca0d9-843b-4b8e-a1ed-03c0224186df", "value": "PO-242399.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551f7c59-90f3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785951020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785951020, "uuid": "90c80d0c-69d5-452b-9596-32f9990325d5", "comment": "Malware payload", "value": "4cdc0abd646b5566d80869f07368cdb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785951020, "uuid": "072a77ea-7d5c-4a67-a58d-a69d8cc0f734", "comment": "Malware payload", "value": "b490fb34e100ff2e1d879f78c8a1305c16ead417b3d2f8648307f9ccf4dc15c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785951020, "uuid": "833a3430-c7ed-4f17-b94e-5c24b719823c", "comment": "Malware payload", "value": "02ef127c9cfbeff1411442c80f84a74838cd89d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785951020, "uuid": "c34d6cc6-abcd-4997-8b81-b207b3fd8b6c", "comment": "Malware payload", "value": "9758eee9d2c7ab19571966982deb84ea2c748e232c52316cab2f1a70be2d7babff9bd26b5de3d82d83df2b863c3790d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785951020, "uuid": "10164fd0-ef5c-4a53-888f-cd2098eb5c5d", "value": "T1D9B67C73945334D8E5A88DB4D11416526DBC388B5738A3C7BAC471F66BBABE48E38730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785951020, "uuid": "401c1529-0e85-4f2d-8a5f-07fc0ed4639b", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQW:cqYUQuVDt0TZEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785951020, "uuid": "0c2872a9-d122-4204-a4e0-e8760f7a3717", "value": 10846208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785951020, "uuid": "b1fda97f-e958-49d8-8114-f39699d540e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785951020, "uuid": "53ff4040-b967-4b43-85d1-be808a5c336c", "value": "b490fb34e100ff2e1d879f78c8a1305c16ead417b3d2f8648307f9ccf4dc15c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5717cf-9070-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785894632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785894632, "uuid": "e37dbe9b-b277-4068-b8eb-84f43001ab5c", "comment": "Malware payload (Mirai)", "value": "0afc11d0fc849f09583286d35a9c5166", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785894632, "uuid": "43797551-29ab-42e5-a22f-67d207627467", "comment": "Malware payload (Mirai)", "value": "b6fcb33c4d6193b07bcb7c595ab6209e6a935f853ba73c07212b4a4c9eff5518", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785894632, "uuid": "5949651e-0bf8-46bb-b238-03021a1d5f8c", "comment": "Malware payload (Mirai)", "value": "6e8718f35839de1bdd1385495d3a4c217a614efd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785894632, "uuid": "d4d8802d-c9a3-49dc-b744-686e42b51b32", "comment": "Malware payload (Mirai)", "value": "9f1d792f392df00ac4b86b53103a1e42f39f3e289216605d8d26e64fae49022ee6471153ede2fc512ad69392c4bca0d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785894632, "uuid": "c70db866-9429-479a-afa9-7debd48d68ba", "value": "T1D2D32B17B64148BDC4E1E0708B7BA962D738B0BD5231271F2B95AB721C92B691F1BBC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785894632, "uuid": "2394421e-8ffe-4626-8e39-39f3866b81ad", "value": "1536:G1JUOHzadQU4WUrlHUCrX1T+f7ZD+FnzwMI1yPIlJT1Te7OkK3GnRdVgdZM3Nq:0JUMFBhZXhcQhTkxc0GnRdmPM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785894632, "uuid": "713000b5-da3f-487e-bffa-9b4cc317ffc4", "value": 132672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785894632, "uuid": "3d31657b-10d7-4827-bbe5-9e7871db7770", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785894632, "uuid": "b8ce2d0b-3ec8-48f9-beab-7196cba39ef2", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dda4f6a-9118-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1785966980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785966980, "uuid": "529614f6-964a-4632-a52c-1763963cdf20", "comment": "Malware payload (RustyStealer)", "value": "e518f1ad663f9150e8cf17ce7daa2a50", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785966980, "uuid": "442414cd-6aa5-416c-8b1c-d64c3bb5db08", "comment": "Malware payload (RustyStealer)", "value": "b72342c9ae243231eecefda808f66e0177637b120cb8d45e3bc9681c84d0a9a0", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785966980, "uuid": "a88a0c94-f9cb-410d-8831-1c8735da3555", "comment": "Malware payload (RustyStealer)", "value": "7ad89bf65b82c2f1205532f5e193d1a9246497f7", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785966980, "uuid": "f18f52c3-773b-4fa2-a59b-618f7f83678e", "comment": "Malware payload (RustyStealer)", "value": "20ee232c1a3d0d36e20de6abef65a0abc0e41a28e74e5e8be5161d4ca0cc87fbf9e28c888502857775abc373e99acbf3", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785966980, "uuid": "a3e4d8f4-8a5a-493e-b681-f6e73806c472", "value": "T1E1161257B291923EE15BC1749386D972F236B4CA0631ACFF11E8E7342E59EA50F0CB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785966980, "uuid": "187064af-4451-4f72-abaa-4a6b8f008d7b", "value": "809293624745fa482c080f26d20f3a8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785966980, "uuid": "dfa9cc7c-935b-45f6-99b5-7d0378aa6bb9", "value": "98304:sJBET2r0jV2AFwBiN5YcR/zuETZeWKatBEzVOx1ReBdSaFO:LCIVXFsiN5YcuETcWKatB4ETRaJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785966980, "uuid": "1c70483f-1729-4794-abed-4cf3ffc30e22", "value": 4336128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785966980, "uuid": "cbfe91a8-629c-4231-9d43-fcd548704d6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785966980, "uuid": "d5003ceb-197f-4572-abe3-f1ab6b7b5f19", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6d0beb-90ff-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785956458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956458, "uuid": "4d014c4f-9957-4310-a2f5-d92a0d00132a", "comment": "Malware payload (Mirai)", "value": "a24797d03361cfdec3551476a55b6a9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956458, "uuid": "e539cf2b-ddab-4da9-9a1b-d2ef2a6190bd", "comment": "Malware payload (Mirai)", "value": "b8974e465cd86794ec79c83cb674b3b2cf26f74978dafecd9deeecbc521454c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956458, "uuid": "f3fd7d14-f3fb-42f8-bf67-484467525feb", "comment": "Malware payload (Mirai)", "value": "c5fa8d06a74443c152a8b8553e3ea8fe35bd35e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956458, "uuid": "8dfcf911-4cd6-4839-bb54-52ebdd8e15e2", "comment": "Malware payload (Mirai)", "value": "3ec5e93fe8569968fbe3cd205a9389e3f2f4d5fab8f7825674e9adf640b72e5e91fadab0b9d1f02388dc3cb58415ca3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956458, "uuid": "8f32ada0-05fe-49f3-a141-4ed58eacf936", "value": "T18843F1A182499E40C8790976C82E11A1CB5D7DD6E2187C7EB820C2AC77D38FF7FB9542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956458, "uuid": "daa3d90b-99ae-4bca-a025-060a0792724b", "value": "1536:hufMeudkt+H5/286SxX++g7/HSd43lsfTc:hPd9Z/28b0+gDHSd4VsLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785956458, "uuid": "cfa6bd72-37ee-4143-b5f2-573ef188b15c", "value": 55788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785956458, "uuid": "ab8553ac-4c17-42c3-9018-2e73f508951f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956458, "uuid": "a622d18e-a87f-4017-b14f-cc9ce253cf53", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dbccf83-910e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785962550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785962550, "uuid": "d460078d-6623-410c-baac-af0f88fe4444", "comment": "Malware payload", "value": "a567eff6cb3448293a25eaf0970a44e3", "object_relation": "md5", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785962550, "uuid": "47eb621c-1526-4045-98d1-206def445510", "comment": "Malware payload", "value": "b8c1c8f9c34a33e84930fbaf8a3d52954420bc000f01ea45d48ffdfe108b0c60", "object_relation": "sha256", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785962550, "uuid": "43070576-0e58-479a-8e98-21e2ac34985b", "comment": "Malware payload", "value": "8ce1e4e500f7fa25ec48332023b2aa0ff789327f", "object_relation": "sha1", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785962550, "uuid": "528fb916-6d38-470f-8d11-baed60f2ee72", "comment": "Malware payload", "value": "9b1505147236d3fcea016706cc15f54eb972d6531e858ab3bccde580e41d19520b2de48c4dd177c8bc5b123d336e9b67", "object_relation": "sha3-384", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785962550, "uuid": "461fb581-1faa-4b4b-bdb9-d1799786309b", "value": "T1B8D52285B8F61EB5D836C3B29D83E0BDB129775496658D1B37CD66008CA38987C393BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785962550, "uuid": "73eec4fb-4480-446f-90af-7c25c8deb4e2", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785962550, "uuid": "50742973-8338-4376-b0d0-e376ee81661f", "value": "49152:Qf7mZlyW3Yy5/pU+G2mDQUjiL/jq1JBHKz8ce2T4CvuD18NoCkN+3iN:QTmZr5/pU72mDLGO1JtWs8oGoVw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785962550, "uuid": "ce6cc5c6-eac7-4a54-b949-3c6b610e8de1", "value": 3003392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785962550, "uuid": "b00a18c4-3349-434c-9c58-f15e6d05cac2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785962550, "uuid": "3d40a629-079e-4ac6-91bb-bb1be8adcde4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db4235a-909d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785914017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914017, "uuid": "dea4b28f-5e86-4c47-b1f8-177b40dbf565", "comment": "Malware payload (Mirai)", "value": "63e4456ed8550b38e2291597971bf79d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914017, "uuid": "c36ec63a-f9d2-4bc2-bfb6-527b8808ebaa", "comment": "Malware payload (Mirai)", "value": "b8e898e4041097df72e5f5bb90cf4fc571be87b1086962ee066670e3273d912a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914017, "uuid": "37a59822-c3fb-4aa1-bda8-6f2deb5b3093", "comment": "Malware payload (Mirai)", "value": "deab5dadd8d1b18df4aa3f67b57034aeec58fcbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914017, "uuid": "85ebe5a6-f06d-4c30-8da0-07866f390a6f", "comment": "Malware payload (Mirai)", "value": "450d90cd5e31583710c3f4535eb2f6dff495beb986526767b4aadb7662df36117346e10fe2895b418805dcdea4ca85d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914017, "uuid": "b8d5c8fe-600a-461c-9bd8-8e1be552bae0", "value": "T1BBF33B06B30D0947E2672EF43B3B27D1D3DF9A9121F4E744251FAA8A9172D32158ADCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914017, "uuid": "1c58c5b5-b7d9-4f2d-b287-314707e71f95", "value": "3072:0v9PHx+wpHQxWFrctE3u6LVFq3tpvx6GIW:01PH7QxArcmu6LV03XwGIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785914017, "uuid": "33073edf-8786-4245-b9cc-0a6573223e45", "value": 158956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785914017, "uuid": "57b95ae5-5616-469e-b8bc-259e86fdc65c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914017, "uuid": "0a0501da-3548-4c9b-89ca-29abe1963e15", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccdcdf47-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1785917720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917720, "uuid": "d4c2117b-2ff0-4750-9a8f-b53b47b61588", "comment": "Malware payload (LxBaseRAT)", "value": "dc062652010ad73182bec8b29959195d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917720, "uuid": "13ed2d0d-ceee-454d-a316-6195a50c3151", "comment": "Malware payload (LxBaseRAT)", "value": "b90486b4ac14667e961d5c12646b6f3efaebd93d2612f323d791a826d0689fe2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917720, "uuid": "1edfdbf6-2a67-45f3-9f5b-42b41b557785", "comment": "Malware payload (LxBaseRAT)", "value": "532a5ec8410ad80f74c8bbc17fa41b59461f8b59", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917720, "uuid": "ac3845d3-e1a0-4e74-9627-72cc654a6340", "comment": "Malware payload (LxBaseRAT)", "value": "1f71c37cb132369ed1e75279416fa8ef499dbfac2dd8c7d892ec050d8b4363ad6331254f9d62d290bb646a52694d1667", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917720, "uuid": "5aa70339-9f9c-4369-88f9-7e72505c3c4d", "value": "T121059E5050367C1A54E2D6172E4F23533AE0BB4146DDC4EA6788B6A332A79F8FBD5C0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917720, "uuid": "228321aa-94bd-454d-8ad0-cb0e5d4bbfe1", "value": "24576:B/ZHB2e0om7tHtJV4ZXhQZuEA4ZFf1ZHUv:BhFYNj4ZGZ5As3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917720, "uuid": "66c8ffb8-3fe3-4952-8ba0-274894336db6", "value": 824718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917720, "uuid": "3ba98dbb-00a4-46b6-81e7-e6fb3a0f1a07", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917720, "uuid": "5a273429-030c-44f0-9657-b2773e0dbbec", "value": "NUEVA ORDEN N.\u00b0 9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d654f9a2-90a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785916877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916877, "uuid": "d26bc242-a7ac-4007-ba12-7a25a6246f4c", "comment": "Malware payload (AgentTesla)", "value": "de3d5547b7020985b41fed6f7388ff52", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916877, "uuid": "8b6cdc66-a87c-4044-80dd-d05abc6112fa", "comment": "Malware payload (AgentTesla)", "value": "b946be96b26b1da362d83c7de6b18cc47d22b757d7bd810db6cf580b99110964", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916877, "uuid": "d031a2c7-4408-4660-9275-a805a481283e", "comment": "Malware payload (AgentTesla)", "value": "4b40a3317b7212a08be0ad9b3f0d9d19d4342fc5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916877, "uuid": "896d4330-40d4-40c6-8ffc-509861f849ca", "comment": "Malware payload (AgentTesla)", "value": "f4dd9e32348af408a30bd623f555ba5b9f4b266b9242748c1e274adc257a2784d18fae8c300004bcd31651486aedbd34", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916877, "uuid": "0b06b639-62d0-4b45-86d7-add5ea2334d6", "value": "T1642500F619A7AB2C8872DB449B3E32DEF9664B9F43107CE43B1C9E93EE352090155C25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916877, "uuid": "b048750e-026c-458e-b0e8-e173cb0937a3", "value": "384:ePFIZBP3JoPNj2l5PF/7q4nmVZzCUHJRJrgloybnYD0JgoxhitgnYCaGiVhZt0bE:ec9b5YDdEYZ0vxZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785916877, "uuid": "10286ff2-de7c-4949-b2b7-d4e4a558db40", "value": 1054667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785916877, "uuid": "f8ebd556-c68f-4d14-9176-f64bd341cb65", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916877, "uuid": "d396c8a0-3654-4e48-a683-b95a8d6a9091", "value": "POReportForeign.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7650cb4-906a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785892371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892371, "uuid": "f4afc669-c73f-4d7b-934f-7328220bbdf8", "comment": "Malware payload (Mirai)", "value": "91ae10d8443e8f48845bb727384b86ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892371, "uuid": "b91709f9-1d49-4c93-856d-1ca572e3191e", "comment": "Malware payload (Mirai)", "value": "ba584221459b0f1a6359864f3addeca070259f707eb402f26e945565eb25852d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892371, "uuid": "3fb162d7-2bef-4ba8-9119-a1b163d0d885", "comment": "Malware payload (Mirai)", "value": "64e5595ca9f9ac33dcdc4875ea49b742dc2a0068", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892371, "uuid": "a443e811-50f4-4fc5-8844-f3935209898f", "comment": "Malware payload (Mirai)", "value": "0a3c3d43b5b1731b0ab86f5edab0a16d4fb84920f9fc17eb79f5baef9e533f4108ba9904fe62bd009afd3f40f42551e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785892371, "uuid": "a4ef007a-547f-4bdd-a388-a51ea6b684b5", "value": "T1AB43641AAF629E77D81FDD7301E8850120CDB49762AA2B2F7170CA6CF75B98B05D3C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785892371, "uuid": "a44a20d4-1d19-4cec-85f7-76ebe269a758", "value": "1536:ug0e5e+NsG6JEFClpbGUoK88Jzny4Dy1rtrZg61VsVfDA:uze5eosG6quNGUoRrZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785892371, "uuid": "f90f79cf-0ad8-47ce-a393-ae18c4f95e2c", "value": 59008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785892371, "uuid": "b8cbd397-d52c-41e5-a323-57515dac54dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785892371, "uuid": "825d23d8-8c47-452b-b88c-a8ce19ae8b06", "value": "main.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4098e41-90fb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785954615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954615, "uuid": "e197bcb6-6dc4-4431-95e6-b5f427e3a9b6", "comment": "Malware payload", "value": "7385d6e8a9ead113be34b64f51334339", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954615, "uuid": "e877d3f4-fa7f-49c2-8e0c-4d9532002c8e", "comment": "Malware payload", "value": "ba8af29578e1958950e1fb503f2e663def6495667cd0a0d834ae5b98d992176a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954615, "uuid": "4c112bec-3a3d-48f8-a5c9-b7d5a39b4029", "comment": "Malware payload", "value": "2f9f91540187116ea87f2c2d2d43544518aa8d8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954615, "uuid": "97c037f5-2488-4479-b2a7-8298a35faa91", "comment": "Malware payload", "value": "83423de595323bb16e244c5e01d77b1c6f5536f6ee54910f93f900470b3b91e4dd97e1a11ea1847f320c8365bd9bf7c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954615, "uuid": "7e1fe812-d4a6-48ab-9416-56b521e88ebb", "value": "T121F69D77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954615, "uuid": "ec2fe8c7-36bd-409f-b812-189023fb5ed9", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQy:cqYUQuVDt0TZEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954615, "uuid": "b6c41c3b-6e1e-4742-820a-f10382c9f640", "value": 15695872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954615, "uuid": "5debb315-4218-407d-97cb-4150b120fb96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954615, "uuid": "4b951928-5b26-45d7-91d1-b1d2680e485f", "value": "ba8af29578e1958950e1fb503f2e663def6495667cd0a0d834ae5b98d992176a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e702b50-909d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785914018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914018, "uuid": "f422ff86-94e4-44aa-9e76-0c5a9bf93f21", "comment": "Malware payload (Mirai)", "value": "e2185129f060ca5cac291017fd14b573", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914018, "uuid": "782e6cdf-1519-4c46-bdc4-a3727090364d", "comment": "Malware payload (Mirai)", "value": "baa8fa960244f34828509b9511a82c77eee66b98b1f0e163065199079b0fddb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914018, "uuid": "256ef13b-52d5-4713-9d5c-8994cafa7f88", "comment": "Malware payload (Mirai)", "value": "50c27e8e31c80afa0a64e89683f6a06c83fd4025", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914018, "uuid": "5609e419-cd0c-4bc6-8093-879e10203d2b", "comment": "Malware payload (Mirai)", "value": "828f1b7a176b3fe9eee9425b564ac5116486a35ae5bb4657b2f4e58a37b55320f20a2df459f27d7792a9c94f15f2f415", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914018, "uuid": "5c16e2be-a071-4d54-82db-dbecb7878103", "value": "T1D4A34C86FB93E0F0D94605B1111FF77D9634EE625024DE5AEBD4BEB2AD32602921B31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914018, "uuid": "cd246bd1-ab61-4543-8d62-40e69a4ca279", "value": "1536:rw1BTbd90hDtZx6O/0c3Ra/oLDQ9VPJU3310vntiZvnwl7/4qKU7yMY7r:qP09tZxac3A/oLDYiClSCBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785914018, "uuid": "f6ddb268-5d2b-465b-8b98-fb1dda0cad24", "value": 100420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785914018, "uuid": "946efab0-7649-4e3e-88a5-c451b57e4c56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914018, "uuid": "a3f12539-628c-4939-b782-e6707d51017c", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3441e4-90df-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1785942605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785942605, "uuid": "4eeaf086-eb16-4d6e-9112-404f561de04f", "comment": "Malware payload (NanoCore)", "value": "50b849e2f8fd66987c49b6fafdfd3041", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785942605, "uuid": "77e853da-b8ff-4293-b243-dbc8297a4253", "comment": "Malware payload (NanoCore)", "value": "bb0ce18a3d8d497ae462d0807130eaac3f0afbec107a12ff116fddd678a6344b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785942605, "uuid": "0fc64697-2c1e-4121-99be-75bfa2dc301f", "comment": "Malware payload (NanoCore)", "value": "ee9b2f22ecb147c8a12e75b3534f3cc6bcb3521f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785942605, "uuid": "7e7b4f3c-ac9d-4011-a996-ec8aa7c30a67", "comment": "Malware payload (NanoCore)", "value": "890522821d56b2a34bda74113b8026e5f250d80db9d4905039b598aec33e44135e240091d7bad0ad37b494eb03459529", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785942605, "uuid": "2ad5857b-b838-431f-b0e3-270c6cba4e94", "value": "T1F814CF167BA9492FE29E867D611202138379C2E3D9C3F3EF28D464B78B667E406071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785942605, "uuid": "5b8ee7a4-b02a-42b0-90b3-c6891352033f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785942605, "uuid": "e2af0849-5246-4c69-be12-4f72eff3134a", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIFbC/Ma/FfqL4m1FYeRBtm23Bi:sLV6Bta6dtJmakIM5V/BFCh1FjM23Bi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785942605, "uuid": "5f612b11-da1c-472f-a982-fda5deb3ce16", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785942605, "uuid": "e4a4499a-8145-4ee8-9f33-440ae37567c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785942605, "uuid": "8391b3ad-b044-430a-a435-dee030aa08ba", "value": "50B849E2F8FD66987C49B6FAFDFD3041.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f33f13-909e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785914670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914670, "uuid": "0f4a85d9-b877-472e-98e9-498603a6a67c", "comment": "Malware payload", "value": "bec950c3d0eb9b61fce31bbc07e62e52", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914670, "uuid": "836ac296-9686-4438-a3ca-e52e647e7d4f", "comment": "Malware payload", "value": "bc469cf91c81a44bc3e7e324accdd2803a21e7628d1f73a6f738226d8d0c989c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914670, "uuid": "8cd2866c-64b6-4b63-8e16-06a22a0d3c8c", "comment": "Malware payload", "value": "9fadc77435aa03cfb6fae462a8f9f6e1be70a83c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914670, "uuid": "eae9c656-7d3d-4b32-bd91-bff528a26158", "comment": "Malware payload", "value": "779cb59efead74ceb73f7591edcf832baf988c24602c33f504121d3b775b6ddd6b034298742293aa0152a011b2c4e646", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914670, "uuid": "9ec5fb6b-9322-4a75-9d39-8f251ef78449", "value": "T10F41ABE911418C799F62D937F264C16B716AADD624CB3F09DECE3EE980CCE0431926D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914670, "uuid": "03eee860-e885-47ed-87ff-af0685583c19", "value": "48:QkHZ4yap4yamVZ4yaE4yaD4yaA14yat/4yav4yaO4ya74ya+4yaC4eakO94i:QkHZwpw6wEwDwQwt/wvwOw7w+wCikO9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785914670, "uuid": "07b1fd06-cc07-4ee2-9ba4-5fcfd7d32e54", "value": 2368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785914670, "uuid": "4487301f-ea4a-47fd-843c-bf8ba28e90f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914670, "uuid": "dcf18bc9-65e7-44a5-9dac-8540ceb8b3ad", "value": "cgi.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af68b914-90ff-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785956325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956325, "uuid": "89a2a42b-3d81-4b7e-a976-a795f0d03a60", "comment": "Malware payload (Mirai)", "value": "7aaff84c62713d70d566429a21a87993", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956325, "uuid": "a5194956-1881-4f75-823e-76c6efdc76a6", "comment": "Malware payload (Mirai)", "value": "bc49f72d368c8d61fe874ec469f18047567327c97cdd737e3d040735eed59ba9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956325, "uuid": "cee6327e-ac0c-4e9a-9e44-d70f193003f1", "comment": "Malware payload (Mirai)", "value": "df5da945e9b20ceb5da64009484bbb6b2538fb09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956325, "uuid": "434a3775-f8b8-4b61-892e-8e97294136bd", "comment": "Malware payload (Mirai)", "value": "1b1866efd4e4ae89db80d5f06632b05a17ee666e5f655d9561f88fac537b1f612bea2b8226453ff4596812591a9dc32b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956325, "uuid": "a593f1e9-1d97-476e-ba5b-0dc34654392b", "value": "T17A6302781A135DFCDF74A9FD2AAC0B8316311D2FEE22DC4118504D4A5B8A7E8B91DDC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956325, "uuid": "992fcf6b-7078-43cd-9205-7ff8cf1095c1", "value": "1536:jfl5VQk+TPV9yA9smpoECpQXAUslD+9q+qyr0V9M8fpo5VEWx:jN5V9+bDnmmpzYlRF+9qbMcp0VEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785956325, "uuid": "a8efab49-63f0-4daa-94ad-39fadd11e1da", "value": 71280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785956325, "uuid": "f39ee76e-d90a-4b37-ac18-6614904e4d17", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956325, "uuid": "1966e22c-c6d2-4708-8e10-f1a8833e0f0a", "value": "killbotx.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc67ad4-90ff-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785956266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956266, "uuid": "f983336a-b32b-4d7e-abab-7c565d8dc2f5", "comment": "Malware payload (Mirai)", "value": "df699e5ea2d7153873e8d5b620a9dfaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956266, "uuid": "d91117cb-157a-4e3b-816e-6cc27264c724", "comment": "Malware payload (Mirai)", "value": "bc69446109b5fd26ae83f5238b78c038e4209ea6fed6fbebacb448c2ffa806e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956266, "uuid": "aa3b6722-bffe-433a-8825-79f4a6002c0d", "comment": "Malware payload (Mirai)", "value": "e57cce1a3086c8e3074210af4a78e31faa2a800f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956266, "uuid": "638bb9ab-8969-48d5-91d5-37c4e7018bde", "comment": "Malware payload (Mirai)", "value": "3192e80e0eed3d5d214c0fb6b2271ccaaadf851e3fb728f95af85bcbd9e0e8d7dd13748ed805126b277fd2d2ee662194", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956266, "uuid": "1082f681-d8bf-4bc8-88d9-ac3dcf5b2aa9", "value": "T16C042B4F7720CF61C769C93045B3C79666EA22621BD28849F35CDE08BE65349682FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956266, "uuid": "b88c7037-75bb-42ee-b88f-55e9e40eeb20", "value": "3072:LEOdjT9gsBc1g7o+7d3CkrtXT6dWJJ21DHjyNT:QcT9fBc1ao0xLjKgJkPMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785956266, "uuid": "9721741f-1071-40c3-bdc0-53d7dcd688b8", "value": 180892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785956266, "uuid": "3778df3c-d420-42dd-bc48-cc9be8d50e4a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956266, "uuid": "3225d68f-0b31-419b-9f3f-3b093419efc5", "value": "putita.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f7b59f-90d9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1785939725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939725, "uuid": "84061b02-4543-4919-bc1f-01fd3ad01d39", "comment": "Malware payload (Joker)", "value": "db7e60b30d7e4620c658e40294c8fcb5", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939725, "uuid": "eb149dc3-9fe4-4059-b26f-251f949b46a6", "comment": "Malware payload (Joker)", "value": "bc898187f826b982f9219b96e789607421015a070cb93cef2522ab04e022e524", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939725, "uuid": "87f78c49-167b-45bc-8f47-97088177709c", "comment": "Malware payload (Joker)", "value": "874b94c98b9e5574f207d0562fb925574ff4299a", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939725, "uuid": "3d4f001a-2d8e-48df-99fa-78a48ce0299f", "comment": "Malware payload (Joker)", "value": "b9e7a507d571e2d035d3ee196a8afe20e22e9822e441a3388e7d4ed44f88d39edcf0798cd986ed0a5b82b3cc724bf65e", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939725, "uuid": "7d67eec6-4802-4547-ac55-bb2a98d78762", "value": "T109372309AF0E642FEDC6743C4D5F0361F5277849AA40EBD7A611821CAE837D99F19BE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939725, "uuid": "e8ba6324-22f2-4386-8517-ec635ba7d876", "value": "393216:ZHkz8Tr8Eq6w058e8wLW7WhKZ6MXJKM0bIb/eALL0NwaMTzIiVsRYS:9kz2K0581POKZeMswAYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785939725, "uuid": "d97a662f-79f8-48cf-bc94-85bea5ebd6a6", "value": 23132428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785939725, "uuid": "e5780f86-e793-4501-903c-e45d0420f283", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939725, "uuid": "f22e2122-3e1a-402c-808a-e4e651d823c1", "value": "com.venom.disting.cleaner_1.6.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c805a70a-90f9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785953790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785953790, "uuid": "a502e02b-b245-442b-b5f6-261aaa736839", "comment": "Malware payload", "value": "ae8e12ebd4c6a0e867d70bfc9cdd7c80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785953790, "uuid": "059ad88e-220d-458c-8a18-41162ffbcb4f", "comment": "Malware payload", "value": "bc8c661c88c00393abcb218be13919355dec9636dc26a146f70a0df7786cfdf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785953790, "uuid": "e1488a18-280c-4f7e-8cc2-3241d6aaae00", "comment": "Malware payload", "value": "cb9d7f43320da875354ab9ddd9dc02210efa92fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785953790, "uuid": "1a60296c-fb9d-428f-b52c-0cb6b8c8daae", "comment": "Malware payload", "value": "de6784a05c67830bd5e29032a79b1bd4ed30173b6ee7038aded4663f1c47aa5d8f7d7aad03be2c61ef52a70131b40f2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785953790, "uuid": "1636ab23-6195-47f7-9d67-e1b104b4aa85", "value": "T174F69D77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785953790, "uuid": "0b19edfa-3158-41a7-8e4d-4f9a300b7cf7", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQP:cqYUQuVDt0TZEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785953790, "uuid": "671d186b-905c-4c53-b7c3-07deab411a70", "value": 15630336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785953790, "uuid": "42b830fc-8b05-4136-8e63-a782c51da81e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785953790, "uuid": "f6d0e9af-33c5-4baf-9dea-ce7f8d5ea8d8", "value": "bc8c661c88c00393abcb218be13919355dec9636dc26a146f70a0df7786cfdf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69227349-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917553, "uuid": "25f2dfea-57fe-4b42-a4a7-3d571d592a56", "comment": "Malware payload (AgentTesla)", "value": "1bf82d639a0723714ed71e6319547921", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917553, "uuid": "26cb5f15-fb95-4c3a-85f4-43b6c4e93aee", "comment": "Malware payload (AgentTesla)", "value": "bcc7c08bfe047c323558ae2bab047c8acaa86f499c7a131ec7ae645e5653e4a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917553, "uuid": "028e2a19-df27-43d5-8352-3832b2f930dd", "comment": "Malware payload (AgentTesla)", "value": "8590fcedab3bb0b69a926d69c213cc15524f0b82", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917553, "uuid": "2b416955-9c19-4fdf-b41e-552a9f1edc78", "comment": "Malware payload (AgentTesla)", "value": "f8b7d09f58b2b6c3567778aa1bec2f5edfaaaf24af306da8dbb7ac977b6a5c104d1a6bfc627266f2ac83df19a6b86fd0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917553, "uuid": "5ac09f6f-e713-4588-ae07-7da6adb3d651", "value": "T108E5E6811B8491B27730AB9D923BDE309A0FA15315C2DF01769DEA08361DE9FB35CAD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917553, "uuid": "2c8393d2-9297-4e57-aaa4-3908885ece28", "value": "49152:68i9MAlOyw09r9KrC0BcHtJhuqeKHWX0QOX1Ilhecziaz5aODJ/r0cKlXjcmXaA3:7OFOb0n4C0BcHtJ3eK2XuFIzj+az5ago", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917553, "uuid": "bb8911b1-4254-4587-aadf-3037036418b6", "value": 3023570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917553, "uuid": "b1f7a729-6b66-48a4-92b4-4dbb07a99f4b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917553, "uuid": "48c5d142-67aa-4953-b117-bdeb5609242d", "value": "050820260024.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f84c7c-9102-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785957388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957388, "uuid": "882c43ea-2acc-40ce-b5c0-4139963102ef", "comment": "Malware payload", "value": "b2155938ceca6a925f0a47c752a80520", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957388, "uuid": "d7ceb478-7b51-471f-bd71-5e3cd4447585", "comment": "Malware payload", "value": "bd09ae02030fa7bc915268f0c6efd1099f56eb70bc2cbd42fc86571c6de2fbfe", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957388, "uuid": "dba0164a-0d13-42b1-866c-18aee22d5c64", "comment": "Malware payload", "value": "d7b0e9544a65ef4edb76803fe01661d621501c26", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957388, "uuid": "90df5266-9f65-47fb-b4c7-7c7bc901205d", "comment": "Malware payload", "value": "48bf5e3cde974a3dadfdcfae87828ce268928e9c0bc209d2ab87b429d0300de8c0da967817262ec7276780979d20d2d8", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957388, "uuid": "a762f15e-e8b8-43d7-b8cf-9b4e5e9d48a2", "value": "T118941193BB8D1332D90201B6E28EC3E68BAED5DC3277252554FCC51C22159E983BB7E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957388, "uuid": "aba5c59b-d353-43d0-ae52-0490b28f52aa", "value": "cf6fdf0f71d35ef84405554a55dc1265", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957388, "uuid": "6ecb0dd3-acea-4af9-9b1c-57f87887de94", "value": "1536:+8kMx6+Jjnt2jz4KU+64+OSn2zTlobK3r3fAJr76vfyL90c:IMcq2H64EMT24Tfgkg93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785957388, "uuid": "8e4e6478-0f91-4816-89a7-07d41fc01d9d", "value": 442880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785957388, "uuid": "97d485f9-5679-40e1-b819-4596076226f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957388, "uuid": "be679b48-44dd-4239-8cb9-b55d20257194", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922bc04d-909c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785913756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913756, "uuid": "966a3b1e-1543-48b3-a26e-70013801638e", "comment": "Malware payload (Mirai)", "value": "d49b4783ec368bf5642bacea572f37ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913756, "uuid": "4fb37132-6c8c-4347-8bfb-c47509e455a0", "comment": "Malware payload (Mirai)", "value": "bd4d8f7d9867086489504f51d0948d3f49acd5b2c919ef7ec52d73b3c7bbee78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913756, "uuid": "16160486-83a7-4ddb-b779-0a8c14a6205c", "comment": "Malware payload (Mirai)", "value": "373cee85dbf3fb4cc957596984fa9b225c7bc4e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913756, "uuid": "c912c414-d715-401f-a9c0-02f5bf3edb00", "comment": "Malware payload (Mirai)", "value": "dda0b74bf777c2205de54000c64fd76b6a6b4bbed38bd858bd67f5645b477efb997855ec22609cd4b96bfd752cc1b446", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913756, "uuid": "4c503b2f-57b3-4d43-ba96-b27dd8e5a73d", "value": "T1F6A3C70AAF711DBBD85BDD3705A90B0238CCA60771583B757534D928FA8A94B8AD3CF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913756, "uuid": "6181a84d-6c88-430e-ac88-120ad200b7ee", "value": "1536:tWvMd/6z7ZCbRxbBOXzBm79m9T56dDt41VyF/BXIgTFFUVke2/:w0KkbRx9ODBR6XX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785913756, "uuid": "d63988d9-5597-4bf9-832d-8e59914c6d7a", "value": 105440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785913756, "uuid": "356adb40-49dc-4d04-9bba-35c156903455", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913756, "uuid": "e20a3d71-2b04-42bd-9e54-bdcd13263ee1", "value": "jih", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf72109-9087-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785904913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785904913, "uuid": "4b79d889-5ce6-4639-8d91-2d798c06c09a", "comment": "Malware payload (Phorpiex)", "value": "1dea1494c8fdd968b2dc09ae484ecedd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785904913, "uuid": "d4cac64d-a589-4905-86f0-fbee42eac7fb", "comment": "Malware payload (Phorpiex)", "value": "bddbed57dd412c52cb60093dd8bf887f96979f8451933b36e406fa46f290f57c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785904913, "uuid": "e347bf41-f152-43f2-a8cd-21a11b85febd", "comment": "Malware payload (Phorpiex)", "value": "4a54c473a8b9a18cf835254a088851bb39132f37", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785904913, "uuid": "5e2ca49c-08ff-42f1-ad38-78cd247676df", "comment": "Malware payload (Phorpiex)", "value": "e9bfb611ffacf52728c2705af86156a5897df5516ef4a69f9672e60423f4a255a745b0c22335a266116b255e681723a3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785904913, "uuid": "5acb9223-8d11-45d2-acf5-5ac2546b19ae", "value": "T165824B0FB9414326D0E11070A276567BDA79A8B637C414DBF7E48AED0A6C6D1FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785904913, "uuid": "fa27405b-b05a-4aa0-b885-40924455f465", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785904913, "uuid": "9756170d-b435-4aa0-9394-d104a2f1e8c3", "value": "384:pV6I8vVaF6OeYUQQlmLu94gXQc4lmxav8U9c2l:pVPvUQQt9a8a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785904913, "uuid": "c5befb3e-16f8-4705-b9ae-9484fad60e70", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785904913, "uuid": "e17c3ef4-4006-454f-a307-a24a3c41224f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785904913, "uuid": "e7ba8e89-9825-4b49-93c5-9603fd5a929d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce34fc6-90a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785916861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916861, "uuid": "f13ef707-c0d0-4cc8-99b6-8481fe0beb13", "comment": "Malware payload (XWorm)", "value": "0cc16baafc023dd19df9881adef5dea2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916861, "uuid": "bf9bd6e9-a42f-4d72-905f-e18e847ea48b", "comment": "Malware payload (XWorm)", "value": "bdfa7425eeced3ef7ca8b847f3628a1ebb6c844d1bbd5fba93f3febbf1a06ff6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916861, "uuid": "00124edc-6254-4fe7-b615-a90bae33aa09", "comment": "Malware payload (XWorm)", "value": "b215966dc7364ddb2b13e4a08a4867ca59a12906", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916861, "uuid": "5d7bcd8f-c098-4b23-be48-c9221c863094", "comment": "Malware payload (XWorm)", "value": "9e6351a3206e29f5f8e18f9411c8a1fd5a49aa5806d8cf3e553a4e9aa1364e9563f5d35639c140632258b95e6b8d0e78", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916861, "uuid": "5449594a-2afd-4228-bb1a-72bb39b532f9", "value": "T13EB5D8805B4894B2B93C772EE5335E244A0EA00351C6EF0D7A3CA64873A9E5F635DDE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916861, "uuid": "e4cabf70-af6e-4bb4-b462-649ec4f8623b", "value": "49152:3F/iEja9THdUcacdV/AD9SZouBdotlD/QwKKM+9S8qj2aWt:3Bja4eH/tZouBdothtKKDSXj2ac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785916861, "uuid": "7c00de25-234b-4d3a-a125-2e1e9c01feaf", "value": 2288114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785916861, "uuid": "11dfb4c4-0fa2-4239-ac7b-00ee7265593c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916861, "uuid": "eb9f0cbd-2c6c-4a81-94da-f0b0bb61c976", "value": "Reckless driver Cam6 photos.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab2fa8c-9078-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785898228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785898228, "uuid": "6c9971d0-3f3f-4a38-8867-5711899fa2ec", "comment": "Malware payload (Mirai)", "value": "61505dbce5b8c81b8b3cd542e9547925", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785898228, "uuid": "935f4f63-08a1-457b-9fbe-6bfb1fff52df", "comment": "Malware payload (Mirai)", "value": "bebd8062fba5ab7163333480655f9027995ace5d4eee2bebab499d4c549923f3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785898228, "uuid": "8137b2a0-fab8-44ab-bb28-ce0d39386df4", "comment": "Malware payload (Mirai)", "value": "8c039bf4a743b27477d07c2eb47dea2fa2b851ab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785898228, "uuid": "acb6c2da-cbf9-4d57-9121-33c050f60cf4", "comment": "Malware payload (Mirai)", "value": "6b4cf8cc48f53948ebf2cc7f36b0e72bfc81d199b51e66f69b5e56c9b06906459b38595f353fef94bd4d07f872626fb6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785898228, "uuid": "4830faf2-6ad8-4e43-a876-87eedb6e695f", "value": "T1DE24C60AAF610FFBD8AFDD3746E90B0635CC650722A83B3A3674D924F54A54B49D3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785898228, "uuid": "ba832e41-4868-4687-ba8e-76161c706960", "value": "3072:P9/6gT7DbU28Mn0NawZ5aMBjv+7GYNRPO1:P9ND1f08wZ5Fj6GY3PO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785898228, "uuid": "76829a19-26f4-4ee3-aaa8-9454718d6961", "value": 211648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785898228, "uuid": "0ace19d1-80aa-4d58-a540-aafa5f9b6a13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785898228, "uuid": "9a5af369-c1ab-49c8-88a9-89af31c644c8", "value": "sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436d2caa-90c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785932522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785932522, "uuid": "1dddc879-7e0f-4830-82de-fcb3fd39abbf", "comment": "Malware payload (AgentTesla)", "value": "9e1bed1767db43ebfcafa62aa4fb46fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785932522, "uuid": "1f62425d-3a45-4a5c-a6bb-082b4bd14036", "comment": "Malware payload (AgentTesla)", "value": "bf010ff289595d56a2299a613058b675e794af18b70d3505bc7b16c9b22f9f0d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785932522, "uuid": "53cc2f37-2e77-4d5b-9e2b-e7663d023f06", "comment": "Malware payload (AgentTesla)", "value": "3841f2034c379281cb52fcabb1b4a930cbc873a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785932522, "uuid": "688b4503-24db-46b9-81b6-ecd3293dfadb", "comment": "Malware payload (AgentTesla)", "value": "af5bab0c86868ba66cb840b96ad6aed994cefd4260fe978c51534014b22739a219c5b54b032ee86db9dba0a9dca8d1c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785932522, "uuid": "23dbdcaa-3749-45b1-918b-b399858c505a", "value": "T1BF350194F791CA10EC2D47B51832CA7107727CAEA471E21E4EDEBDEB3A77B152804653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785932522, "uuid": "fd56ddb3-0948-491f-bec9-16b510cab74d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785932522, "uuid": "dd8c7d1d-c10d-4bca-adef-b91032780e4c", "value": "24576:aUD6Yom3u1U1XLZVC336BtGyokl6Gqzgfq1O/yx5eH3SVdsmu:acn13HXLnCgtfaOqO/K5EAd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785932522, "uuid": "d49a5674-5fff-4dd2-aca8-96fe3b480659", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785932522, "uuid": "e6183258-5ba3-4dd4-b778-813d46a4e8e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785932522, "uuid": "e56e0bdc-dd1b-4a64-ac81-bf06e0509965", "value": "SHIPMENT DOCUMENTS_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a0477e-90fb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785954625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954625, "uuid": "b792a66a-b123-410e-8931-acaa43d8132a", "comment": "Malware payload (Mirai)", "value": "e522e39bdb03286ccf966ad7302984a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954625, "uuid": "075052ea-6c78-49c6-a4e3-3096d6d70a31", "comment": "Malware payload (Mirai)", "value": "bf20fa97c5afa6cb4d25611fb5a6b9d1fc3dc18ecb07f6ba1bd80d9de05ad5b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954625, "uuid": "48d3c7c7-fcfc-4295-89d5-bafc82bdb06f", "comment": "Malware payload (Mirai)", "value": "f8d4825ce1cbf7d1c912ee0557afb3794ea2c3ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954625, "uuid": "e6bd96e6-47b5-48dc-9aa0-b63b5b23e400", "comment": "Malware payload (Mirai)", "value": "d809eed9e1796e8784390ba755ff13ff243563f85f3947b45593700d343f0a60af4d4dc58dd2c5d6f81e7c2d05c00fa3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954625, "uuid": "9e63a103-6786-47ae-bac2-33aa23a19545", "value": "T19E23F891BC829613CAE4137BFA6E428D332563A4E1DF32139D222F1177DA92F0DB7651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954625, "uuid": "8512d760-02a6-43b1-9404-c83b9281d009", "value": "768:cMtjFULqQbIk6QHDZVPfVXdf6y5vEUfWkDEDFSpM9/M8NDEAT4AlooU+PNO6EDCf:ZtjF9oNHDZAkDeDYAT9sH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954625, "uuid": "1bd8686f-31af-4ce3-8115-b393ee611cff", "value": 49988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954625, "uuid": "93cea3bc-7421-4ecb-925b-946ab34314af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954625, "uuid": "7b8e762c-d24b-4ff2-9205-4087142324a5", "value": "bf20fa97c5afa6cb4d25611fb5a6b9d1fc3dc18ecb07f6ba1bd80d9de05ad5b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6f2fb6-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785917805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917805, "uuid": "e3355b84-b94b-421d-a092-8ad26b615852", "comment": "Malware payload", "value": "21983c845d9280e7c2d0d7dfd2592b16", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917805, "uuid": "d81ef718-caaf-46dc-9031-855133d2d6ce", "comment": "Malware payload", "value": "bf7d2cce68baa0250c0502532b552c849678aa0800d3a792c74f768cd5b7743e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917805, "uuid": "bbb357dc-d8e9-493d-b16b-8d4c785b1d32", "comment": "Malware payload", "value": "83e55631e7a3a9e6327f45c8d25062c039a8114a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917805, "uuid": "f0c7c2d6-b9fa-4c7d-b0d1-5c3a130a0557", "comment": "Malware payload", "value": "0d596a16608ec6a96df9fb65dd92197579e3b806ac2fe27779f0acf00375b269d9703ab04bb372614b7ad11846176fb8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917805, "uuid": "a846c408-83f4-40a2-b6e5-8e1786ab064c", "value": "T16F25FADF6BF33A4C2409B71A89F9BD9C1842CC910852A079BFB51BDAC51D6416F8D3A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917805, "uuid": "e356e6ec-b534-4e5a-bbdd-39f9261ca45b", "value": "768:eH6tjxqlxORqK8b7sT0Y1YZkR1Llc2/R1Fx/v2Q56aSgY1XOL7H7uifT29W4C7rt:uTrqRDDyNY/kH2oqNPXFMy1tA8JPqYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917805, "uuid": "e5441b08-90b8-4f4a-9b78-95e6e153a0b4", "value": 1021857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917805, "uuid": "3ee203d3-e0fe-4dda-9bb4-5edc3e266843", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917805, "uuid": "10cc9439-3e20-4af9-a860-906896a3abe9", "value": "COMPROBANTE DE PAGO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e95776-9096-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785911180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785911180, "uuid": "408c9440-083f-474b-8095-76cb6fabcd79", "comment": "Malware payload (Mirai)", "value": "3d3c5357a48ef54fc81aa930dbe5345b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785911180, "uuid": "dbe00094-cfbd-44cf-92d5-45c1252be1f3", "comment": "Malware payload (Mirai)", "value": "bfbc2922e071efca5b6a2546edd6d805456c64b8fab8bd64c83567abf052e38e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785911180, "uuid": "403d3e07-0c97-432d-b811-77685828f3d4", "comment": "Malware payload (Mirai)", "value": "158cca13de437bf5cdfc82bcab6daa32dc859e22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785911180, "uuid": "d6abec12-b72a-46aa-95e7-018721a55fc4", "comment": "Malware payload (Mirai)", "value": "257f3673f231ee9f34dd02b5dbcdd02b736c0b20973ca532d6655b710e760676b68748b0e0720670f62a7a31cea388b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785911180, "uuid": "fd55d80f-1a17-4847-8e9b-5c7b434700f8", "value": "T1AE8302FF8F3607FAFAC479624F520D5E353A61746919049C6A61F37C53B40887818BAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785911180, "uuid": "3a42c0dc-fdde-4cd3-becd-2e0caa693e1f", "value": "1536:aG4kg0l/jMQes8y4KVQHdDEdwU8jqUt3Ywp0fAPh7g6iM4sOlTMf6IRB8xeQzz5f:ajkgah8heQxCoNt3YdYP+seM6IT2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785911180, "uuid": "f7b5ee43-cbcd-4cf2-8526-b09632ffe04b", "value": 86768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785911180, "uuid": "fe0534bd-5dd9-46e9-8ebf-ab716e70dc4a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785911180, "uuid": "ca935ea9-f9de-4579-b2d7-e75c9b062b19", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a05ed65-909c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785913743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913743, "uuid": "610bd046-0fed-4ebd-92d4-b53c745d2807", "comment": "Malware payload (Mirai)", "value": "682d6eede31d6df72ab389b52462d61a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913743, "uuid": "1b4c1863-9291-4ad3-b808-fbf5e0f44eec", "comment": "Malware payload (Mirai)", "value": "c16c65bbfbbdd5b1cbf140be9770b8240d4e67f1697df3f55452185183111409", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913743, "uuid": "360cb927-84b9-4f7f-814b-ab85e466b8eb", "comment": "Malware payload (Mirai)", "value": "6dd0a509f33389b4aa8b94841336cd1b39b8eab0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913743, "uuid": "f009b9eb-69b6-4bd2-95c8-232b910f08a8", "comment": "Malware payload (Mirai)", "value": "4e37e6ec16a4634f4c716f15d69b49c07faacc2a1312e1cf14e228c431ffac1de5bc5c5b37fbab9dda661a5e6c0ccfe0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913743, "uuid": "14edd380-f518-4732-8c8f-d5ce9d42521d", "value": "T15134C7067BA19EF7C89FDD3302E6860110CEF45722A56B6B7374D61CBA0A94F49D3C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913743, "uuid": "e54ac099-697e-42b0-b263-4da95abb0df9", "value": "6144:SXnBrFB10H61Q0xN/58WzvgreG3Ai/a9vNYzpWe:ErbIcQORzvgreG3Ai/a9vNYzpWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785913743, "uuid": "381bdbc9-7163-4311-a64d-de6aa2d84d4a", "value": 238414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785913743, "uuid": "99c0cd7a-ba55-4292-975a-510a5f5cf67b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913743, "uuid": "30e0f79e-2d12-413f-89d1-a8991806bd76", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699a7bef-90d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1785937310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937310, "uuid": "9d9e42c0-1d6a-4182-969d-8ddec214c6a2", "comment": "Malware payload (MassLogger)", "value": "5a60896524d3ee9e775a75e2d3b655e8", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937310, "uuid": "15f22614-443d-49de-a60b-b2796683ddb3", "comment": "Malware payload (MassLogger)", "value": "c1938d074395628133a21c597938afcb9e6f9585053a0bff3a149273c80ffceb", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937310, "uuid": "c39da089-9ae4-49a5-99bd-eaf33dd379bd", "comment": "Malware payload (MassLogger)", "value": "3b200afc7e8d9ccc7ac6ef03c381e9a6c000a526", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937310, "uuid": "6a9c37a7-da54-43cf-a3ae-ab75127d8ace", "comment": "Malware payload (MassLogger)", "value": "57e27dbe03671126d70f1ba8e08c5389f3b63dd7c86412a5adb23ce29eaa15632a16622f386815ec7508dfc39ba971a1", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937310, "uuid": "fa614f86-8fad-4cf5-b512-6f0cc96d1839", "value": "T10A539FA21E28C0E32D5DB04460C5DFEE867A7117B9B94E0717649BA2CFBD1CB3E855C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937310, "uuid": "c81f820b-a436-41b6-b831-7ffda0b4317b", "value": "768:V28OcE1qTROgqRrd4pUZ3UKtjlSBDfejrETuiV+0X3tQVdkEWhd2a2WIBBAH5LuJ:FkVSqrE5ZBoil9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785937310, "uuid": "fef4930a-5ea1-4cb5-820f-7c1827d22404", "value": 61420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785937310, "uuid": "9e1e0df4-f9b3-4b81-b8af-b188276d4034", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937310, "uuid": "0d1a9db9-a53b-400f-bcd3-b792fb14611a", "value": "Order-148.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23aa41a2-90dc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785941059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785941059, "uuid": "a88add67-fc86-4881-b629-b7cfb5bae038", "comment": "Malware payload", "value": "1cb57d209a7289f546284cdb49fc99a2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785941059, "uuid": "e2b561c4-da97-44d3-87c2-69a15f323d32", "comment": "Malware payload", "value": "c19a50080f76018e266bcf06d162be2770c55be4d85dddcf0ee851cf761173ab", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785941059, "uuid": "cc85dd67-a403-4a92-8134-ecb103547bab", "comment": "Malware payload", "value": "c33576defd0531151215a5ca1ebc089fe29c37dd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785941059, "uuid": "2b9aa9ae-8c2a-4f47-93cc-dad9d8d1d1d9", "comment": "Malware payload", "value": "b94bd24f07a42ab0bfe62c089cdf092a2fd7d01e0085ae2d996f84323c803aa2bc47caed7d96e2f39387855228020b83", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785941059, "uuid": "03062265-1c9b-4fdd-b738-83c88b2e9080", "value": "T169468E70E2E10D1FEF23D5BCE22A68D99EC995A18B4200B655F2D6FA41E15D4C34EF2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785941059, "uuid": "6556b393-f305-4a47-a130-3deae1303eae", "value": "d9cdd14f1e51bf231e8fd705275c2c8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785941059, "uuid": "8201478f-3795-46ff-b41f-ae21fe9f3497", "value": "24576:Z9okudfYzty9M1NNJtFqlMsalFhV6s7J6g20h77YjKDWLsC4X:RuAeM1jJ6sFwg2097QSI4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785941059, "uuid": "a148dac9-0184-42e6-959e-30652296eeb4", "value": 5734640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785941059, "uuid": "2b6103a1-2cd2-47d2-b29b-045ba7582b06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785941059, "uuid": "16a457f6-12fc-4b65-a349-9c8c2b759ab8", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a653deb6-9068-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785891456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785891456, "uuid": "1d56a989-fbbc-4ae3-9f54-f6a31ca83e15", "comment": "Malware payload (Mirai)", "value": "e0812e42b716d16ab61212f9d0314c6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785891456, "uuid": "14ca7403-5b4d-4f62-817d-a53b619a3df7", "comment": "Malware payload (Mirai)", "value": "c1dfc650c67b98f8f51ca35bc8583fe4454f6f3c4e6263f1dbead0e969ea463a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785891456, "uuid": "5471f303-01d6-4804-9ffc-59005a8c929e", "comment": "Malware payload (Mirai)", "value": "3c46b6d6aa8db2eecc2eda0101bff342d00ef0e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785891456, "uuid": "2a8b3bc4-da75-482a-9756-06870352bd60", "comment": "Malware payload (Mirai)", "value": "be148f959ec5ee8cb3d52f95f4dd7d06e03c6c0f246943fc001baf3b14adcc98db46e4da57b4dbc85daf23696a4e5be6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785891456, "uuid": "3514804b-4326-4ab7-9b35-9077399ce959", "value": "T1DEC3180BB55249BCC1F1C1309B7BE225DB30709DA631375F6B946B362C56FA81F29B90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785891456, "uuid": "c7c5391d-694e-4ed6-8603-087e47f11f02", "value": "1536:ElCfgX8NVZIMaauGKzKJhtzrRcgHmz9f/UQxv/sQ57O8nxheSgwgd:ElCFNw1stztN+XUajRCSKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785891456, "uuid": "d3b07b8b-0964-4b30-b28e-97d2e53b795b", "value": 128704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785891456, "uuid": "85e79792-90e8-4f93-82f3-d962be976b63", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785891456, "uuid": "9c593de0-9acd-4ba9-8aa3-4d5417b48b80", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2813e51f-90cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785934624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934624, "uuid": "9035b7e9-acd2-4e15-b8f3-2ac20dda3fe7", "comment": "Malware payload (AgentTesla)", "value": "ed9477be564e804676766ccbc520ad95", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934624, "uuid": "8073d233-37b8-490e-94df-346ffb0e08e1", "comment": "Malware payload (AgentTesla)", "value": "c27a0320a5f2ddf49f7c91a869585f9fa380a0c0cc2c62a767f5748efb9e49e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934624, "uuid": "b2bd507a-c361-404f-bbcf-ebfa907f2f3e", "comment": "Malware payload (AgentTesla)", "value": "355f2ce0be2411cfd2d105285fce41e59314fc26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934624, "uuid": "1da08fd6-c913-42b8-8b03-b39022908464", "comment": "Malware payload (AgentTesla)", "value": "d2bd1779d643e0a13fe34cd509fb76429b2b98d6e2889d8146ef1ce1092a1857610653bcfafb069104cb8f89a339f9ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934624, "uuid": "cb7ea4c7-e1e8-442c-a8bb-a768da1e1d8e", "value": "T14AF55B14A229B383B5D4E33AE409BFED573E90933824AE84356DDC39866DF1772513A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934624, "uuid": "7f18c277-c64a-4cd7-bf52-ce2bb6ef0a48", "value": "98304:XUCXwp9hfBBUyya8GDfgwsk3Yov+avDFYSsVtiswmtWO94/7gJdS:kCArhJnya8GbYXpa0Gmt3O/7gJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785934624, "uuid": "68dde12a-696a-432e-a91a-1405d164d112", "value": 3591147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785934624, "uuid": "1c1b12b1-b232-410e-961a-96a3f665e6de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934624, "uuid": "13bb61f0-f3fa-4456-a375-93ff140ec98c", "value": "PO 45029.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99bb4386-909c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785913769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913769, "uuid": "2fd3ae22-342c-47c8-9814-ef2e037d545f", "comment": "Malware payload (Mirai)", "value": "cec0f2dfe90bbf4ed376bcc4890fcc8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913769, "uuid": "72dd6f28-78df-4a09-b0d2-adc94228bbee", "comment": "Malware payload (Mirai)", "value": "c2a00a4718497dae08f9688e37126d7d6b45046c46b4d59a2c0afd27a5cabb3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913769, "uuid": "ae8dbf08-403c-4454-829a-344adb676c9d", "comment": "Malware payload (Mirai)", "value": "24f199dd91219d858df2e4e935b400dfff3648d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913769, "uuid": "e9572b46-3213-4e2a-880a-9211f0ec1ee0", "comment": "Malware payload (Mirai)", "value": "16b98f6a09b0dcfe2232b5313e1e56a10be77f743231041a14b52e01e22ab644bab0b3373cce8762a34d218a2a3b9fa3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913769, "uuid": "7be69310-1273-4bc4-9db7-cfd76e2f21b9", "value": "T1B2731A16B9459F1BC2C256BBFF5E8389332723A8D3EA3103DA156F25379F51A0E2B051", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913769, "uuid": "1f6c5495-6a56-4de3-b299-b99d4c0a6f35", "value": "1536:3BaIOmz0BuMZNbwx51JNOpYD4+o0IKAXP31vXIYTnZcR3FLEonSb7qM:3BaIOA0Bu2NgXJIYD4+o0IjXvNXnZm3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785913769, "uuid": "67974592-f51f-4c88-b874-dece6710e88c", "value": 74956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785913769, "uuid": "015e7f73-751a-40d2-82ea-0f650f0c2e8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913769, "uuid": "05a50d29-a2b4-45d8-b861-e049c2a57dcd", "value": "vpXK", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4162e018-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917486, "uuid": "7a7eab17-70f0-444e-8492-c232b5a8fa63", "comment": "Malware payload (AgentTesla)", "value": "e4e156b62c6c11123c5e3a37bc5ec8e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917486, "uuid": "8f67be22-854f-4e70-870a-608a276422a8", "comment": "Malware payload (AgentTesla)", "value": "c2ad7fe539cc9118fc2d452c35ee7aa377943595e8a580835a0b58ca512c9e62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917486, "uuid": "2bb65436-6d88-4abd-93a8-949165bd1101", "comment": "Malware payload (AgentTesla)", "value": "6492c62bc242eb8b5cbaf33332f5cbb3fab23a11", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917486, "uuid": "9284523b-4e48-4d07-9433-ae02f6924b74", "comment": "Malware payload (AgentTesla)", "value": "585e30f1391d0f40f5135e36fa5299da1333469d79a788696b965bd612e1efc0e45f4be8a5d756c2cabc5266c2cce05a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917486, "uuid": "e54a04b6-3378-4e2b-8099-a5bbdb0a843c", "value": "T1BA2562B7651E96084F62E1F0DFFA54284BAC078F9332C64FB1B169A55092CDC10ABD7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917486, "uuid": "0bc1aee4-ad7b-4ffe-9c02-771a49a693ff", "value": "768:L8B+aVUZZVNVfAsMbJV4Z8qa9UjsZVbAT5x+OKsG8w/OVxQ/7Zi+Jmd7GRU8k8dP:aGQN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917486, "uuid": "b8551202-faac-4df6-bf6f-6f999b84b5d8", "value": 1054598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917486, "uuid": "eafc5dbe-73ae-453d-82b4-7de2aa4d75c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917486, "uuid": "7980b395-4644-49dc-bf29-9151adfa163e", "value": "Product specifications and drawings.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682fb9cf-908f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785908102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785908102, "uuid": "9b6231c1-2e01-4627-8551-4b187e39f12a", "comment": "Malware payload (Formbook)", "value": "27cbe0976619c61fa0961e1dbcd79d7a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785908102, "uuid": "96af749f-4e56-40ca-b084-527a829c8ba1", "comment": "Malware payload (Formbook)", "value": "c2fbe4fd85440a8c8134305fe74b021646055bf2dc9ac9864d73639f3e649832", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785908102, "uuid": "3c5c8012-d498-4e7f-bb90-357a725c8696", "comment": "Malware payload (Formbook)", "value": "b3ffa4135047f04c3e3c7e6353038e5252791d9e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785908102, "uuid": "eae72cfe-81f5-4ef4-9031-303c3e05eb4c", "comment": "Malware payload (Formbook)", "value": "229b1e18528f14f170d3e52880157ee9aa28251de8fa97ab1515173f3d07554cfa4fb96a5b7c0cf3474406fa556ec4c1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785908102, "uuid": "de55ca8f-0869-4b6f-9d5b-2d39496137c7", "value": "T13CE5E9B36BAF755E594C3323E1099D998F5B8431C9C399E4B0DD01C0630B84ABBD9DAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785908102, "uuid": "efd81af7-83d7-4402-a101-7f6b012194ba", "value": "12288:2/cl8DECVMZU2uYJMrBQVdRLMtmyhx5x6I/EJRVTBR00124J8lKcgtxfL82NLuYY:XCy34Qf0+7syeqHXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785908102, "uuid": "97c1e78b-9847-4019-a3d9-6601ae65fb0b", "value": 3313426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785908102, "uuid": "f4324af6-1611-4609-bb8d-520d6fbe2e99", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785908102, "uuid": "b644afec-19ac-4ef8-b09b-f275ca86df8f", "value": "LOA-AD-142026944-7K.Rivera.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52f7032-90d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1785939612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939612, "uuid": "7122f2e1-677c-4743-a9c7-1c7a2c537771", "comment": "Malware payload (ValleyRAT)", "value": "262f7efa68c1662fb977535302adb578", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939612, "uuid": "c448e442-9eb1-40e8-bf43-7b7f66617035", "comment": "Malware payload (ValleyRAT)", "value": "c33bf27dc5e7c57f95cc10e6480e54faea225df318ae994117d60a231149347b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939612, "uuid": "273a0eed-5e71-4229-a41e-49d959285b80", "comment": "Malware payload (ValleyRAT)", "value": "d0e79471e106d407ba8119788e622f2a57c9eb32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939612, "uuid": "9872918d-1dd8-45e8-9852-ffb6843c6667", "comment": "Malware payload (ValleyRAT)", "value": "5cea6ca1e0b1255b76b20278783b30c6896dfb166ffe4336abdd3206fe1494f78b8baa94809ef49c9083e1579061d235", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939612, "uuid": "7fbf9d8f-91cd-4235-8b85-a3f3c70ba719", "value": "T12C26023BF28B753EE42A1A397A72D110943BBA61A5124C1697ECF48CCF255701E3F687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939612, "uuid": "19762f21-ac6b-4373-8443-fe898207dfe6", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939612, "uuid": "a0460781-c7b5-4d7a-911f-3f41903739d7", "value": "98304:R5O8zgrwE36ts4V1dFdoa+8eJLuGwRFX/gL7kBO5WIw0XDR6PktJ:Luwdts4JFWaaJCrXI3kG9t6PktJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785939612, "uuid": "f1822509-650f-4b2a-b12b-4f7ca6fd1ea5", "value": 4483769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785939612, "uuid": "f05b6a94-f402-4a4f-b02a-df23707ebde1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939612, "uuid": "18258bf4-e7aa-4cb0-a512-c63a4be30ec1", "value": "262F7EFA68C1662FB977535302ADB578.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33e14af0-9103-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1785957836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957836, "uuid": "910e5093-8409-4362-9bc3-117661ee67a9", "comment": "Malware payload (AsyncRAT)", "value": "68adf0a596bb63131bc320b521e45016", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957836, "uuid": "b7218295-4c11-4bba-ade2-2c346763ecda", "comment": "Malware payload (AsyncRAT)", "value": "c3896171b744c28d8def5cb67f6f55db2c6383b6fd1d727c367c8fb54e981db9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957836, "uuid": "d5545d0e-059f-4437-beea-038b35256b0a", "comment": "Malware payload (AsyncRAT)", "value": "97daea598e8467e7529d07a5a040155215ec51aa", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957836, "uuid": "23ba41d1-ffca-47f7-a71e-d782930ed476", "comment": "Malware payload (AsyncRAT)", "value": "149ea79637262fdd595e91d2bf9ce13e9aae0ba2e21d54c2686acc89c11c3f8040488f09e7b0c3cb7255b884bf9e89e5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957836, "uuid": "4421c487-4b4c-4349-b16d-f7c7061581e4", "value": "T161C22C0833E4C676D1FE4ABAC83385009779D55B9923D75A5FC490AE2923BCD8B18FE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957836, "uuid": "406e4d80-3d58-4bfd-85fb-95dec7df34b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957836, "uuid": "f110e9dd-cc9a-4e9a-bb24-6f88fc4627a4", "value": "384:RSIAojG/rIDdW46OsVa/KFHbZ0yH9qbuUscCbQxnCJfJBndnjJZKgK:RSboAO61VDHd0wIb1BBiBn4gK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785957836, "uuid": "13edbb6f-9e2a-42e5-b464-7b3264e42331", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785957836, "uuid": "4703db9b-20ef-4ce3-86a7-bc86135e253b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957836, "uuid": "1f02e585-033c-4cae-895e-90f1351ab8df", "value": "AU88APP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c76cc0-9096-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785911182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785911182, "uuid": "286decee-8816-43cf-9e3d-6288857d955f", "comment": "Malware payload (Mirai)", "value": "3e0fd925cc22a19d7e07066e608173db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785911182, "uuid": "1e3742b1-27bb-4a06-94c4-d8161cff60f3", "comment": "Malware payload (Mirai)", "value": "c458bf8f951cd5d2415b67ffa894e85ced9733a2ada45e43eb118cd8bc9625f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785911182, "uuid": "14741890-2094-4fc0-bd74-86accbeeb832", "comment": "Malware payload (Mirai)", "value": "d2698313217cb87e36843c8bfe48dbf42201ed3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785911182, "uuid": "43951a76-354c-4c96-b967-d6bbace13c18", "comment": "Malware payload (Mirai)", "value": "109833d64abd61785a7fecebd54db604d43f2fadc61f7f7c2f191ce3ed7fb6ea61474ef6d246a40389d446ce2afc3d81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785911182, "uuid": "385b5979-3eea-4720-b1d3-88281044b27d", "value": "T16BF46DC6FAC3D0F1E96701F0105F9FEA0A34A1369057DAF6E6C01666B861B925F1B32D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785911182, "uuid": "eb927c3d-6ef1-48e1-bce4-0aa99f2643f4", "value": "24576:nAypOtnxY3ClukGhgChm2hHeB6bLPL9EktcFH:AypOtxJQkGhgChmC1LTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785911182, "uuid": "37cfffce-a4fd-420d-8e49-1acca682ff87", "value": 792580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785911182, "uuid": "71b2b44a-64d2-4a80-bd8e-3bdce8fcb97c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785911182, "uuid": "9b036e70-c04f-4328-9cc7-166d19b92d67", "value": "xd.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125b9852-90d6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785938453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785938453, "uuid": "cc68a584-6a52-495c-a082-7a01226a54be", "comment": "Malware payload", "value": "516f500948cde6e1a34625014c9251a6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785938453, "uuid": "817d1e07-2151-4bf7-90fc-d9bf176f2531", "comment": "Malware payload", "value": "c4afde2c4134c354cc4b6e729f673b6bf1221e4fc2a95f064520dbe8a7cfb840", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785938453, "uuid": "0e47be7e-c864-473c-aba8-b08399578b5c", "comment": "Malware payload", "value": "7c4b10cefa53bf29a7282dd64c924b358dc372e7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785938453, "uuid": "b78d4913-2e99-4589-a97d-3a4e9943dcb6", "comment": "Malware payload", "value": "4aa5f0884747ac4da2a1f242fb7da3d18dd22f06275b0fb74f8f8b0bfc10ffdf59cfc488040f3d05ac80e7002ae0faf7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785938453, "uuid": "8adbca1f-6d85-434a-b8c2-711cdad543ee", "value": "T1A0236C552A857C14AA98C4371D7E2F0CB9AD43E6320492ED7FCF3CF68C4A69D921871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785938453, "uuid": "4165f0b6-34e8-45ec-b873-f7ead8b4a4f4", "value": "768:FXOGVvq9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:hLncr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785938453, "uuid": "7d5f8b44-535c-4293-a125-7aacd05f1bb2", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785938453, "uuid": "e2029bfe-26b9-4ed5-a7b2-45f8ba3fce17", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785938453, "uuid": "8f3c1093-17bf-428f-a858-164eb72376b2", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2b53a2-90a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785917232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917232, "uuid": "427cab34-5514-4c78-9701-f58a9eed2681", "comment": "Malware payload (RemcosRAT)", "value": "5adca81fee713d26f840e8e788c36a5b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917232, "uuid": "c835a7e4-e3ca-4c88-b9af-19f519cda973", "comment": "Malware payload (RemcosRAT)", "value": "c4bd38bf31e4f4f83349759657d120687a9a664153b2bf0dadb329dc138f2693", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917232, "uuid": "7a3cede1-639b-42b3-9486-2782579d64c9", "comment": "Malware payload (RemcosRAT)", "value": "42eaf50d9d1e96ac2c4931ccee1b11fcd4b187f7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917232, "uuid": "7751cc61-e64d-4364-9eb1-72af2c2cf238", "comment": "Malware payload (RemcosRAT)", "value": "0607aa6355b43c3c75aa41a01e28da9da6efef4bb97be9a1cddcc183db16dc5663255770626a724a770683454571cfb8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917232, "uuid": "f7f64b76-8332-4596-b801-ea9b5ba0cb53", "value": "T1A03519CF6372191C648A7A0FC8386E8E7696CF830510FCBABDA4594BC50C75253B5B6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917232, "uuid": "679c12a5-f12a-43a7-8eb1-34392ee3582c", "value": "6144:XTuUJrQnlGPYN/cZoefjjo8OWlUwFFcnh:Xxcnlef5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917232, "uuid": "b86bd89f-9081-4267-bf5b-1949e53c1d27", "value": 1063347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917232, "uuid": "81fccd20-81cb-407b-ba99-6d5f54fbdaa7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917232, "uuid": "672140d0-02db-406f-896e-8b47293714b2", "value": "REVISED PO-4701006574 New.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5dd048-90a0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785915469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915469, "uuid": "7b8a55c4-0df1-4c67-bd84-dbb9d3453ca3", "comment": "Malware payload", "value": "dad745d5df9b235d194182785d0c6ed3", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915469, "uuid": "491338e6-87e6-4974-bafd-78e38b551488", "comment": "Malware payload", "value": "c4fa09a189a835b2672f0a5d3030264e0364ee05ff96794b50ced46dc46c32d9", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915469, "uuid": "ada75a22-c644-4919-9045-5bd7c278faf4", "comment": "Malware payload", "value": "1710bd5e5f3d06bf13bd6af91434f9e7d5d86b83", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915469, "uuid": "80723f41-5287-4132-a50f-d87c3588b078", "comment": "Malware payload", "value": "b848e99ea1f303d40063bb9f901de3dc2d1969c63a4919c9ef867044562495f4fe02d6074b401fa83b448e8db12bfb4a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915469, "uuid": "0b5e9f3e-1631-4fc6-9306-5d2182cd88b8", "value": "T14E4758E3D718BFE0DEE8BB4C04D3AA562662F319F65595AF33B14275DD82C217A08318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915469, "uuid": "906f4ae6-07dd-404a-98ec-b21035129916", "value": "1536:NGJGVGJG5GJGeGJG7GJG9GJGaGJGBGJGeGJGCGJG5GJGgGJGuGJG9GJGMGJGUGJQ:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785915469, "uuid": "3ee8dbb6-8fbe-4b81-9c9a-bd966a828ebe", "value": 25991296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785915469, "uuid": "68212872-8a72-4248-81e3-e5f0bb2a1cf4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915469, "uuid": "e52fdd8b-cd46-4258-8952-239a8f2ede2a", "value": "Payment-959329497.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719343ac-90d1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785936465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936465, "uuid": "826bf802-7973-4d0e-94d4-5f96e090dd5a", "comment": "Malware payload", "value": "bb165bb569a62e1794feb7aeaec54535", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936465, "uuid": "d1235b6c-3f7c-4305-b66a-bf3647a26fd8", "comment": "Malware payload", "value": "c5a83fb1772c86bf4f5013734080f4023b5738fc8f6f491e6d1ee29c6d41cfdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936465, "uuid": "cb14a16e-eb87-42b9-9ec8-4502022579af", "comment": "Malware payload", "value": "b80ec9bb6980d95939477fdc883b7bc1e0f9a637", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936465, "uuid": "b36d4993-a1fe-4967-81c7-9b8e4d8cef94", "comment": "Malware payload", "value": "ea07bbef82e14687620684797964788fd4be1a776e56fd171216a54eab1bec6306600d3698017227b71aa8c0de079c49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936465, "uuid": "ccc447c8-8594-444d-bed2-5620ddc316e9", "value": "T1C5B47D15B6A91CFED97B803DC9921406E6B23C9547A0EBDF57A00AA60F137E06F3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936465, "uuid": "957f8a2b-963a-44ba-a70a-eab1eeb1da24", "value": "abcdb8b48f1a6c556fd339d1950a61b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936465, "uuid": "b50a6046-9fd8-42fc-aaed-d5faa2c29551", "value": "6144:zTUuRT3kcy6o7ZwU83qD79P/efWERpWe:zTU+od771/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785936465, "uuid": "b1de63e7-645b-4935-b1cd-e087b1e03ca4", "value": 502784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785936465, "uuid": "ba65c79c-c421-4e35-8e33-52b7b35bad10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936465, "uuid": "e389d04e-87ba-47eb-9751-38e87db2f4dd", "value": "c5a83fb1772c86bf4f5013734080f4023b5738fc8f6f491e6d1ee29c6d41cfdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c0e261c-909c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785913746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913746, "uuid": "8ac5c454-c2fa-4f31-8250-fb35a8abc40f", "comment": "Malware payload (Mirai)", "value": "250dbf10f51708efb1b6a91f11bce21f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913746, "uuid": "3b49ed2c-37d3-468e-9046-687b11775255", "comment": "Malware payload (Mirai)", "value": "c5fb7dc78ff2f03cbe493a5d77a68543af4a8e91093b6ed0b5b74e525b1dfbba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913746, "uuid": "74950bba-f97c-4cb2-a7ee-73f338589fa1", "comment": "Malware payload (Mirai)", "value": "2aa7ee348bfb6de517d9e4588957df9ed58bcb03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913746, "uuid": "1b43edd1-fb52-47d2-824e-14df178b4f65", "comment": "Malware payload (Mirai)", "value": "825278490c6c338e8fce05c811cc0f068171c67ba9c80d01eba5e0cb7162cdeb37fa0c64c199d190e05e7ac20350618c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913746, "uuid": "8b2c6504-46ab-44a5-a1cc-04d95f5271e3", "value": "T115142B02D5504B57C1C21BBABB9B425937336F64D3DB3302AA24BFB42F86BAD1E2D511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913746, "uuid": "da07c945-dbd0-4e2d-a190-24cedaeebaac", "value": "6144:/D1vt3yYaau0K/zQqDx4mWltYrZxa5F4sss:LZtCYaH0Gjx4mWltYrba5F4sss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785913746, "uuid": "4c0bc82d-fcf3-43d0-931e-28db083ab207", "value": 205314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785913746, "uuid": "37281651-18b2-421f-a708-1d52c9d40561", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913746, "uuid": "bea0c21a-d76b-4d6e-a72f-31fc04fd61c4", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf25928-90a9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785919520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785919520, "uuid": "e6f91135-0306-47f8-8db9-24fee8bf6e9b", "comment": "Malware payload", "value": "9185acf50196a087fdfe20b0d0995d57", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785919520, "uuid": "8e0b4215-dff9-4553-a6d6-fd8f5d43c3dd", "comment": "Malware payload", "value": "c67652b243f64f8aaa7d0fd042c0021082f944c1a236ea9f24ca13be166e2483", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785919520, "uuid": "c7e3b0e0-7977-4d0e-8579-45011892b1d8", "comment": "Malware payload", "value": "a53698f09991b5bb3c83ae81d863dd114e67bbc7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785919520, "uuid": "7cf4ef8a-3a3a-4494-8812-2511e5aeb2ee", "comment": "Malware payload", "value": "c8a94e003d7e4f66885bf563e338f483a1448ea127b16c3d85eaeeb1df4cba8223fa4830f93f69d1675eebad62c9c7b8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785919520, "uuid": "4e0d3295-a7a2-4461-b7b7-0f642a32dd1d", "value": "T1DE235C552A857C14AA98C8371D7F2F0CB9A943E6320452DE7FCF3CF68C4AADD920961D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785919520, "uuid": "721cf58e-d6f0-41f8-b5ec-1f1aa43c9367", "value": "768:RQFWzZx5YC9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:KkzuHcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785919520, "uuid": "a544b425-3692-494c-8bf8-48f7966f59f1", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785919520, "uuid": "64f6dd55-149c-4299-b0b5-d7d218417e7d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785919520, "uuid": "862e4a42-a1a8-4105-9324-eec0a3666d31", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de46afc4-9062-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785888973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785888973, "uuid": "6db78512-fe98-4c9c-bea4-1c93dea1ec94", "comment": "Malware payload", "value": "b48594fa63f56bf074801dac09d57275", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785888973, "uuid": "dbc750fe-536e-4b3e-80b0-40fa04d69f1c", "comment": "Malware payload", "value": "c6d4209d7086ece3833d2c655e1fa281881515c487733205ace2fc9452b91a1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785888973, "uuid": "1f853995-761d-4028-8e6e-1bd40fe5912b", "comment": "Malware payload", "value": "c5ea7df65dfccb856b51e8a3827bb325bc965b4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785888973, "uuid": "32d3505f-0cb9-467f-bfaf-fb8e021a45af", "comment": "Malware payload", "value": "59f2106e91084f859bc6fe68c9649c1625112455db59e1824bca21db759fceb1c8ee14a521477a24bbce1302c85e6ce5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785888973, "uuid": "1b4afc74-6084-46bd-8b6c-e97647b3540a", "value": "T1D3E733000B0FC1B1D145E2F6DB8BAD4A982EFBCB92D8571A1BDE54B26256CF59C73231", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785888973, "uuid": "5376519f-f9f1-4383-ba2e-583ed0979429", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785888973, "uuid": "6d92c818-b93a-41ab-83e2-b68d499c6fba", "value": "1572864:BzFaNokS5i00u3mCgBjcxceYcyr8U57IoMTXnIjj7:BzFuS5i8kjc6eQjM7E7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785888973, "uuid": "5482a447-35fe-480d-9307-140c004481db", "value": 69135789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785888973, "uuid": "61a0b109-ec40-448d-9f25-a3346af46854", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785888973, "uuid": "49614c07-775b-4327-9e30-e8cd63bad08c", "value": "voxfix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab74180e-90d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Joker)", "timestamp": 1785939568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939568, "uuid": "001e171c-c3ff-4e9a-8427-8fa04c33265c", "comment": "Malware payload (Joker)", "value": "3cf1253759a63ca9e2094e998b6a892a", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939568, "uuid": "2de0ad59-5d7b-4e61-b925-42965f9022ca", "comment": "Malware payload (Joker)", "value": "c72f70ab824403747ffe72f9a465922b29ba8131b49279b02a12f771048d8329", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939568, "uuid": "50941177-fd7e-4828-a8a7-e14259fea1d2", "comment": "Malware payload (Joker)", "value": "5e98110ea13ec3240680a39205f5fe77ddef7820", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939568, "uuid": "67dd7d8b-cf65-442c-a28b-6bdad6b7a8ea", "comment": "Malware payload (Joker)", "value": "0f3ab7b7db8e92c093e6595a45948e3e3724955025c41c33e18efc59bcf6f2777d416fd5d36c1e3616a80e0c5884ebf5", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939568, "uuid": "4126e540-7a9a-45de-836a-aae1e657bf46", "value": "T14E18F149D91CC936EACEF0BC9F690767F23674644268C1567C29824CFF876F04672BA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939568, "uuid": "3fee850a-2871-42a1-bf59-dce1fce60a90", "value": "1572864:UsfIzQ43TmhjAe1BeUh20HxhjMhyRER1yVo5PwQ:UkIzQOTm5m61MhyRERkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785939568, "uuid": "31ffdf43-5a19-4795-b844-44e87bafb7fc", "value": 86124218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785939568, "uuid": "36e1578d-6904-414b-b4ad-9231410f6981", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939568, "uuid": "41317784-7033-4016-8305-2ce20dbe8c7f", "value": "com.redrama.shortsgo_1.11.8.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25dbdd8-90cc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785934426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934426, "uuid": "39aecf72-f36e-47a8-9109-297e6240b015", "comment": "Malware payload", "value": "006124cb6ea2cb8ec8706aaa8f725e17", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934426, "uuid": "a5a99d35-3266-4224-a079-9f55d752c5a8", "comment": "Malware payload", "value": "c807fc2958b943ba452c41251b66810c0f306f5a93a809a376551f616ae79f54", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934426, "uuid": "690fe357-af20-4379-a6c8-ca2d30674b6a", "comment": "Malware payload", "value": "76e4714c18190c2105ad9346b0520cbd60dd9e86", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934426, "uuid": "7ab05036-78a2-4564-8744-7049503e1ba8", "comment": "Malware payload", "value": "2a1285a012899bb6b711fb30e1d6bcae4f6b5baa305bfad0c74819b98c39963d26689dbab6948188fc5ad70e53d62eba", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934426, "uuid": "4813d360-0a54-417a-9374-a17a30e43ecd", "value": "T19305237624C35C66DF10F23EB1512062362DAAF488C5A315933928BB3E8F6B9F777065", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934426, "uuid": "50469a3c-4b17-485c-ac11-5f49d6926367", "value": "24576:CcCP31RgDUK66Uc3sT6o3csInJ4xiRIV6tBtvK:Cz1RC66b3sT6UWJ4xXVu1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785934426, "uuid": "052e49ed-8ab8-400a-b4b1-0e00c4d8c829", "value": 813938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785934426, "uuid": "711bdc2f-3cab-45b2-a8e8-441cd3e4ec4f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934426, "uuid": "e58d58aa-c8a6-4b95-84c2-f2ff3a52a00f", "value": "Purchase Order_PO20190298.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8da6e53-9093-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785909929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909929, "uuid": "f4a5c3cb-54bc-42b6-af17-630dd27caf46", "comment": "Malware payload (Mirai)", "value": "89ee0c2ed56da7b8acc5475ccb40c2d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909929, "uuid": "b2ad014f-0895-4b24-ae5e-209cc943e755", "comment": "Malware payload (Mirai)", "value": "c81ed863e2f8dccc8afb7cda8b5d2f34c6fcfc3f018d7baf8a9658b82c362374", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909929, "uuid": "a7520c30-5611-4468-a986-b7212c8a0459", "comment": "Malware payload (Mirai)", "value": "d9cf97ca4e38b5d5d26367cb16c4c2a22169bb6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909929, "uuid": "b8d9bec6-b9bb-4ab2-ab67-f00ac451b2f9", "comment": "Malware payload (Mirai)", "value": "2b16e967aeee244f26d816148daf0075434d2d75f158f3c072d5b459ddb00df7a77ea869c8a415c694a0e13f7445aa46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909929, "uuid": "582cbd3e-745d-4e42-a575-0b638819f662", "value": "T11D8312DB1B1812E4E9522EB7CC72690DD701530BFDF6B2C2F1782E6ABE149858D0247B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909929, "uuid": "492e1dbc-6ab4-4cb0-b9ea-9536820839b0", "value": "1536:1aN9Bx0d5v1PjD9OGqAiI+Kunurmyo3zQJ++YRaVSFQztpKRuYvebJ0/u:S9B2bh9mAiImurjwQA++aVSF0tgRuYv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785909929, "uuid": "e23b55b6-263f-4981-9a52-2f6414ed56fd", "value": 86028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785909929, "uuid": "d09ba7eb-f8b2-4f5e-aaef-07b89867b36c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909929, "uuid": "a9802a22-3f4f-4960-a48e-22e59daec193", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad0bfd9-90a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785917368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917368, "uuid": "40da3b96-0184-414f-81e8-b2932cf786a3", "comment": "Malware payload (RemcosRAT)", "value": "6d7bf977eb4df93faf377a1c1440cbfb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917368, "uuid": "ca12f2a8-ed3a-4237-9d29-d5be452867e8", "comment": "Malware payload (RemcosRAT)", "value": "c8a975fb680ff0c44f3b000cf39ce1f54459a62d1fb03ab0c372308aa1c5c7cf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917368, "uuid": "7a991d41-839a-4e28-8329-408fedf261e0", "comment": "Malware payload (RemcosRAT)", "value": "07adb1a056e69285d4fee8903f4f37d31d62fa38", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917368, "uuid": "08603f11-5d09-45d7-99f0-548c61be9b44", "comment": "Malware payload (RemcosRAT)", "value": "257088d30e548c889a4a666eeb18d3b642759d3207d1300c90f92b9647cb5890efe68a8a1d200dd2029b213b0c69eb1f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917368, "uuid": "f435ebb5-5ce2-4d4a-aa29-b9b07f896c4f", "value": "T12435F7DBB371035C184872CECABC6EDD2864FE92D110E66AFDB83787D20C659A191F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917368, "uuid": "980b6fe8-4fc4-421e-a86f-c4740b92ea8d", "value": "1536:OAsOwvKvmxZGaFCof1dgy+8ahxMrwLTmYPriU88sb9c414yRHI:LY/h/yMKrSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917368, "uuid": "179a27d1-3723-4f51-8122-2d1e39d3517f", "value": 1061331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917368, "uuid": "99178aed-64a0-4462-a476-d5f4c329ff82", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917368, "uuid": "6bd5bd81-56a9-4340-b71f-7e5a13b0bd81", "value": "Purchase Order PO K 0155.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a7d6e9-906a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785892368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892368, "uuid": "ddc5986c-1231-4148-9922-c6cc803bba7e", "comment": "Malware payload", "value": "44bc46927e58e76510e5664a8388169b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892368, "uuid": "1410ff1f-97a0-4664-aa47-42d5f37b272d", "comment": "Malware payload", "value": "c8f50aebfc5cf9506e58593afcee45d98aa2a1e142644aabf316e46c61374f95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892368, "uuid": "7fca7d75-a15d-4959-b4d0-fd9edfaf0310", "comment": "Malware payload", "value": "e2a8359373366989656754cc4931cdf859ff60bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785892368, "uuid": "30ad87f7-2e9b-4efc-8766-54e64f20f21b", "comment": "Malware payload", "value": "dab74383a4c34cc2e092ee9c58e697f4bc09dfaa84f9f7301969129e3b236ae66a4487da093308503c0fed62d6e1adfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785892368, "uuid": "d0988cae-746c-4ad3-a0f6-63a22cbba400", "value": "T15343442A2A21AFFEF56E823047F39E70D75535E226E0C284E26CCB185F7028D585F795", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785892368, "uuid": "8dc6d742-9bfb-484a-8f7d-6b13b494a373", "value": "1536:bYRYD6yh6HEMrBp5r5gEZNe19q057gxsE+BHcTT:l5Ck0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785892368, "uuid": "0659141b-38b2-4f68-bbce-3c478d8d2557", "value": 59008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785892368, "uuid": "1861bc9f-6d30-4b21-8556-46753b8243bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785892368, "uuid": "2cb9f8e0-1d79-4615-a31b-62ec37c91c97", "value": "main.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c3129f-90a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1785917218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917218, "uuid": "53eaaba0-8a89-406b-ae4d-47ceb65ccdaa", "comment": "Malware payload (GuLoader)", "value": "1a5368add57017560fcba4f861f726dd", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917218, "uuid": "a50ac7c3-f1f3-43e1-bde3-fa5f1d6741ad", "comment": "Malware payload (GuLoader)", "value": "c9a4804652bdb057378516f59d8f2c49f0fab84ed875bfa50ef816bccf91153c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917218, "uuid": "06af0796-48aa-4a80-85f8-e675044ec244", "comment": "Malware payload (GuLoader)", "value": "e6eb973207f77a533bf1f025ce52faee8aedcb1f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917218, "uuid": "2b9591e1-ef01-477c-9fcb-e45460463828", "comment": "Malware payload (GuLoader)", "value": "6cc7f0d20ceb700c7fab8c3f5234a2279fbd7476870750458459d3c011d509ecb159ab0360871c9fb1133b6741056a76", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917218, "uuid": "de84d33c-ee40-4033-bbce-704b8649ab7d", "value": "T12A454A20DD2406694E1B17ADFCA60B62CEBC861D522794F5F6DE030D62064FCE3BE66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917218, "uuid": "fa5f7430-03e4-4917-868a-d95f801517b9", "value": "24576:zrkfGp6JK/6JjrafWFR0rDJhIXta+gCfL2YDhr:nkfGp6JK/6JjrafWFR0rDJhIXta+gCfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917218, "uuid": "d8d4b349-ff6c-4d9c-b41d-9e3fb334d835", "value": 1174536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917218, "uuid": "18c1f2ac-6e37-4bd9-8add-f63b2627d5e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917218, "uuid": "c0a2c804-3830-4a09-a60f-dc7e9c03c317", "value": "RPF1910485_20260804.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac6e565-90fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785954170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954170, "uuid": "6ffd72bc-27f7-44f0-b1d1-9adb65880f5c", "comment": "Malware payload (Mirai)", "value": "e53c84fb8d57c1bb595e91da27324798", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954170, "uuid": "079f7c8f-af3a-459d-9d2f-afecb2831486", "comment": "Malware payload (Mirai)", "value": "c9c2d64d444bb8561eadd21233408c6af402108d92b043906fd49a80b7a52f11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954170, "uuid": "ac764b2a-444b-4e90-b7e9-bd16bd2c9415", "comment": "Malware payload (Mirai)", "value": "2af5e19486103da02609caba83bbe1e62ecf62dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954170, "uuid": "5a1bc0fd-07cd-4061-99e7-03627a32ad66", "comment": "Malware payload (Mirai)", "value": "849b098316b43dd5fb5e949052e5c8c6cf10c7c86cdc4ce9b9ce226941ceaee1c92014a9dbdd5cf109143a4a572bb2c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954170, "uuid": "8d3384ee-398f-4247-b23e-a39b6cd826e2", "value": "T1FBE2F1349165DB90E3F12132D2198F8BA1BD97B9C3FE253272EDBF212047887567614E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954170, "uuid": "1b85cfff-521b-430d-b2fb-d77353a541cc", "value": "768:M6chaEX6Rj4MuMxOJG2Dl+wNpuJkrXDs3Uozy:2jXdMsG2DlrN9Kzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954170, "uuid": "27e8782a-c2f4-422a-886d-2c2b8bf2506c", "value": 34064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954170, "uuid": "5549e479-3310-4da5-9a82-99f918eeba79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954170, "uuid": "20e4180f-cc0b-4d95-8c36-57c271bd6dc1", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a099099-9078-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785898227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785898227, "uuid": "aa03af18-810e-49a4-8beb-592a89127e9a", "comment": "Malware payload (Mirai)", "value": "9243523b2111579b333d6741517e4069", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785898227, "uuid": "cca0c133-be29-4d71-a34c-714a90614707", "comment": "Malware payload (Mirai)", "value": "ca2af697388746b2381dc7c4e857ffcec86223ea4618de4583437380050d7770", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785898227, "uuid": "6ef39d68-f205-48ab-835c-ac938a7a1d74", "comment": "Malware payload (Mirai)", "value": "e8fbe93a2a71f28abbd5fab68d97a05e656ea172", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785898227, "uuid": "8b1cb4ce-8c0b-4408-b45a-09e5715457ad", "comment": "Malware payload (Mirai)", "value": "e84a639bf39ef0a25ddbfbda3d8f429fdbc325af9b5ca1e21fefdbd9ed026a1494d7c0afa0bbcae0d9d7d33e1f792f55", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785898227, "uuid": "df2add5b-40e5-4477-b048-635b6b34e36e", "value": "T155246BA8BA0F6C01F2C3D3F8DE8C87E13A1735E3C7768971791212EDDAA39D95990512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785898227, "uuid": "9566a5d3-4fe6-4a86-8058-57790acdcd46", "value": "3072:wwS1OScpwRz0maXCvz9P+HyC37HbKG9P9nKMhazboqN3y:LuOScKRz0mayvhPIyu7HWwnKbzboq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785898227, "uuid": "2146a9e2-564d-49e0-862b-7f4f60670682", "value": 210936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785898227, "uuid": "5efcf29a-8540-4ad5-a12d-c66e78cfaab9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785898227, "uuid": "6aa3dd1f-d025-4146-95c4-15899f4295ea", "value": "sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbdbd601-90fb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785954628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954628, "uuid": "75578a4e-f85d-4d1b-9ddd-f13d5d2c38b6", "comment": "Malware payload", "value": "b87b5ebc8ae3259fffa6ebda0b3d1324", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954628, "uuid": "a95c488c-bbae-483c-9dba-d25e98f43a27", "comment": "Malware payload", "value": "cd8041fc39dbd43ead00d75d64f32e1778f0fb3e32ee3b8e2a024d60e733d66b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954628, "uuid": "40bee4d9-ca33-4cd8-ac63-b460a4e4a349", "comment": "Malware payload", "value": "835d3f43f47a858abeeaa5e479baf1271eadcd65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954628, "uuid": "abaa5349-3b15-42b5-8f39-a938bf9f6c5a", "comment": "Malware payload", "value": "eb29fc639363097f76f217b5261d21d5af901277f45257a2b101ba68ba73f28ad8234af5287f1e78aa5f49e7f075ae3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954628, "uuid": "df1110e2-6d11-4b4e-94bb-df0e06a9b131", "value": "T1A957CF7792167CEDE9B98CB4D01025816DA878874778E3C7BAC470E666EB6D08D3DB30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954628, "uuid": "91aa3cb0-3bc1-414a-9607-093f71fe1d75", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ6:cqYUQuVDt0TZEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954628, "uuid": "11ea6529-acb6-4930-bc0d-56418c85d718", "value": 28213248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954628, "uuid": "75554fdb-e61e-496c-b04e-df539b1c1864", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954628, "uuid": "49a06e63-e6fb-4914-b56b-cd062ad05dd8", "value": "cd8041fc39dbd43ead00d75d64f32e1778f0fb3e32ee3b8e2a024d60e733d66b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc94fad4-90fb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785954630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954630, "uuid": "314b2df0-9a7e-4763-bc96-0d3673aa1747", "comment": "Malware payload (Mirai)", "value": "afef4be8c59243cfaf0805d204963e49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954630, "uuid": "0a50b8f7-2fe2-493a-94e0-de421844ec6c", "comment": "Malware payload (Mirai)", "value": "cda62e4f1121da4c98747dde8e4f79acb4a95fb8e8ce8412023e9b04c985bd2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954630, "uuid": "ffefcc66-8070-49d6-a675-e33999d2f8e5", "comment": "Malware payload (Mirai)", "value": "94dcd74a674c4df0c7b8fb4ebff64e0e07eea465", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954630, "uuid": "8e9c1db8-317a-4dad-a864-9a6a7657bd78", "comment": "Malware payload (Mirai)", "value": "e2d75ca52e5ab5b034cfaf4d94e07bae57cae47f4a7a9c8d94fc1f379d75f8260fe72b91db28ba314e36ce1f596c5a3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954630, "uuid": "4304b13b-204b-4713-8486-1b9eb43cb322", "value": "T158138EBAD42DAEC4D55E5738AD34CA7C1B53E00196531EFA478984568083EECF71A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954630, "uuid": "bad813cd-9bfb-4eb5-af17-7098f8a9dc06", "value": "768:HDbbCwtEfTqLdl6V8eilXPwErBoU6UG2qVBaCoos3gCBm:HDPCwtE7uhtwErc2gBaAygCBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954630, "uuid": "5e342e6b-574f-4c64-bf6a-c1ca01b29bd3", "value": 43356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954630, "uuid": "6aea351a-3641-4773-92c1-1fcfc4ff1ab9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954630, "uuid": "f93225eb-7eb4-4fd6-ac70-9eefdc94ca7f", "value": "cda62e4f1121da4c98747dde8e4f79acb4a95fb8e8ce8412023e9b04c985bd2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00aa203-90ff-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785956380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956380, "uuid": "2a987c5f-4481-43fa-a96a-833dd2f5d113", "comment": "Malware payload (Mirai)", "value": "b95600a3705e12dc9fac3a8e84f878fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956380, "uuid": "c2dd552a-7804-4f55-8bab-b5f9e1935ad4", "comment": "Malware payload (Mirai)", "value": "ce045a6ba4c3c9fcd3719f6a906fca4c4f7901ef60bb6ad99eab2bda9033d197", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956380, "uuid": "7c5f8c4f-eb12-4061-a00d-dbc1e7c3260c", "comment": "Malware payload (Mirai)", "value": "dc2d51988f4e18c1c53d28b4eed42014d385a3ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956380, "uuid": "c579e660-a445-48bc-a306-6d8549eb421d", "comment": "Malware payload (Mirai)", "value": "1762f7322436be0b73de2629951b2d26bae52a66229cee87c4dad1beb53ebc4c2830ab106ad3c0b3918c232c77e424ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956380, "uuid": "2b55200a-e469-4947-b5a7-9a7fdb0916dd", "value": "T18CF3190BB7108FA1D375E63006F38BA7ABA9268116D2D585E36DDD007F6135C682FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956380, "uuid": "0db87d1f-85bb-411c-a1e2-09f9d09f17cd", "value": "3072:c8YOnCG6tGu8nX6mJIgvte4jgXH76tGdhObv3vUjbKS2:XoGu8X6mF1UaGdcT3CC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785956380, "uuid": "75f5df63-e663-4f47-9639-380f97e99805", "value": 167012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785956380, "uuid": "06eb1adc-8568-4876-8c96-bcadc3dd8134", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956380, "uuid": "4880f208-7c22-4a46-aaa6-72d51833fc72", "value": "killbotx.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0249234-9097-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785911713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785911713, "uuid": "a516ac1c-34f0-467b-b119-768b83c3f327", "comment": "Malware payload (Mirai)", "value": "4f5da0547138d112b8e80ef1a35e206c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785911713, "uuid": "2e8a4444-957b-4785-9837-91bfe28e5093", "comment": "Malware payload (Mirai)", "value": "ce0865d3a8cebe945d01f5ef0f5614426f0053a0f55fa8419b4d7156190153d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785911713, "uuid": "00476108-16a9-42fe-9fb6-5d5f16af0413", "comment": "Malware payload (Mirai)", "value": "0af8da8d70116fb3d76fcc8f34fbcf395640fc1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785911713, "uuid": "c2233a27-e6ec-4e30-97a2-d08cf3332d86", "comment": "Malware payload (Mirai)", "value": "ae05c072286312bf395e893d9e44184765e0ca7ef46d560ade46f79a42410dc015e14fd9785b3515cc5be4baf217189c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785911713, "uuid": "213a493a-e971-4d2e-ba51-b4aaf4e7e2d1", "value": "T18CF46C627B21DFA4E364C13008F3CA5599D521621EF340DA727CD71C7A60A6E292FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785911713, "uuid": "f4fe9ef9-a44b-4779-bc60-9c7fa2169c54", "value": "12288:pyfzBXBB4SP4uyI41ZEzcK87FkpdYHYuVdm8pQgpkBaAP:pyfjB4SAuyX1mzcKQFkpKYuVbpk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785911713, "uuid": "79df8e67-3ee8-4168-9dfc-9c1c84affa3b", "value": 734056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785911713, "uuid": "725dee57-9336-4a37-8251-68cbda05f1de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785911713, "uuid": "b9cf4618-4572-4427-a8a3-b7bb10e7f1fe", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da88d2a1-9114-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785965417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785965417, "uuid": "1253c625-15d5-48ee-93d1-8ab5c6157087", "comment": "Malware payload", "value": "6041ec612ed7ca1d3a31e6ac0d4535b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785965417, "uuid": "ad1effd9-036f-416e-8f4f-2da088e804a5", "comment": "Malware payload", "value": "ce37bbeaa6551bab9cdd06a7c05217ce3ca049473d721833a2137ca7d68370e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785965417, "uuid": "dd8cca58-7bb5-4059-b255-5c01300d6c78", "comment": "Malware payload", "value": "e453d1973774406fc45e573f20c1321de848c416", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785965417, "uuid": "eacff448-ab6c-4e9b-9a11-39557801a0f8", "comment": "Malware payload", "value": "6b0a8fd332e2b83f4adc7074fd2ee42273fa4c7abda127379ebee555a9489f60b82742b33e2611fa3e6164c86023f8fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785965417, "uuid": "21786e58-ec13-4fff-be88-dd6ac0554317", "value": "T12B261973A49154E4C2EED574C6256213BEE0389B273423DB7BD066E11B7AFE49A78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785965417, "uuid": "c6ad291a-adcb-4093-919b-6a828555beb2", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQX:cqYUQuVDt0TZEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785965417, "uuid": "e833c79e-5424-47a8-be3c-ad2afa407f3c", "value": 4685824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785965417, "uuid": "43bc5102-dec3-4b5a-a868-ffe4ca3af674", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785965417, "uuid": "727535a8-fb95-4cbc-9f26-e0e5e71bf2a6", "value": "ce37bbeaa6551bab9cdd06a7c05217ce3ca049473d721833a2137ca7d68370e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68901752-90a2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785916263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916263, "uuid": "0a4591ed-efdb-4006-925e-7a5193d2860f", "comment": "Malware payload", "value": "1130d78a8cf66a9ddb40c71a2a1757d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916263, "uuid": "7a4b2468-7111-425c-b544-21414113babd", "comment": "Malware payload", "value": "ce61700a601d0ed8aa448c1a9ba8729e8433edaeb9104e80df5244e726930e7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916263, "uuid": "62e73ee1-133a-47e8-b288-310be2169b7f", "comment": "Malware payload", "value": "e2b590b10f56d7a713200c1b1419dcd51aa9d231", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916263, "uuid": "ce2a7460-7554-4794-9fcc-8a428efc43b7", "comment": "Malware payload", "value": "8bf43b570f67af4434a6ac13c6cc7f87db784c3a22372eff7b2f7be8976a1a05e74eae3bd9da265f61f583e01c125006", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916263, "uuid": "eab0a1c7-7f65-4625-978a-6fcba8adf0a4", "value": "T139D523DAB9F60DB4C436C7728F57E06EB0AE774096A19E47FADCB510AA53484483B331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916263, "uuid": "75ef35dd-283c-43c9-95ca-ee90a59312af", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916263, "uuid": "7a703d9d-8511-45be-b8b0-dea2ae6b17c0", "value": "49152:cfhoWHqVbThYN4p28ScO335kwabznhI8AxsROcOKXxFFMi5G87UMPoyzuLDsMrEp:c1HAnhYN18mywALhHRgy3MinPoyzaxIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785916263, "uuid": "61648159-acfe-4ee7-9854-84e963aa9afe", "value": 2909184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785916263, "uuid": "9b8ca283-0375-4e12-a1d0-7c3443562dfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916263, "uuid": "625e2e9f-0862-49d8-b12f-35c65076f938", "value": "6eq5gvOfRvNmCi54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8a42e1-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785917694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917694, "uuid": "47f31497-2cf4-41e5-86df-15f9f4bd2eab", "comment": "Malware payload (Formbook)", "value": "1cc3a5618bc8113ca477def2b873d679", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917694, "uuid": "df1fd6d8-e210-4a1e-9c12-fdd40b234fe2", "comment": "Malware payload (Formbook)", "value": "cf3e25b9df6cd364cff63b065e09b19bca105159edd64e9fa97ebe3a0e5e17a5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917694, "uuid": "ff175f7c-8345-4c50-bffc-1eb6acce00a4", "comment": "Malware payload (Formbook)", "value": "1fa160d96f2194e18ad2b3d5d35385d231459e89", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917694, "uuid": "5cdaf246-0e26-4d11-bb3c-268b67350c99", "comment": "Malware payload (Formbook)", "value": "bb838e20854177e8daf1abd605bff7c72c14132dc91d611969037c177f9b9722938a089117724c622e3073b06429aa04", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917694, "uuid": "a03ff4c0-da6d-4ad5-b969-a16d6a4ce711", "value": "T18D259EB573923F0DB12D8AFB5EA927104CB93A5915831B4492E82BCF7511E87EFD403A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917694, "uuid": "1f3d1d4e-576a-4e8b-a1fa-597474d1d8fe", "value": "12288:NMsV69MDm/VPFKpBmtbJjjb7BnOEvO7td7ovzbGvVvNnfbdyvaKaI7Oa1xcrjuQt:BmfU2bJr7NvFfGvnnRyS67OyW245", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917694, "uuid": "121b99ed-1197-47b1-8187-128a1b63954f", "value": 968416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917694, "uuid": "e3ef70d3-0baf-4d10-8675-143c838c283f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917694, "uuid": "2c9934eb-9a9a-46c3-88d0-886ad43313d3", "value": "COTIZACI\u00d3N _623895.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeec1111-9106-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785959331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785959331, "uuid": "f1d5dbcc-137d-45c0-8e8f-fe4db59652a1", "comment": "Malware payload", "value": "932a304eb9d78fd05615a78da06aa299", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785959331, "uuid": "72188264-57b7-40ea-bf3f-8d6fff6c7425", "comment": "Malware payload", "value": "cff23479efa73587cdc2ef115a4e90e8e8487e3eb4c8e4566f36ab606f8714c5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785959331, "uuid": "8b84401c-69ea-439a-aa91-b0d56eef03b4", "comment": "Malware payload", "value": "3ff7a243cf158398fcb4abeee849d9d8b15f75af", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785959331, "uuid": "d0b9b588-63c7-4e81-b539-f22fad60661b", "comment": "Malware payload", "value": "8bee2ed188a537b98d1effb7b99f3063bd06ab212720be4fb4db06f6f8b0c88132fe5697b3466d7211b6e123a108adb5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785959331, "uuid": "0dcbbf36-47f5-458f-ab3c-886a5a1433a2", "value": "T16AC27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324A42AC3D8A3C71DC11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785959331, "uuid": "1f139a54-3d2a-4766-9b86-4c7093d93958", "value": "768:i8vCB+25j6es8Rk9FYpMSUpi+20qUpi+20YQX:i8l25JCd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785959331, "uuid": "f7eec225-f4bd-42f9-8d8e-3c4af92fdeef", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785959331, "uuid": "e5af5c9c-f637-4d11-a735-63f4c628ea88", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785959331, "uuid": "b81fde9b-a9a3-470b-836f-a8001c009a6a", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632e8963-9101-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785957057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957057, "uuid": "b7d365e8-8601-4c1f-8bdd-503cdb0637c4", "comment": "Malware payload (Mirai)", "value": "84231cbd118d00c43dfcd87ed73623e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957057, "uuid": "bd1aa057-8d81-4f6a-b35f-2a2bccd995e7", "comment": "Malware payload (Mirai)", "value": "d13df7dbd4a2f0abecc0039a942e9a8bffc3e98e3bbea0abdbca1c2a1908dcb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957057, "uuid": "3b5a3ff5-b83e-4e3c-aa9c-46ff14e8063f", "comment": "Malware payload (Mirai)", "value": "63f8644d00fadc5095bcd2cf83c13e4da9a89af3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957057, "uuid": "3fdb99e0-907e-4886-8509-0a47bea7a29f", "comment": "Malware payload (Mirai)", "value": "c102c661f7b05767fe9c6347857678c8d5114352bbbdca4e01fcab0a55f47d8a38b6d7036b2ce22e2c13b0d43047f876", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957057, "uuid": "55b809aa-133a-4e05-8f2d-2c5bee703cf5", "value": "T13B3302A3F9FAA270C1628A72DD1B6641FC75ED1949225F6305C9DBFDC5832782E80F12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957057, "uuid": "0db61076-fa3a-4203-87e1-452a58aebf91", "value": "768:qFi299ncj5+AZpRuKASir/MIgbamgMBHU7+B2cyzkl65uu3CXkWPexfF4hH1+c48:qQ27SqKASiRgbamHUy2c8yXkE6eN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785957057, "uuid": "7d56fefd-6186-49bc-a253-8dc7eb10039e", "value": 52028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785957057, "uuid": "d658ec19-b859-4c39-8205-e5915a9d0ee0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957057, "uuid": "d30d75be-7d98-40ba-b898-cd009ab184fa", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17f8223-90a9-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785919446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785919446, "uuid": "ccbf5ad0-7adf-4f3a-9a22-570e6164fe68", "comment": "Malware payload (ConnectWise)", "value": "7c5f3b797e639deaa5a0a7a3136bb717", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785919446, "uuid": "5ef7f312-97ac-46af-ad00-efe9b590ac1a", "comment": "Malware payload (ConnectWise)", "value": "d20a4a83a75724b81c7e187f1e391125ac89b95488a2d101f5a808ffed1a89b2", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785919446, "uuid": "4a251a5d-1024-44e8-96fb-b66a45144db8", "comment": "Malware payload (ConnectWise)", "value": "60eef06baaa54ac4f5c906228693b4942417549a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785919446, "uuid": "63442862-ccff-4950-b8e5-a624aa348c02", "comment": "Malware payload (ConnectWise)", "value": "1fb778058179d3859517c7c90b0630b5189e9d4fd210d07241bac6d10c483ec201e4721bd33dc4f495b38941f7785bc7", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785919446, "uuid": "2375e23f-c530-4aba-abdf-581adf545657", "value": "T108223B441B4A887CF43C0F65686A21575DF7E409B9955EC0EE3B2BD3BC2F858A4B078C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785919446, "uuid": "20a7691e-e494-421e-bad9-da6dbe593ea8", "value": "96:jfSANkGqKVtmRyhVqT2MZFF6yyJ8XQEd16VlifGFUgyIV2D16B3JWMpOXnRE61ZF:5kGtzSnZ3djIyImao7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785919446, "uuid": "f4e71456-cb81-4707-bafb-f6b6756f5ea1", "value": 10286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785919446, "uuid": "26b937c1-ae1e-4b8b-ac73-3efde77b1395", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785919446, "uuid": "5d8af36f-b438-450f-8362-b4942f8eaa0b", "value": "Document.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b04b217-908d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785907248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785907248, "uuid": "73b3b779-aa0e-4a71-bb35-5f803bf366d0", "comment": "Malware payload (Mirai)", "value": "1c63082980cbbb2f9aba2b5179cace9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785907248, "uuid": "2ad1f66b-1197-4cb7-a31e-9d8639b8df7d", "comment": "Malware payload (Mirai)", "value": "d23a65074cd7af8d1bcbd70b3862f1ab904125b10b108018b2d75d37eb21cd4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785907248, "uuid": "673a7b7e-3dfb-4132-b38a-eaa0749812ce", "comment": "Malware payload (Mirai)", "value": "d8ab8ee6628acc715ac87a39a57355f0f0628511", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785907248, "uuid": "912d4f9d-3ebb-4f67-a394-c995c53ea957", "comment": "Malware payload (Mirai)", "value": "f1e51e89e764ab52dad6d5ca83e02e7a79cd38a82e5967275fef5457139b21ba4fdb1b37e9be0378d074b3f74dc6a6d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785907248, "uuid": "d24b60c7-8b5f-4c26-a138-dd088a8d1582", "value": "T1BAC32AA9F890DE52C6D526B6FB4E418C33231778C3DE7106CE149E3477FB95A0A3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785907248, "uuid": "21d9302e-722e-4c9b-a749-bee0b07c5142", "value": "3072:R74ICbzNB9v9/KUMnZGIKgcYEEUInhMWTNwhR605cqv4NvF+6AuS5mf1Dlo:RsZvBArG/gcYEEUInhMWBw6icqeNjomQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785907248, "uuid": "9b80496c-d4a1-408c-a860-dd3e2c7cc42d", "value": 128444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785907248, "uuid": "f7974fb0-e1ba-409d-9dc2-22b42ec23ae0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785907248, "uuid": "9adcc6e1-ccd4-445a-82e6-3daaa3c8b4cc", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ffeb9b-90d8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785939529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939529, "uuid": "d14a3518-4d69-44de-abc3-5ed84550d182", "comment": "Malware payload", "value": "d33ce2e4961f58136588ff6c5c9aa76c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939529, "uuid": "a0cdb81a-ef21-4bf7-b9d0-dc92b78d0353", "comment": "Malware payload", "value": "d3c060e3dfaa2fdca0d8aa47913e9772c81525148aa6d9f5d443ec4f24ef9877", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939529, "uuid": "c373c949-b87c-46b5-a812-86057012f1ab", "comment": "Malware payload", "value": "c2401bdc4f40ac34a7e6d9dca577fe9b8aa715b6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785939529, "uuid": "bb1735d2-9d91-4513-ad7a-2aa2d8917da7", "comment": "Malware payload", "value": "2903f04de1f9e1d021e1e0e7a8ef8d9b5a69f6f0bd790dc0e8814dc64baec41d86fef22666caf4ebeb2a4215b5155d4c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939529, "uuid": "dbb2baec-b324-40fc-b98f-fc14b35f3048", "value": "T17E01AFCA8040AC105099A96C22975594F820C3CF25964BA5FFBC6D7EEB94C14B0B6F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939529, "uuid": "d26567c8-9bb9-463d-95fa-827e96f304e6", "value": "24:kXCKysE2hi0ziQvZohaeLvICp6ikBprOlYX:e9Qp+MseLvICp6xBprOaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785939529, "uuid": "824cd175-fc3b-4f0f-909f-34047cf96dba", "value": 844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785939529, "uuid": "14a2fb39-de04-46c4-bd51-7e2ff971d4ff", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785939529, "uuid": "b59b38d7-04c9-4c2f-b9f4-2a9a0afd0a04", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163a67b7-9101-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785956927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956927, "uuid": "335c4b21-df7b-4f3c-b16d-c3a618403c44", "comment": "Malware payload (Mirai)", "value": "48f6ef54d42915a536ff3d655eb4c147", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956927, "uuid": "e920a2e3-c1ce-4a8a-921a-c535ed8848ac", "comment": "Malware payload (Mirai)", "value": "d46895754916d90c544507b60434029d147df7d85a1a4a83391b567a77ed3111", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956927, "uuid": "f1cd02e1-d3d8-4fe4-bfea-0df7e5ab7ccd", "comment": "Malware payload (Mirai)", "value": "5f855082dced650ce684295f010849a48991ed23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956927, "uuid": "dc7fdade-2044-4350-820a-ea886569245b", "comment": "Malware payload (Mirai)", "value": "f51892ac0984646cedab244c1a30141c53448f8694424df45b37daaa7cc28b026a8e5f3f681813ef41428b8b48ba89f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956927, "uuid": "44f4c4bd-27df-4bf6-9aaa-0e88ce51cd7f", "value": "T16D63023D9DC495AFEB1C3C7EE8EC22189F4531B052E503B46352DCE4496858FF4A8D6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956927, "uuid": "a41b500a-9455-4322-8b50-ccc49b8dd651", "value": "1536:39/5Kilvac/UELnOqh4YNtzYi3le43i4mWbIm1fB9gQhNoo:39/FhashjsYz3SRWxfXVDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785956927, "uuid": "c97907d7-081f-4bf0-913d-83f6dc421e3e", "value": 71832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785956927, "uuid": "7a85c87d-ea33-43ec-814c-2f950c170509", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956927, "uuid": "3eb2ad18-01c9-4981-ac86-3505256c9ace", "value": "killbotx.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd54f28d-90a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917265, "uuid": "791e933b-1db4-4ba1-b51b-d09cbd9a6d54", "comment": "Malware payload (AgentTesla)", "value": "72d2dd31448aca5a858ff24c3e731941", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917265, "uuid": "3b8d9a40-0c22-436e-909c-fd86cac32603", "comment": "Malware payload (AgentTesla)", "value": "d6ea3677a8ca991af8308c8a7aea50c786d09447445fa541a6b9e53eb0e38fb4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917265, "uuid": "4430fffd-5d00-47d5-80d9-4d10863bf910", "comment": "Malware payload (AgentTesla)", "value": "d25de1bd00fa3f042feb434b3dc327462d43376c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917265, "uuid": "25ab77b5-0db4-4a50-812d-5b5e7c4ba8fd", "comment": "Malware payload (AgentTesla)", "value": "98c53596b472838e9b34547121e2ceb25bc43b5fc4b23f83cf2a2aa4413df64341e2ccdb1a8abe1d39b8dbe3218ca10e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917265, "uuid": "6932963b-383a-4db7-9400-dc25f49c4cad", "value": "T10DE539605318A7B0A92CAB2DD5365F164B2EB01B52E1FF0D376C27487395B5F238D8E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917265, "uuid": "1ab5dc15-1fe1-4df6-8ab7-eac204b81d52", "value": "98304:F1aPHUIcyrzVMOqeZBfKRLUGdKnBA4GdhyLXscX39lN+gmNM5x147G:FYMnaieZBlGdyBr4hyL8cXj7sMfO7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917265, "uuid": "d9b378e9-2d84-42b5-8993-6f384cdcf1e3", "value": 3311194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917265, "uuid": "80a5c6bb-ca45-4a78-b996-5fca4f371db4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917265, "uuid": "570fcd28-95a1-40b4-bd48-e8c929b9f203", "value": "PURCHASE ORDER_CONTRACT AGREEMENT_Doc.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d1e391-90fb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785954617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954617, "uuid": "78f15380-9c62-49cb-8774-b80fed887eb6", "comment": "Malware payload", "value": "1d5e9f455ad4dc87d28787c991241c3d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954617, "uuid": "56431037-d573-4ef4-a907-eb9ad0d6efa7", "comment": "Malware payload", "value": "d703fab188c2e55489d07e07cfe375f546ed47368338e5fddee0faf17ed1491c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954617, "uuid": "976e6934-5a3e-418f-bd55-c156fe2caafc", "comment": "Malware payload", "value": "642a06a66be799e73ab3d6dfbc66a66f2fdd58a3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954617, "uuid": "2f7b327c-55d5-462c-818b-cb4e547e6250", "comment": "Malware payload", "value": "bfbd4fabe7403305633743e8520130d95152ac40e8fbb819eba2317567d12b0066061f94a314f1c134d7737bee26e654", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954617, "uuid": "3b436ebe-91bd-4014-884e-e82155fe524a", "value": "T12431609F02205B34231BCEDDB7B23548A00D95E7296BD7E49C084EFD92985DCB262FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954617, "uuid": "954b2828-b058-44cc-9b36-171ba48ec02a", "value": "24:jtonlgIaujZbeFelvtVNX0HiNQyv+tTnr4eYSdcLNv:+0vklvbNkHiCvtiR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954617, "uuid": "205470d8-eeae-438b-b5d2-db229a92d5fa", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954617, "uuid": "5b96b23e-664d-48c1-95e0-03a94af20dd9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954617, "uuid": "8daa2617-30c2-437c-bfdf-426ea4f46a77", "value": "d703fab188c2e55489d07e07cfe375f546ed47368338e5fddee0faf17ed1491c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8467f82-90a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (a310Logger)", "timestamp": 1785917229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917229, "uuid": "f01cb0e5-62ec-44ba-a0b7-e6b572a763c4", "comment": "Malware payload (a310Logger)", "value": "6aaed8fef0599c3637b7f96b745aac78", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917229, "uuid": "4a3d34ec-987c-47e8-b1e7-41681520e394", "comment": "Malware payload (a310Logger)", "value": "d78a408eaf714a3e8d46a3d0a79e61288f20a71c3283e2bb46496227afb047c9", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917229, "uuid": "0c7044d7-7d7c-4d6a-9d62-5092007a6312", "comment": "Malware payload (a310Logger)", "value": "8849b76f03d0b3c209d0eaae748feeb39a831662", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917229, "uuid": "6a79a008-fc7c-4284-b1dd-9648abd4e5e7", "comment": "Malware payload (a310Logger)", "value": "2730c084012b947ac49cebdd690dccdd0798fd56166d03e659d046e43a9feb75cd2936e80262d5ef3c49f78d2d507de1", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917229, "uuid": "7f3e7b63-714d-4527-a120-81676cd8e50c", "value": "T14946C99163CE6B5A6D11B67C320CC4484F0FD8757583B8C8B0DF4995360F8AB6668FAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917229, "uuid": "9b47ab37-639a-41b9-8e7c-364c848315ad", "value": "49152:HANBfRrmIgM3GU1Sq7gCLzaD5PsNAIcpNrnx73mH2IxKymjS1xKI5VnQumNpr:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917229, "uuid": "2189b647-2f21-43f4-b8fc-2fb3e3379f0e", "value": 5392306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917229, "uuid": "124282c5-c329-44c6-98d4-6a24d78d1b81", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917229, "uuid": "73bb1aeb-daa9-4b46-85c5-b19006e866fb", "value": "DHL receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29cda37b-909f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785914870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914870, "uuid": "4ff39d88-3b10-429c-84d1-48f23fd6d6aa", "comment": "Malware payload (Mirai)", "value": "7611f06a3cc7291c5504ff95d41f73a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914870, "uuid": "12eba551-61ec-4828-a606-7aea72fd18d1", "comment": "Malware payload (Mirai)", "value": "d80e73f79ea87aa2b9c2f488d8acf56f19059c32db8aeefe471a8907c9c5dd52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914870, "uuid": "8ca194af-2dca-431b-886a-80038cf46f1c", "comment": "Malware payload (Mirai)", "value": "a9d214a67ba33fe851f117d0d0402c97d4279d0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914870, "uuid": "b063efdc-ab58-4994-9a08-52f108fa88bc", "comment": "Malware payload (Mirai)", "value": "80f65a1c811d43c4c65d0981701d2b2a1f940c979e84666ecdf6a9292e6b4e875172ade23d5c36d28de6637c7a9dd16b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914870, "uuid": "13339193-8292-49f9-b7f3-fd6b95d8f5bf", "value": "T157E35B49F95BC0F0E6D340F1062BEB6A963A99116233F5A1FF5A3B71FCB1301648626C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914870, "uuid": "7baebe84-d2ad-4b78-98b1-b73d2f3ae2f1", "value": "3072:kjdzGeNNJ8TcPpzQd9ZEACmAjLkqCu+aNgt5ooWI5TOe:8GeNNJ8TcPpQDZHCiqZHUoobq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785914870, "uuid": "7e1af357-2c7d-4c64-8535-0c9058fcdb6c", "value": 148860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785914870, "uuid": "21660084-83eb-448b-a652-855dc0474154", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914870, "uuid": "658bc9b4-342f-4c74-9388-eeaf90ee78dc", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bae8efa-9069-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785891626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785891626, "uuid": "f71ed31e-a64d-45a6-9a01-a64c948fcf41", "comment": "Malware payload (Mirai)", "value": "3a05f5ffbe4f0d7ef69a0aaea19444e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785891626, "uuid": "4cb4656e-67c8-4bb0-9dc3-52f02bec9fb0", "comment": "Malware payload (Mirai)", "value": "d8602f06298cba1a8fbd4c3a2ef8f68cb3e5b07f7d933bfd0e6184b4e683a1c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785891626, "uuid": "111a528e-78bb-4c6a-bdb4-fbf1c21f3f86", "comment": "Malware payload (Mirai)", "value": "0e7f3696f835455a0e849763983ede60127e0509", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785891626, "uuid": "ff324a9b-e807-4723-b7ef-e67b4b8cd8e9", "comment": "Malware payload (Mirai)", "value": "6166525a74282969d6916607c72646fc6c30475200a6d12161f9aa915319e7fdc9dcb0a4854a312619fff193404f2533", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785891626, "uuid": "3dbac6ba-4a31-46f3-963f-60bc20d403e8", "value": "T1EF1302D222DC8DA0C61D15FE128D776E116CE6EAECD2D8ED49C001659CA0F593D60BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785891626, "uuid": "349da972-07e7-437f-8782-2c1e6e55d0d0", "value": "768:Pp9i4h0726dzuhnvpaaJ/dXNs5VINsio7Fd/N1H/zwnbcuyD7UHQRjqg:Pvi4h07shnhjJ/dB+ioRdFynouy8HyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785891626, "uuid": "1d716301-236f-434b-896b-ddc3f5aefae9", "value": 43372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785891626, "uuid": "99a282d4-f66d-440d-a501-28f96698c6af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785891626, "uuid": "393b4637-afba-4fd7-b4e2-0954e55be380", "value": "d8602f06298cba1a8fbd4c3a2ef8f68cb3e5b07f7d933bfd0e6184b4e683a1c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6cc4d75-909f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785915187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915187, "uuid": "2bc7c7f3-3192-46c5-bb30-ce964b35c1aa", "comment": "Malware payload", "value": "275013927c2e5716c9525f2a596430f6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915187, "uuid": "cdc59bb0-6d1d-49a1-8c04-6aaa023b3008", "comment": "Malware payload", "value": "d889886ed43f20cf45da7c54341e9f28e0a686d69240a6042f651ca25500e779", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915187, "uuid": "d05eea8a-8945-44a9-b51e-b3f8704981e8", "comment": "Malware payload", "value": "58d4a6870447546db20549750f13bb74ccb73731", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915187, "uuid": "e831b543-a343-47ec-9103-347e1a1cde81", "comment": "Malware payload", "value": "89a294af80030ee77088651f97022285a9409a7c1bca274d2ee50525b818607aa8a0d73b44955b4828b9f8b4bcb972de", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915187, "uuid": "dfaca162-9c2c-42ab-9cec-45cdd9b60041", "value": "T17775C60BAA7551E1C1BAC038D542653FFC7034A68B70A7D7A6899F171B23BE4E93E740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915187, "uuid": "378869fe-04b8-4e49-a34b-aab7a2418555", "value": "e52263e980e5c1fb58ea5c70d6157e35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915187, "uuid": "5156d322-1b30-4466-8305-c0830aff60b8", "value": "12288:qvkoqoe3fLzejbWjNZGR8UenL+sUkatvWgjuwh1eXU3aHYHWZLBTYUCbP7KOdpyj:qvvvG/e/WjNZjnfgjJ4HYslT6b+OiLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785915187, "uuid": "5bbc3346-b386-41cf-805e-3f13f9473fb9", "value": 1697792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785915187, "uuid": "f7820e0b-d414-44fc-902b-5af322f9f010", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915187, "uuid": "e9d47f67-21e1-4408-adf1-a1192e7b1a85", "value": "conhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4574dd2f-90f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785950564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950564, "uuid": "22d5ed1e-4374-4a8e-8876-6b9721d8e1f8", "comment": "Malware payload (Mirai)", "value": "60bacec7042bf7478c6d27c8977f5c9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950564, "uuid": "71ce1678-39ea-4316-8623-79275838c78f", "comment": "Malware payload (Mirai)", "value": "d897d6eacd63f138cdfe540265abdc747ec9ae8da8ed3f3e3e1b029a94b2c18d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950564, "uuid": "5791d8b8-17cf-4215-b4c2-81e2ad9b8728", "comment": "Malware payload (Mirai)", "value": "8a624b790346cddf3b0e5fd2d568a1c501c1ce8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785950564, "uuid": "09cf130c-ac2b-4cb0-9a47-0fc593bfa364", "comment": "Malware payload (Mirai)", "value": "5c7144203ad907792577a4410a149d5a8e5d4056a276547ca26cb6d29a97ed2b6200bd25ab3e498eb906c0018ab7e380", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950564, "uuid": "209b4534-9896-4362-82f7-f4faab517273", "value": "T1408312CB4AD452A8C1D6F6F746F7DD0AB0A7210D2D5C88196A8EEB35CC15CC2ED6C4B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950564, "uuid": "c702e425-c146-4f36-bf8a-14c0af577eaf", "value": "1536:2AMptf+vY0uWXMxOZAFAmarr0fqD+6nuI9sbJfAyBJV0aBKnc:W/0uWXMx8AErr0KZ9SJ4yBP0aBKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785950564, "uuid": "6b3fa9b8-ba5e-4883-9ac5-d5d7e8b07f8b", "value": 82760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785950564, "uuid": "0398cd7a-876a-468d-a1f2-9d688f48faf9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785950564, "uuid": "b6275e58-7534-413a-89af-3626a65cadd6", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61084e9-9088-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1785905280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905280, "uuid": "94b3b0ac-8a42-4695-92fd-bb12e5f85e3a", "comment": "Malware payload (AsyncRAT)", "value": "422bdf2d372f11fe15f51c38ad1bbc5d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905280, "uuid": "a1030768-ff60-4d68-92c4-3b288b2b309c", "comment": "Malware payload (AsyncRAT)", "value": "d8a047f6201766e5e3fbab78a017a055e5bbc9d9b5e53883eb07b27db6d06c48", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905280, "uuid": "bc08fa07-a8de-4957-9353-a832c18a7126", "comment": "Malware payload (AsyncRAT)", "value": "53061609767be91ba692c7928ea257556bf05766", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905280, "uuid": "09246413-7f2d-49b1-8f7c-bb627f227456", "comment": "Malware payload (AsyncRAT)", "value": "83736d3c0226b58b59d554c634f42d021e0bb4f684663c4164c44f8ca1142c8955f9a85ab7bacd064af493d62b060e02", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905280, "uuid": "fc2f4143-18b8-4395-b391-c4c45208c75d", "value": "T116575FA4C318D1F2D5835C74C169FFE99E857A1B84EB101EA28011CE0BFADC568EF796", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905280, "uuid": "57c90eb7-0e02-448f-ba66-645b901a81a0", "value": "1536:z1oGpSTUIr8R7SUBCJHlb0WZ3P78Yi2POynfffWMWlESK473V4HzUbSn0GZ1aiM1:obH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785905280, "uuid": "5b73b2b5-83db-482a-8265-458cf0691d5e", "value": 27543658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785905280, "uuid": "db70ef6b-f774-4a6a-9e49-ce5a4e733456", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905280, "uuid": "a99c65b3-e4e2-4915-b470-9e3db8522e00", "value": "requerimiento preventivo.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9837cd63-909c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785913766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913766, "uuid": "d872cef0-68a6-48e8-aa69-e0a7f8b75a70", "comment": "Malware payload (Mirai)", "value": "9f1cebf13f111247c36afd624c3de0c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913766, "uuid": "12ea4da9-fc58-4c28-a7b1-23ab4bc8b8cb", "comment": "Malware payload (Mirai)", "value": "d8d0970d2f58a1ae38e7a6163b2d5de5ec53e065bf53882422fa4bb458c2f19e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913766, "uuid": "ca20db05-52c8-4570-b709-6a74cb2812c8", "comment": "Malware payload (Mirai)", "value": "9634be70aa1d9e6b8317de0a3563c153499a2937", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913766, "uuid": "2ffc275e-f256-45a1-b929-3495e2e7e2e1", "comment": "Malware payload (Mirai)", "value": "c672108d870337554aa62908fb430dbf0a3fefb8db853f089182453ff0e30e02d72352a78c72b9b96ad5d3a14440c34d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913766, "uuid": "55a082d2-dd52-45a8-8690-c0bf542f0124", "value": "T1ABA3C71E2E219F6CF2B9823497F78E30975923D127D2C584D1ACD9002E7434EA95F7AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913766, "uuid": "110c1bde-5afc-4d57-b092-6897b15e3a85", "value": "1536:PjfVBcRQMRXTUS+i3HagtTavVurqBTz8hgnn0c/I5CFr0QJv/jGd:rHMRXTl36gavVhBTcy0uR0QJvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785913766, "uuid": "6e2b466f-7ddd-4d8e-8be7-411ef5ec6efe", "value": 105440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785913766, "uuid": "ede5fe63-b552-42b0-90bf-02bb89158fbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913766, "uuid": "8719f832-b691-4d77-80de-08dc8212599b", "value": "F9M", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e278682f-909c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785913891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913891, "uuid": "556b216b-8cd6-44ae-9b10-3005afd5382e", "comment": "Malware payload (Mirai)", "value": "7df4cffbdb613d1f8249a6603bb5362d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913891, "uuid": "029c99d1-c244-4dc8-8c53-220394cd429b", "comment": "Malware payload (Mirai)", "value": "d9ddf05d9a259ad69c81097a475918fdf75c2bd6f8e123469f22478d22201b1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913891, "uuid": "1e5859c2-451a-4512-ba75-eaeb05dca011", "comment": "Malware payload (Mirai)", "value": "3039df76d842b76673eecdda48c6d9655a1f51ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913891, "uuid": "60eb1f1a-32fb-4280-88cd-dbb4b6c1a2b0", "comment": "Malware payload (Mirai)", "value": "7b783022cad6faee1bfbb5ff4c0c69096a223a0773fd231cf4c3fe7823cd54f5158842aa48e4861e39829deceabfd06a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913891, "uuid": "430639ec-8f0c-45a5-9c7a-a06316f48482", "value": "T1A5B4C0C677063F3EE0B7553D84E64F176B25A38545832B4B203AF6A969132F43F256C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913891, "uuid": "0b884eeb-5ac8-44d6-965d-d8f23a636878", "value": "12288:AfI1+2Iw1nfRTMuqDr/H1mA05kMNBLVLhV06:Ag+Tw11ITVO3VD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785913891, "uuid": "46eae86c-4cb9-416d-acb8-9d76ea1db8c4", "value": 534600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785913891, "uuid": "0f5da202-ece2-4090-85ed-c68f88deb62c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913891, "uuid": "b2b5cf7e-1fb3-436e-b6f7-fb14ee343917", "value": "xd.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "568cc58c-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785917522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917522, "uuid": "1de613af-128b-4551-befe-5c0ffff1ee6f", "comment": "Malware payload (XWorm)", "value": "cea71cc80f38caff1b6487aa33192d51", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917522, "uuid": "4c747f02-d0b1-4322-b2e9-1d39a6dbdaf3", "comment": "Malware payload (XWorm)", "value": "db52832d1e67ce8a6e29c646df9746f9afe0a046d723ed3a2fb9e148f84022d2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917522, "uuid": "deca5580-5419-4e92-8c2b-551af69846d3", "comment": "Malware payload (XWorm)", "value": "d80fb46dd68ee2c76ed5c981d757084c1668e1ff", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917522, "uuid": "d38d5a63-b834-4a95-b7bf-afef2e8e9bfd", "comment": "Malware payload (XWorm)", "value": "2e2cc5781eaabff296c948ef5f79eabef41aeb1b5e4e797cb613baec697249d96f9414d738e05177ccc5a2474b8e07bd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917522, "uuid": "43e2dfa7-26fc-4e4f-aa8e-070b1fffae36", "value": "T18535288343D09661A491534ECE4F328DFB7303766C626B2DFA5BE6CD687021D88F66B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917522, "uuid": "0c22d26d-3f63-4a3f-9eb6-17f07e5eec35", "value": "3072:1weUeUkgVUZweUgVUZweUgQwSp10mp1VU5eUMwxU5xUZwSpAUpZwMwxU5kxU10QG:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917522, "uuid": "a0526d42-3416-4b54-ac97-a94f4ac6b354", "value": 1111342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917522, "uuid": "68c67f8a-0304-434d-bbfc-29d78092c1cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917522, "uuid": "ca3e930d-9530-48c1-a76a-17baf4437d9e", "value": "05-08- Payments-01.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add27c61-9106-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785959329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785959329, "uuid": "d3b8279d-1d37-43f9-82ea-bec764f28fc1", "comment": "Malware payload (Mirai)", "value": "7c0f837666e5529d3158a6c2084e78a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785959329, "uuid": "9551e31d-11fa-4198-9f73-96914a031f4e", "comment": "Malware payload (Mirai)", "value": "dc9d4d94549c878c392d0ceee8bdb84f459ea97d395d46446d7bbcb8ba16a23c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785959329, "uuid": "a7eee45d-58fe-4b08-99df-6c1dbade3b54", "comment": "Malware payload (Mirai)", "value": "62ccb8b2d3a4382354f977574918fddd885bc05a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785959329, "uuid": "e011044e-647c-442d-8032-2b75507651aa", "comment": "Malware payload (Mirai)", "value": "31b59d69d287d45be32de102b514fa2ca93c3cb1c6a3abca1208c399009c5c646042471e58f000e2bc9e07cedd18b6ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785959329, "uuid": "d0d77620-21d0-49d2-90e5-34438faa212d", "value": "T1DCB3F855F880CA52C6D5267AFB4E428D336317B8D3DD3102CE24AE3577EE99A4B3B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785959329, "uuid": "4c00e18c-9730-4cd7-90eb-fd4a4eedd20d", "value": "3072:X4hBPjKWCiEOLZXgQioKZb8E78GlpodKn5am:X4h9jKWCiERoKZb8E78AoM5am", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785959329, "uuid": "d863ca37-77ed-4ca3-b621-f64334288a28", "value": 112164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785959329, "uuid": "d5192d2f-4a31-493a-959f-f9f91616c859", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785959329, "uuid": "89fd44cc-9e2e-43b8-a659-0060daf2e023", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca76443-90fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785954227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954227, "uuid": "3a049a5f-1b01-45bc-95c3-27905dce3aaa", "comment": "Malware payload (Mirai)", "value": "a47a883f6a8f27f46ebbe4bf330c9eda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954227, "uuid": "83a6b5ca-23c4-4ef1-ae48-b8727ad8fe7d", "comment": "Malware payload (Mirai)", "value": "dd5346a1628eee9a81c70e23494cd4bd7bd93299e2565153880882b58d84fb4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954227, "uuid": "01b3e774-af79-4007-81ee-f734b291f0bf", "comment": "Malware payload (Mirai)", "value": "3fa9178df1905d937d4c68567b19a9dd7f863347", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954227, "uuid": "db87eb9e-b9cb-47da-9409-49837dab599a", "comment": "Malware payload (Mirai)", "value": "859581265174b38960186e226036aba8977dcc410a0d603549413d2295cca6404039b47add377ff2eb9d4f74afd2b7c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954227, "uuid": "058ff8a2-53f2-4849-96f3-767fed1a267a", "value": "T19A632A91BC815B13C6D1227BFB2E428E372A53A8D2EE72179D216F2137C785B0E77611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954227, "uuid": "9acecdb0-1229-4e3b-a20a-5329265b5c06", "value": "1536:d2usQY7G1zIFNiGQEh5eUY62noowZ7ns/hz:d2uC3itEhHL2eU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954227, "uuid": "01d584a7-6351-4fb4-9b0c-a450c1f4f46a", "value": 72156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954227, "uuid": "c3538ca1-054e-4241-95e7-e29cf51b61cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954227, "uuid": "d863b850-f3e0-4313-9c00-427a33f46595", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6d1c8a-90a6-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1785917832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917832, "uuid": "b1fb7303-a0e0-4635-8ca3-65a94874469c", "comment": "Malware payload (PhantomStealer)", "value": "22436af70b5aa9eddedcd0e144bb0fcb", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917832, "uuid": "92824a78-194c-4dce-8dbf-671ba13962ee", "comment": "Malware payload (PhantomStealer)", "value": "ddc027aa383a4248f9c5e4479e9232e22555aff8d1bc760d61bcbfb00b38839d", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917832, "uuid": "eacd7888-8144-4c2b-b81e-b1608b771662", "comment": "Malware payload (PhantomStealer)", "value": "27b5d3ed51a9245c29b4a2eb35e6500fba74d398", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917832, "uuid": "62ff4745-4ebe-4b1c-9761-07e02ce66cf7", "comment": "Malware payload (PhantomStealer)", "value": "da383cb773f1e3456c8221be401647ecc242a5eca26b8eae96a3ad917a1609186efdf33a2699854e453a41f861b9469a", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917832, "uuid": "bbad418b-45c6-4c0a-8c84-f44b8b02135e", "value": "T10A62653BF60CDFF40B2E21D5519B7D0210599BA5B53989EDD8DAC0947F26B008EA78EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917832, "uuid": "a54a6092-02ba-466f-bcac-9673c47726ec", "value": "192:Jiogb7/DlSIN9wkhfckAX0oczynCz6Pe6umUFE336hP5d4P+CXFMPug:Kn/wIzwkhkkg5fPeja336hxiVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917832, "uuid": "5de68a1a-423a-49e8-b32a-09986fe09bf3", "value": 15695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917832, "uuid": "f67f442f-1d8b-42b3-83a3-7903924200c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917832, "uuid": "37d3e740-5928-4627-84f8-ce7427d50f47", "value": "Order_handling_depo_7120.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f166bf-9093-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785909931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909931, "uuid": "5c18f106-9d50-4bfd-bcff-4e4a2751d4db", "comment": "Malware payload (Mirai)", "value": "139dd8fd414850645b4818efc849ade6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909931, "uuid": "a3d92c7c-6ea8-4dfd-ba86-e477a049a462", "comment": "Malware payload (Mirai)", "value": "de705df36fdf3ee15ec3eb2f68cddd908318e362f09c33b36182f622cb663746", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909931, "uuid": "c44cbaee-392a-4fbb-85cc-fdcc8d55ca8c", "comment": "Malware payload (Mirai)", "value": "cfcf6c8c51b415863079e6e90c31bd649c95e706", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909931, "uuid": "b3fef984-ceba-4497-95c9-8a84b508f10f", "comment": "Malware payload (Mirai)", "value": "dbd25f858d0e46da22574f7a8c544697eb6542c55783284f7350a604accc21fc39a55aa777f21fc9f6fdd279159d7975", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909931, "uuid": "17d490bf-7502-442a-8f06-da15848035b3", "value": "T15B4301205EC66F9BC87010B31C7992C37D5EC9F0270B75706025C469B7A679F2A9DFA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909931, "uuid": "e6be0474-850e-4cf1-9ef7-47b68e7e378f", "value": "1536:X4Yr8Djj7DzqhYZm7ztjmE0Y1ns8gDiROsnc1/X2QfP:IjfqgmXBm7IDZRc92Qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785909931, "uuid": "2893bda2-941c-4a84-84eb-f8fdd17dbef5", "value": 59348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785909931, "uuid": "143c0802-d23e-4ca6-bac8-b4762654114d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909931, "uuid": "b8ca34d9-e6d8-4856-adff-a24c06833007", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce1615fc-90ff-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785956377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956377, "uuid": "606e23d1-08cd-48e3-9880-21a395ade1f6", "comment": "Malware payload (Mirai)", "value": "32a0b9b1eddbc4ef5cde37a6340cc465", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956377, "uuid": "3eafb254-940c-4582-99c5-502d7508a029", "comment": "Malware payload (Mirai)", "value": "de7be7d3108c203674c02422bc23d2846259f6a4d9252b2fa1c8d166c7114f6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956377, "uuid": "58e875b5-339e-4e53-97df-70244ed6affd", "comment": "Malware payload (Mirai)", "value": "5be2a75309c4ca2279c0fa0a86b9b2a7ed60a4a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956377, "uuid": "a9ca331b-9f11-4995-97a5-ec0fa1850200", "comment": "Malware payload (Mirai)", "value": "56a45c104f0650b0502e4a72fe51f8e21aa16a5bd74fe40b0b6dae6cb7fac91d9591f4cb8b7f0244ce3424d01e1df1f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956377, "uuid": "09b08d9a-c9f3-4a26-bf73-e812db234786", "value": "T1DDE34A49FA5BC0F0D6C345F1156BABAA9637D9112233F1B2FF563676F8B1302288526C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956377, "uuid": "332eed61-1e0a-4090-a80b-c35093ed545b", "value": "3072:YIEJgNQYhTvQA65uT6ULU6al3T9WIsIf4mn:X4IQmT96VUorD9mD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785956377, "uuid": "51cacdf7-ec7c-47ca-94f9-09fb55d23585", "value": 144764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785956377, "uuid": "ef0f74f6-554e-4a0c-9b7c-2f842e443af7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956377, "uuid": "b80988d5-94bc-4ef8-bfcd-32945614bcce", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84bbe135-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1785917599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917599, "uuid": "d8dd3792-668e-4da1-a832-6638c2977c66", "comment": "Malware payload (AsyncRAT)", "value": "44db4d7149d2c7b5ccf5e385e7677997", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917599, "uuid": "b5f79563-2998-43e0-b0f6-a2515ed82b13", "comment": "Malware payload (AsyncRAT)", "value": "dec54ac5eebdce2ae119e32e529372de59da0db441195fba368b0962dc7be27c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917599, "uuid": "92d0fee3-1eb2-4983-8180-e6456f0fb052", "comment": "Malware payload (AsyncRAT)", "value": "fecbf965bb083d5c16d412935232ecb6163f391a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917599, "uuid": "5478e742-c80e-4d22-bfbc-d21885412b91", "comment": "Malware payload (AsyncRAT)", "value": "51c7680a77015c2b8565d34068a96b34d5f200cfb8a5711ce906b9eadf6a198fb6cddf3d284fbbcd34a9971be59552b8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917599, "uuid": "8b525c9a-4919-4bb7-a6ff-22dbef02bf18", "value": "T135251713B5DF00A94DA1E9214C66E01CFE5ED95B8610C88D2BB4EEC5A9E43181F3AFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917599, "uuid": "b3efe7d5-3954-437d-af58-6b4e7872bf7b", "value": "384:avfL4qnG3XGq7PPOTJXPvPHpDVPfbDMX39gL19VPLPPpvG8CPwhGNS9Gu3QlMax/:/WA3JjL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917599, "uuid": "7aff9e9e-107e-41fb-94bc-c47c6cc7281c", "value": 1056264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917599, "uuid": "96261261-f402-4885-a599-908b3960e35d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917599, "uuid": "160eccc0-8249-49d2-8b79-6bcaf7375646", "value": "Copia de confirmacion de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770ec50c-90cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785934756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934756, "uuid": "683cff08-1797-420d-9783-4e9687363cee", "comment": "Malware payload (Formbook)", "value": "ac52e391eae2012d233df0c8cb151cd0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934756, "uuid": "26fdc479-ee0b-455c-9390-ee07b72be38b", "comment": "Malware payload (Formbook)", "value": "df1756b2e055ceebab8adc64363ba0da8b5eca4b48aefd427e44eacb1ac2bf2c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934756, "uuid": "7e5c6628-9fc4-4d3b-a273-193c4c92a5c6", "comment": "Malware payload (Formbook)", "value": "0d9a2748c88b572a1b2db76538f7f7df3bbb52c6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785934756, "uuid": "5da7e48b-ad6d-48aa-bfca-fd4d15ed77aa", "comment": "Malware payload (Formbook)", "value": "efd2c1556b425e77474d5d1e976da6af3d34b655b9f870082ce44def9abc153fe2be90ba04a068045f0a36344cdc9203", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934756, "uuid": "f60e3e41-62f6-4513-b868-94041ec7291c", "value": "T11D259E2A049B68552094674C9B46D6A20A85BD0F5318DFEBADDC4E73337CEB849F8DF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934756, "uuid": "70e7e583-9067-4567-ad19-6b5b0f841b9d", "value": "12288:DQAs7wPFCgmn5P8JpCCWwZuZuq6NvZVqpIfiNwIrnJ7lrbN+f50sd/4jGOtFwRbj:DS8FA+/XrhwjNwkOPuAi2v3nXlh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785934756, "uuid": "2b3c8c31-169c-42e7-a861-366d60a28dff", "value": 974806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785934756, "uuid": "aa31413d-2078-4256-913c-519ff726d2fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785934756, "uuid": "be648548-5b22-4814-9163-49174d1e1abd", "value": "\u03a0\u039b\u0397\u03a1\u03a9\u039c\u0397_804353.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9508cd76-90a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1785915479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915479, "uuid": "861b5c66-b9b1-4424-b7cf-01afda51919e", "comment": "Malware payload (RustyStealer)", "value": "1159e407b385d9ac8abaa7ae984856fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915479, "uuid": "919b5473-f174-4850-ba47-94bf1e5c9020", "comment": "Malware payload (RustyStealer)", "value": "e059d1519cb1a781c3a22207acd6610564c4b5df5175e1908261455379e9b93a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915479, "uuid": "113ba710-b898-408a-b941-82c15d8d4030", "comment": "Malware payload (RustyStealer)", "value": "d3a736e0d24e32a17ccbdbb2a0c1a37259ec39c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785915479, "uuid": "6507d905-ea45-4b17-b279-e06c32e88ef8", "comment": "Malware payload (RustyStealer)", "value": "344442adc6ea1aaa98fd2b59215b2a5be4eb7e35665591c0b10010a8a8b9aee22527ec1bc0efcce1b3ae9efc28ba2f98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915479, "uuid": "862068b5-d769-4a42-bab2-24e07794ccf9", "value": "T191B56D43E29581ECC09EC0B4C7479736FA32B88D0534B6AF57E49B212EA6F505F1DB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915479, "uuid": "a0959a1d-1cef-4987-86b9-be33912ac6a4", "value": "3ddcfb35a64c53c65a030cfd87d07ecc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915479, "uuid": "05bd4ffa-7553-4af6-9d2f-181728852ede", "value": "49152:0hZPS3LFiq0Z2FX/GQ7puPnbYYbIU6isd:8uEUF+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785915479, "uuid": "2419e3ca-dd73-468e-a77c-c034f611421f", "value": 2437632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785915479, "uuid": "15a4fbb8-3288-4986-b13b-a59596caab65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785915479, "uuid": "2f6dafd3-871e-4199-804d-63c36cbb841f", "value": "1159e407b385d9ac8abaa7ae984856fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6dbecb8-907c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785900154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785900154, "uuid": "b9106d58-8baa-4f4f-80ca-0fc0e5ddaad9", "comment": "Malware payload (Mirai)", "value": "2b2de39726907ebb133bbb630c55536a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785900154, "uuid": "75c79685-45c1-42d1-aaf3-dfb29f028bb3", "comment": "Malware payload (Mirai)", "value": "e0be3f6600d16a77b705cc780dde976839e605c8c44b7205af301f0bab4287ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785900154, "uuid": "47f80c28-2ba4-431f-8fbd-301dd17a69b8", "comment": "Malware payload (Mirai)", "value": "db57a3ab74d95d9aac6c48c910ce15978f5507f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785900154, "uuid": "8c598f2b-fc4c-48e7-99cd-42120beefd17", "comment": "Malware payload (Mirai)", "value": "e342806c76e9fe152ac23931bb1f5eb6ad062fd992dd4fa43eb17230f79ff9c7ecd99d79cc512ff12562797a8aa20ef3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785900154, "uuid": "d6e52a91-4dbe-4134-9edf-cc335c6b068d", "value": "T190C319A9F890DE52C6D526B6FB4E418C33231778C3DE7106CE149E3467FB95A0A3E942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785900154, "uuid": "ba48fb81-be5d-40a9-93f6-c6845565e021", "value": "3072:ZT5VBa0Zv5medpH+mMJ1uIYrcYEEUIvXMWmNwhGolYMqPbN3F+RDuS5mf1Dl:ZVDZniruBrcYEEUIvXMWAwP6MqHmiomf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785900154, "uuid": "3ca95bda-0606-4b02-8872-99a3c89e8468", "value": 128444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785900154, "uuid": "15f833ac-ab49-4ea2-a5b0-6f679716b8c7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785900154, "uuid": "cd6bc9d8-d533-4d0a-be0b-f094670711cf", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cab3fb6-909d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785914015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914015, "uuid": "4f3c805e-10f6-4d42-8df8-f1e11dce1d6e", "comment": "Malware payload (Mirai)", "value": "8009283e4c30a908ef1511bf16c4ac0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914015, "uuid": "e9bee2da-5cbb-442f-a4c3-22e8cb3ae789", "comment": "Malware payload (Mirai)", "value": "e1e9381a98878e25d3c51a325eee549aa217f45bace9c67f03201f347be08d36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914015, "uuid": "0e53df57-851c-490e-8a2d-e2904562656c", "comment": "Malware payload (Mirai)", "value": "115bf099eb11ad1abb12bc34f575c3e75fd69796", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914015, "uuid": "fcd53823-23dd-4344-8b80-4576e7bd3ced", "comment": "Malware payload (Mirai)", "value": "acc7bf91615f451958b4bcb170c8cc19b8aa5953e39b6bdfdf096ea6a5f1003535e477d89f0b581838da077605c73139", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914015, "uuid": "b92b2b4d-1064-44d5-a714-30a6949ed961", "value": "T1B2F30745BD518B16C6D262BBFF4D428C7B2A1768D3EE31039D295F60378B96B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914015, "uuid": "a5636b0f-2696-4bca-ab47-6398614d67d3", "value": "3072:smpaNJnxpejfLmzYqNyB6wvk4JX1DRextqziQ/S:smpaNJnxpejaVwB6wvxJX1teH+iQ/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785914015, "uuid": "6f9977d6-855a-40fd-ac76-46271fc6e38d", "value": 157400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785914015, "uuid": "4ebfa622-faa2-478c-b3f6-4c8379862e6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914015, "uuid": "6dd4a67b-1c5a-44c5-9edb-b30653747008", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b63157-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785917470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917470, "uuid": "b1176ec3-f881-4e88-91aa-bf7c7987c83d", "comment": "Malware payload (RemcosRAT)", "value": "9797174ebbfac957121d2ed5e912d78e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917470, "uuid": "0c37c807-4c97-4379-8ded-aed656648fd9", "comment": "Malware payload (RemcosRAT)", "value": "e23838652c5ee714657cd239c61d112aaa256e302a0c64b077b30ffd32cafe02", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917470, "uuid": "b5c127c0-abbb-4492-bb16-8a6306193ea7", "comment": "Malware payload (RemcosRAT)", "value": "a3ef01c6a708f57bf186040e68d26e0ec3456eaa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917470, "uuid": "4e2f578c-6a9b-40c0-923b-6084da7d1a73", "comment": "Malware payload (RemcosRAT)", "value": "f8aed42f01df794ffab7d00d2fe325c7bfa31eda4568d9b588e462c10dc8f0b434969ae5b3b09a7d5b9a6a4e627640a8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917470, "uuid": "872a076f-64c1-403f-95d9-82a229bd306d", "value": "T1E635C8DF6BF33A4C2408B71A89F9BD9C1842CCA50452A07AAFB417DAC51D7416F8D7A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917470, "uuid": "8d48ba3d-f1c0-41df-a0fe-6604d03a7d2a", "value": "3072:iRDo44Ko8XyzB8aECPOxIZ1hdrfZ4SPjQH:iRU38XydECPOINhP7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917470, "uuid": "de52b3f2-3413-4b98-b023-7d3bb5a21023", "value": 1062755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917470, "uuid": "37fb2cd5-fa04-4ebb-9b0f-6b3af30a0daf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917470, "uuid": "d8404ceb-e915-415e-943b-9d84fd86616b", "value": "REVISED PO-4701006575 New.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78f56cb-9126-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785973170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785973170, "uuid": "6cd244a5-8af7-4861-84b9-4a3faded80da", "comment": "Malware payload (Mirai)", "value": "c9f549be718492984c76db4f36e50381", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785973170, "uuid": "9f6d8270-ac8a-4c5f-892e-db71db571c73", "comment": "Malware payload (Mirai)", "value": "e248d956f20e28773321e81afbe9ee0f53dd5882dc9dd738fb5a7c38e5105aa7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785973170, "uuid": "14d5ba12-ab26-4a90-a960-215ab2d9c9e2", "comment": "Malware payload (Mirai)", "value": "9bc38ae8d96a0612537784be388f54a282921330", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785973170, "uuid": "fc0af053-50e2-44b8-baa5-4d881207c7e0", "comment": "Malware payload (Mirai)", "value": "158c1354fbedbf2483d692c7de03427816032297d95b58492c13e520d210e26d8bb0854a1ec9705341f119043b07fdcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785973170, "uuid": "b9f2904f-aac9-49db-973f-88c64ef3b4f9", "value": "T14D43F1D392869EF5C0E6103AE52CF2EA34694AB8DDF73092C5211CED65FA6034B32D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785973170, "uuid": "f265d4c8-439e-410b-93fb-9c8ad72bdd38", "value": "1536:56u1yyGOzYpRlJEHsTxGy5nQ6itnItffl:5/za4sTm6qKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785973170, "uuid": "767fff02-d2db-4a73-b0d2-4de4e8c72fad", "value": 55924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785973170, "uuid": "e5af7a85-3d32-4441-97e8-15c9b8849c03", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785973170, "uuid": "9a007f22-2326-48fe-b586-50cc953ef87e", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad00181-909c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785913744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913744, "uuid": "8649fe04-095a-4a9c-bee7-42476a63cf17", "comment": "Malware payload (Mirai)", "value": "5e9b364c269e5e63e262ba1498c1dfb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913744, "uuid": "18a0e63c-1c7d-4914-a193-fb6c0579a435", "comment": "Malware payload (Mirai)", "value": "e27ae838a219c644b4d96ef15d1d847804099daab9acbff78d91d529f733f878", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913744, "uuid": "67636efa-6536-4e80-a813-be1db88e36ae", "comment": "Malware payload (Mirai)", "value": "f0cd5428e45c37a665cffb04b05fbe965f637f5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913744, "uuid": "6b5a76fa-a5f6-4c3c-9ff7-9979db259eae", "comment": "Malware payload (Mirai)", "value": "b812aa7a7d408c2f49ad13bdcad18b1c1a71ba35fb4be2ba27d35b99e10445dd445be14590d670b329f6f805d74f296d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913744, "uuid": "1a39b432-0b45-416c-97a8-c1cdebb2c2f1", "value": "T15E042B03771C0A83C15B6EF03AFB27F187ABE95115A66280F21FFE845332AB06559F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913744, "uuid": "26454c09-c594-4c88-ad61-59e7bddbf9fb", "value": "3072:8jQYjLyxQactlYC6UrVO9GtjM5/GKTK6vFBv7oxXkl2CLf5QwD:8/uxQamlYFnSO/FTK6vFBv7oxXkl2CL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785913744, "uuid": "e181c248-2175-41b5-bdea-df4758d42966", "value": 175339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785913744, "uuid": "5dfff03d-a079-480e-9021-4b56247a5a59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913744, "uuid": "00c2982a-a174-4a2c-a2e0-aa84fc8b23ce", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3bdde8a-90a9-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1785919450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785919450, "uuid": "252c4b75-35d8-4cd5-8d56-cb1e57566f71", "comment": "Malware payload (LxBaseRAT)", "value": "df71a78531ba1a044d0fd05c8942b374", "object_relation": "md5", "Tag": [ { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785919450, "uuid": "94624e20-9a4d-4d37-b978-89a64c37b6ed", "comment": "Malware payload (LxBaseRAT)", "value": "e3c952a76387a3a2793ad242f824129fb386bc680c68d06bd0bf3617bcd29b18", "object_relation": "sha256", "Tag": [ { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785919450, "uuid": "f471742b-0397-4b76-9a1d-7e92d75a3188", "comment": "Malware payload (LxBaseRAT)", "value": "f1265fa23e39399a6406e4ada170993f68a08f48", "object_relation": "sha1", "Tag": [ { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785919450, "uuid": "d4e4981c-e268-4244-9dc6-1a255e3566f2", "comment": "Malware payload (LxBaseRAT)", "value": "bba7d8b3d7bf47720e6b8e9b0e882878e2a166f6833c5bb1467e6a72d7d362585519737f83e73e080c33be43bcb50e9f", "object_relation": "sha3-384", "Tag": [ { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785919450, "uuid": "8f36eddd-00e4-4734-81f7-c06597fb73e3", "value": "T1D995B0977CCC298B95BDB859CD6F815A1997AB0405025CCF73FA0849CB7C88A44C6FBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785919450, "uuid": "157d5ad0-5746-499f-9281-36940ee3f6ea", "value": "49152:QsCszxXNdEqRt/EzvAMyo40LVXkjZeBNlzRWe:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785919450, "uuid": "494d9a51-54d6-4436-b6f9-78c03464191d", "value": 1945441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785919450, "uuid": "89343433-e592-481c-943a-3f4da82b8d6e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785919450, "uuid": "b5a167a1-a1d1-46fc-8db2-b7345bf086fb", "value": "ORDEN DE COMPRA_.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53dc98a8-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785917517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917517, "uuid": "c6f415b4-c4e9-4f52-97d0-58b423288fb5", "comment": "Malware payload (XWorm)", "value": "1ece4e5dfa160d1beea84e2bb2f44761", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917517, "uuid": "532087b5-5c87-4dd3-bf6a-8c78448ca671", "comment": "Malware payload (XWorm)", "value": "e4fe1cc359050cba07b28f34b6a567663334468cef7d912e9a9e300fea9e64f3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917517, "uuid": "addae2a8-5181-419c-b09c-4296c2ce7452", "comment": "Malware payload (XWorm)", "value": "3c135d5c2f7e6e819c8b4f364477f25a8cf47eb5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917517, "uuid": "a833785d-87fc-4ff5-850f-cc5fd3f3506a", "comment": "Malware payload (XWorm)", "value": "b32af9306bc1cf96132b1034ea29943850194d3e02192a80bd57f3ebaba5684b50a6efc0521407ac996c3f3d09c75ba9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917517, "uuid": "c3233a02-fc2e-4fbf-a091-c43934ae6dae", "value": "T15D2558324BEB6E51A132257DBC1FD8A4B2C19C97CC6C705EF8B4D8E93385CA81429D79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917517, "uuid": "f97cc17e-1de6-416b-b364-83840a892e16", "value": "384:JHXsRLYCXEMRFRrMRFRFRFEiXCXCXWFIYWrMRHXWFRFRFRFeIYE+W3FWFRLYeE28:Ofq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917517, "uuid": "d0bcd5ff-6232-45a4-a045-0cb901e31bda", "value": 1049236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917517, "uuid": "7a2257b9-af57-40bb-8b0f-723d86d0c0b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917517, "uuid": "2ce52e3c-ea60-47bd-a37b-8051ec0dd759", "value": "05-08- Payments-02.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3725ff7e-9102-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785957412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957412, "uuid": "c00c922b-4ac6-4ce8-965e-28b3b2080f09", "comment": "Malware payload (Mirai)", "value": "4ceaabaec680020124a59811181c1fd4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957412, "uuid": "9237a0c6-4745-4234-9028-eec6c7a0e4d5", "comment": "Malware payload (Mirai)", "value": "e6b0f936dcf68722d1e41a0b2be451fdb77ba0fb95542f7d866fda72f18d64fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957412, "uuid": "3aec7faa-7543-4e94-8a5c-56d0700fd18b", "comment": "Malware payload (Mirai)", "value": "b5d8b0d7b15f1bd7e4f5ef06435ecf41acf050f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785957412, "uuid": "edc6b999-9a44-474b-b523-d8bed2bf4dc9", "comment": "Malware payload (Mirai)", "value": "3cade0c5da990a4480da8b23c50c2ae5103a3b06bb1f3e556a86852de539785fdb5825407101b9164a6d1e95289c70ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957412, "uuid": "0f7d68ec-2724-4d71-b8c0-46fa8336a2f2", "value": "T15843F1B1224D4E44C47A1A7AC42A0191DB5D7E96E30C7D7E7820D2AC76D34AF2FF9643", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957412, "uuid": "3faef91b-ed83-4337-9ed0-0f42f52c67c9", "value": "1536:hufMeudkt+H5/286SxX++g7/HSdiCjfTU:hPd9Z/28b0+gDHSdiCjLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785957412, "uuid": "fd1b7c17-5632-4b7f-acd7-c6546fb561a8", "value": 55788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785957412, "uuid": "ed304311-585d-4d46-a449-f02f25d654be", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785957412, "uuid": "8260ddd0-cb5d-4f1d-ac46-3a1c4f31b220", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd2eaf7-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785917801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917801, "uuid": "5d568074-0696-4714-a847-dc87f33be83b", "comment": "Malware payload", "value": "412e232364f8869903820068c6426186", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917801, "uuid": "724fe925-b106-4e17-b5cd-58ca7d90e15e", "comment": "Malware payload", "value": "e77272d0946b951d9a4711ad6af58cbb8138ae19988475f0a33918e3cbdff1e3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917801, "uuid": "e2fa1ec9-64f6-41af-af13-731d38e724f5", "comment": "Malware payload", "value": "245ad6426caccba9dbe6da704a2a566c456bb400", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917801, "uuid": "f2d069ba-e78d-4c97-a758-75c28d38df7b", "comment": "Malware payload", "value": "ee93bf92950b27b3401bb2c761e4c797fc92829e9f021bdfededb47f949e521d3a847b2de54ed8d32534092743283520", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917801, "uuid": "1f9c0111-bbc9-4d8a-b69d-627c068aa86c", "value": "T19725CEAF95CB4A02812193368A8D8F04A724D79E54199F3F7746B8EF0BE4417E47C8BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917801, "uuid": "29b02b75-d140-4b88-bd85-759e767c6f4b", "value": "768:c0aKpg3fAuTauuKoLCPg3uPPa/DgC+mCaGpp0aUtA/PaT+5K0+AuU30D+5KFTauU:dk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917801, "uuid": "6be1255c-d12c-4a7e-bbcb-24ae4cd9e408", "value": 973621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917801, "uuid": "0169c21e-5bbb-4430-bdcb-606b67d6f332", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917801, "uuid": "cd289a9d-645d-499b-a035-c400e38ece78", "value": "AD32 TRC2600508 - 10107161IMG Teklif Hk.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a536e3-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917633, "uuid": "570e9026-4a82-4853-9eee-5112477bcac3", "comment": "Malware payload (AgentTesla)", "value": "ac76c05c50f9a91774cdbd6c8e723d27", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917633, "uuid": "830618f0-b435-48ff-8121-484ee76bfc55", "comment": "Malware payload (AgentTesla)", "value": "e79f6a350ffe1bd5a2c85b0f97ff966037dc47b1d34f904a831f9e9dd8ebe54e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917633, "uuid": "14a95716-462f-44c4-a7b3-f85df7520906", "comment": "Malware payload (AgentTesla)", "value": "f599d56449e74301b474000197bde3f481bbc899", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917633, "uuid": "16718cb7-57cb-4d78-9dff-c4656e6340cb", "comment": "Malware payload (AgentTesla)", "value": "4affc428be3ad27b2f58a3883886ac3bd9c4966d366ec949919b8b82f26407b6af208db89a287d1ad215ea3e5ef26265", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917633, "uuid": "8b763e25-3887-4164-956c-95f306eb331a", "value": "T1F1252AE3773F269F9408D7D1EC2E41F98323621A7843586EF0BCB4CE68159659239AF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917633, "uuid": "2c281be0-558c-4f4d-9ca0-c6b586b9a7ae", "value": "768:nb2FGx9kIM3g33ckGxphpx8293bc3cYMgcbKk2x9KVKk28c29kQKkKVbcbYGpZp0:gs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917633, "uuid": "8b6c2962-ace8-4f61-953a-0b33f9a41a0b", "value": 1045761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917633, "uuid": "d5add9ce-bdc7-4b19-ae88-39569760ff1f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917633, "uuid": "f07984cd-6eca-488a-bb58-bb7679892215", "value": "orden de compra.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6fe738e-9093-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785909926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909926, "uuid": "04ff3130-1dc8-4841-96cb-3bfc25e6ded8", "comment": "Malware payload (Mirai)", "value": "23799c2390996acbaa97864571d16d4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909926, "uuid": "2d618b74-082f-4da3-9042-73b149cb60f0", "comment": "Malware payload (Mirai)", "value": "e7ead284f1a41d07aa97cbf52fd73a25bb79a9787fa1842202a218d86d414718", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909926, "uuid": "2df9aa48-f101-4b52-af96-43ba7af8c4f5", "comment": "Malware payload (Mirai)", "value": "978bb3cb9bf5d2f2502daf518a791a9f9b09d4ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909926, "uuid": "34b1e4d0-821b-4321-866f-22e782a62f5a", "comment": "Malware payload (Mirai)", "value": "8e3c6d65ec5a1020ce0c4d87e66b7ef281f143aaf18812923ce86841fdf9659836d10833d114c8d4a911869b6ee26d02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909926, "uuid": "405c0a74-ac19-46a8-9a38-69c8354af1bc", "value": "T120C43955F8809F61C6C539B6F64D42AC73074BB9D3EB72069E244B343BDB86B0B3A605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909926, "uuid": "6d66d11c-07b7-4fe0-9f60-9101453ab653", "value": "12288:uODNubWvXynS0XM963+q/33UUI1ls2y8pLZ/S:vwWvXF963xUDzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785909926, "uuid": "054edd42-2990-455e-96ab-95ff20334430", "value": 592156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785909926, "uuid": "8a6afe97-f0f7-4a47-af57-867e1cd4e299", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909926, "uuid": "dbbdc1d4-d221-4a13-9ab9-4f0f8f079ea4", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb66c06-90ce-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785935220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785935220, "uuid": "0d474708-e5e8-4695-8ce8-e3462ac0c8fd", "comment": "Malware payload (Mirai)", "value": "5817be5858e3e4a5cfa49f69a1c6004b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785935220, "uuid": "fd792d27-8215-4d61-a8ee-6575aeb0f19f", "comment": "Malware payload (Mirai)", "value": "e7f5644ab6c3fe20eb4d70cb35e99848480e99cd3ef9fe9275ef1cd68def15ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785935220, "uuid": "e10f5ec3-43f4-4377-ba5f-960f8b6a0903", "comment": "Malware payload (Mirai)", "value": "7b565a8cb7d76aa6d1861622d7cf7f623f6bdec4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785935220, "uuid": "6267cf33-3692-42a2-943e-8bd6a78bb2bf", "comment": "Malware payload (Mirai)", "value": "5b26ffb074c15fe0f88506942dc11ea3b14a91a5252d61c149b61599266994bb13ebd3cc3bab4dbcf616216e80c6d618", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785935220, "uuid": "e9398d40-f329-45f1-be72-88ea4a098a78", "value": "T1A5263943F89191E5C1AED130C666D293BA717C895B3023D32F50BBB92B36BD4AE79314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785935220, "uuid": "d4aee501-89d9-4014-b2fd-7e26c62e60d5", "value": "49152:LJ+ZArb/TdvO90dL3BmAFd4A64nsfJRxqkbvG6mpeggOhXv4uzWkxTg3FJ24pv18:FWrO68A8xiE/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785935220, "uuid": "5ef5b610-153d-4c17-931e-02838cfd7c1f", "value": 4685824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785935220, "uuid": "ef7f80c8-e302-4cde-87d1-facc9211130f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785935220, "uuid": "bc052493-bc7a-4f1a-8452-a3d4c6421912", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd2b843f-90a3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785916888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916888, "uuid": "97028daa-6445-4d23-9574-20f305a1f28e", "comment": "Malware payload", "value": "57a28550e573ae8a4e798466670075f1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916888, "uuid": "5f4bdec7-9099-4822-8c65-730ad06a33ab", "comment": "Malware payload", "value": "e84f09aa895b5927c1292b70a21a86ba0a2faf850dc64ce819b4f73dbd3aa7e2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916888, "uuid": "09e58d51-36f1-44c8-9398-469c4900cc22", "comment": "Malware payload", "value": "bdfbca5852187d8d677faa53ca5af95fc68f741b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916888, "uuid": "1403a638-b6a7-46af-95e4-01f02136c32c", "comment": "Malware payload", "value": "a7017c967e7ec153a367a8e1b738f016b0ee7ce0890580e1adc43d70aa6a28e555eb4e367d7cd8c30ce8cd37dc86fed9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916888, "uuid": "ca14c5fb-cbad-47c9-9940-ef86d6b122b0", "value": "T1DE25849F678FE91991A3362ECC2CD2B14FB140280667678C7D4BFED9062225C5C5FAE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916888, "uuid": "49a2a5bc-268a-4d4d-8bb8-006e916c0a7b", "value": "768:/wRw+RLhhYMY/RxYBqRhw+/UK2/7U226B/YMUNYSUKRU6MwC/LUKRYJ/hLYDX7Y2:/lCB91E1dtmbh3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785916888, "uuid": "5997e17f-1dfe-4099-aa45-1c60d8b9be0a", "value": 1008342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785916888, "uuid": "c674ec6e-af20-4a06-897e-118d020077d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916888, "uuid": "ba86bce9-79d6-4890-a160-2c37c94ce0fc", "value": "Document_2026050007.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850380ba-90a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1785917170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917170, "uuid": "34d7042a-4c07-426e-adbf-4379700fa93a", "comment": "Malware payload (PhantomStealer)", "value": "d98c59b734f1f8c21ece429bfd8c252e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917170, "uuid": "98d7d29f-d74f-4608-8f0b-b0b708312c33", "comment": "Malware payload (PhantomStealer)", "value": "e8e12547b133a5a056170a5ecdbc3d9b4db273ca92091ef3052ad0b911d00b33", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917170, "uuid": "ba1e8298-83ca-4e91-ba60-bdb7c003f82d", "comment": "Malware payload (PhantomStealer)", "value": "3ac8ccb54fe0cda9e9a77e0532f614a06254277d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917170, "uuid": "160af4a4-b23a-4b32-bfe5-db7974218def", "comment": "Malware payload (PhantomStealer)", "value": "495c1f76ed62691f9ada30d20befb63f7435776d1ec28d499c6f726109a07368b756290380d4b1e2affe5821a9e52162", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917170, "uuid": "10ef6f3c-eb38-4eeb-8a49-d31ccad80c18", "value": "T1F966D9E763EE34091A28376D980D69048F6AD4505EC3B6D8B4EF0EC8574EDA772E047B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917170, "uuid": "e1dc03f1-869c-4ad0-a6da-7b3e67b8fd69", "value": "24576:Vk+bmjl36q7tTlgJraxRuFLza403V4UFzMmbi95FW6KPEbfMGl5WGFzaT/dQDPRS:i+bmjl36qZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917170, "uuid": "0685733c-fc3a-4bf1-bef3-a72cd5f51178", "value": 6819698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917170, "uuid": "97d18dca-aa17-4b61-b68e-9ea6878a682b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917170, "uuid": "ae0138cc-af2b-4c31-85fd-a413455c7806", "value": "SWIFT Mesaji - 2179GKGD26002283.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ff29d1-90fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785954169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954169, "uuid": "b0f45fc0-49ce-490b-ab45-669d74ab60e7", "comment": "Malware payload (Mirai)", "value": "4ec8ee2416da99f1b7f2749076fa36e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954169, "uuid": "640583a7-8260-4a80-8682-441d8a354aa1", "comment": "Malware payload (Mirai)", "value": "e93d9124f1ee937ee3b14af95c3e345f724f3fc4cb12e95355072185e931a3e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954169, "uuid": "fb7be376-d60b-4b45-a145-a33805cd2b16", "comment": "Malware payload (Mirai)", "value": "cc59aa183a9719ef2963c0bdd731bb7b23f091c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954169, "uuid": "31f0da15-5c12-4a92-950e-93d803d9582f", "comment": "Malware payload (Mirai)", "value": "41b70eabce98f8dc4a500ad038937691472e2fe533668f7f63bd3df74d54ad51ca85df42307e159b9c7e37293be2b29a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954169, "uuid": "e212b0a0-1d0d-4231-8e49-de2cc0ba35fd", "value": "T18603F231902319739794CE3EFD3D8FE32F7B6F7A809E54A52369D1584AC648109F9886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954169, "uuid": "62ff1d01-ecf9-4fce-a35d-748a347f85df", "value": "768:HtGPdEGQdi3BWUEA6bVvhGJfgY6qZ3GuJ8g4lHa9q3UELUFD:NK+GQduBPkVvhc5YoovLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954169, "uuid": "8b488911-75c9-415e-8a30-e6d61174b0fe", "value": 38148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954169, "uuid": "8f715551-3475-459a-a1a8-a7beb0e2afa9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954169, "uuid": "5517bcc0-2529-45a3-998d-0b800354d878", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d37f5d6-9099-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785912379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912379, "uuid": "c77ac436-ccc9-4930-9d0d-625f21fbeb85", "comment": "Malware payload (Mirai)", "value": "0cd27a16d84e1ae3c304e2cc0729acb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912379, "uuid": "e606b6a2-df4c-4e2e-acfb-4c6f3ef2d3ca", "comment": "Malware payload (Mirai)", "value": "e962f0eaac1f06fe1e4201f8100c3b5d1419648e957a94ba863e6043d2e45538", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912379, "uuid": "98e6ab67-db1c-4fa5-82a6-835efc9cfe57", "comment": "Malware payload (Mirai)", "value": "d3bd1d6d89dbf594874e20ce9a2fd7674c4e5292", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912379, "uuid": "f54da7e6-117f-4970-947d-2cd50404f18b", "comment": "Malware payload (Mirai)", "value": "fd0878c910bf8c2ff2c7b362e1a0cbd466bf4250f2b731287b531ef04f6be24845ffd4ecf38701bd2e9647762f5dc460", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912379, "uuid": "c2a47ad0-44e3-4eac-a126-c2a9cfe2152d", "value": "T126043B5F7720DF61D728CA3005B38B5656E926622AD28989F35CDE083E74349B82FFD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912379, "uuid": "6950473e-213a-4ebd-8c50-f03b49efaae3", "value": "3072:msEpj2AuVVw6jQOz6OYgXCD3q6iKoK1DijqS+:md8w6UO2ou3tDowUqS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785912379, "uuid": "be2e6255-37fb-4ae1-a65e-b880620f79fd", "value": 185004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785912379, "uuid": "b081c2e6-faa8-4501-a7c6-ac47782eae72", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912379, "uuid": "8cddfca1-d85b-407f-bf5e-1583e11f8d9c", "value": "putita.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a143d0eb-90fb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785954584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954584, "uuid": "11dffa8e-fbe9-409c-b6df-c43ea3b8c5d6", "comment": "Malware payload", "value": "78047c1c812dd6b454e0224d1f7b5ded", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954584, "uuid": "890c6d28-2be2-4605-9455-b239fd30bdba", "comment": "Malware payload", "value": "e983e5508ea7797c621040b30c7a0b454fdb2ae93f474f3e2bd00df6c0b56048", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954584, "uuid": "77d82b7e-de5d-4fca-8089-d928f4880c23", "comment": "Malware payload", "value": "992257fd9625e7eb8d374bc184a8c3fa067859d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954584, "uuid": "3b2d0a21-7baf-48fe-87ff-2655c25f2556", "comment": "Malware payload", "value": "a44d293c4af4d45f6075772e6d3237e4df25608be812ff8f60db50e325cf8e5a77bbb02baa5be8aa85cd665dfc51b36c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954584, "uuid": "c2d9a02a-940d-4c11-b3ff-23a6d2a26889", "value": "T1F367CF7791067CE9E9A94DB4841015816D787C874B78A3C7BAC8B1FA66FB2D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954584, "uuid": "7a925eee-d48f-4b9a-9aeb-9b8baa3f15d9", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQM:cqYUQuVDt0TZEAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954584, "uuid": "bd5c82c5-935d-4fac-9cc2-dac79760b587", "value": 30048256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954584, "uuid": "4cf61b80-8976-4243-b041-d436f44584ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954584, "uuid": "3059483d-c456-480a-b16d-31dae4ec9ae1", "value": "e983e5508ea7797c621040b30c7a0b454fdb2ae93f474f3e2bd00df6c0b56048", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b81cf0a-907b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785899357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785899357, "uuid": "6ab2eb2b-5dca-45be-9590-4066decd31bf", "comment": "Malware payload", "value": "b26ebec73708719f7b4de88beda7538c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785899357, "uuid": "46f52ae2-91c0-4b66-8128-4510698d7ccd", "comment": "Malware payload", "value": "e9e1ff9629e53ed07c4cb758a310d894d88c049f497bd189a058a85c8bff2a61", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785899357, "uuid": "f07c0f40-ded3-4372-ab5f-e662cffbf09d", "comment": "Malware payload", "value": "1603351affedee2afaa42fae3b5fa83d282bf32c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785899357, "uuid": "0976117c-a07c-4270-8d75-baa5918202e0", "comment": "Malware payload", "value": "4335874fa4d17a3268270b225054b76fcc8088749bacc4c7e72e16bb284b302a89d16103eea1d0a8d58694d793ee53b6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785899357, "uuid": "98be012b-31c8-49c9-8eb8-3f03307e9af8", "value": "T12DF09EE5955284323F3D4A36F7041895F642181714E16689714DD9315E3C9786265F33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785899357, "uuid": "2adff8c9-2819-4454-afd4-d3b5638ca91b", "value": "12:Am6MJGvFHV7KCkpQm9jWT9jWg5jWJFFl7j6NiCYRNaNN7sfYOfqd0Y1IYTv:AmlJGi8m9jWT9jWg5jWJFr7je7YRsvYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785899357, "uuid": "26ae3444-086e-4e0e-b2e6-128ac283a671", "value": 629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785899357, "uuid": "6f7e86eb-e84c-4108-8456-218c6767a953", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785899357, "uuid": "1f41b978-f20d-4b8f-a66d-b88e6647658c", "value": "sensi_totolink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb3df531-90fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785954225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954225, "uuid": "609542a6-3fa3-431d-bea2-63a246e831d5", "comment": "Malware payload (Mirai)", "value": "26ca630cc6d2e361344d74cf7d3f13ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954225, "uuid": "d1714095-7806-4460-9a20-53f63eaa6403", "comment": "Malware payload (Mirai)", "value": "ea6654be4dd928a36fa8f32deabff881a35ea5bb7375561ffb973a78509d07c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954225, "uuid": "e1c05540-af8d-4ee9-812f-9de94becf1f1", "comment": "Malware payload (Mirai)", "value": "819e4543006e7eb51cfc1a41741bafff1765e223", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954225, "uuid": "5104eafc-4d43-441a-a895-b941a182d943", "comment": "Malware payload (Mirai)", "value": "d70d20285d1dbfd79f3dfd13b62388268d6acf7bf214c75bf60287fa869516ca00faeec37c216aff35ac95fa40490a32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954225, "uuid": "b2592d42-3492-43e8-9736-899119910549", "value": "T17E830856B8814B12D5D512BEFA1E118E3323177CE3DE73129E206F20778B96B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954225, "uuid": "2a3d2b96-f9d0-4d45-85f7-edcb1e4981cd", "value": "1536:OjniCdB6iAA674RX+ZlI959EaO9vVQnMTioSpfsnZcO7Se54YSs/hG:eP6iXF+Zm959EaOqpfsnZcOWe+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954225, "uuid": "3df7e74b-8d6b-4ef5-88f3-80ed597711ca", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954225, "uuid": "e6081e97-84c9-47dd-a82b-ad1cfabc6b49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954225, "uuid": "00581295-db0d-4f86-b844-2adb497a49cf", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72fa923-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785917791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917791, "uuid": "9105e657-4587-4ef9-a9bc-016c691413cd", "comment": "Malware payload (XWorm)", "value": "06f8fa00d40da2ad3293e75bb7b95dc9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917791, "uuid": "60514514-f643-4197-a8b5-76a46efc0e20", "comment": "Malware payload (XWorm)", "value": "ebb88aaf2b34d4a18ee48a53c34673008742408d4f37c82f798e53d5160a6959", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917791, "uuid": "ba10959e-a5a0-4564-a5a1-d76724db2054", "comment": "Malware payload (XWorm)", "value": "9edb2976788945e8f69963e1bfb5ae1cf92325c3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917791, "uuid": "790adacd-5a98-4943-ba79-a35325dde782", "comment": "Malware payload (XWorm)", "value": "7cfbad2fcb32331c9316d7d4ad33ea5d6597056a30441ea59b4c068a9f3eb72d52658241e1e5bb3c08c7e35891b1003b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917791, "uuid": "4581206b-89c8-4040-bc93-9891a0a5330c", "value": "T16A253EC1298247988F944C27DE4A6EAC8211093BDDA6363D3FB96CDC31C656FC625B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917791, "uuid": "4a220340-4765-4a16-b2ed-f52e5c13dba3", "value": "192:yU1X4osItribJtJMOp56H/PkD5pid++PADwa8NZQQPH0X7Z14EaW:yUnsIJ0JtJMK56fPkDzid+5idv0JaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917791, "uuid": "63f70c41-7e9c-41bd-b6d8-f62864bae891", "value": 969811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917791, "uuid": "46b591b5-fadb-416d-a6e1-0cd72200d86c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917791, "uuid": "a2e1e45c-470e-470e-82e6-d3c64b475bfc", "value": "ORDEN DE COMPRA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95bacf16-909c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785913762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913762, "uuid": "f489b3b0-a2d6-45aa-bb87-cf3e2d77d359", "comment": "Malware payload (Mirai)", "value": "9c838f6903c3d82db03a66cfb51b79d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913762, "uuid": "df0b7e4d-d0a6-4448-a971-269f1f9dfd9c", "comment": "Malware payload (Mirai)", "value": "ed1f9871a428a3dfd358e7a9a0fb70feb27999da5311558f0dd51356253265db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913762, "uuid": "31978e6d-6320-4d83-ad35-871f4138f100", "comment": "Malware payload (Mirai)", "value": "e6d3fa4a331002f42b5150a66b1a1c105eb3451c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913762, "uuid": "99882972-5109-47e0-8355-ec643dc39275", "comment": "Malware payload (Mirai)", "value": "8330b182cd613b3c6ede631d3c98c968020facd372c15c20843b19d65417e3e6eb8f0de58569e5d9a5299f356811bb56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913762, "uuid": "88af216d-b1f6-4bef-99e9-c2a7c8fe5ead", "value": "T12963081AB9918F19D5C1167AFE1E934D33132B78E3DE7213DE146B253B8F52B0E2A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913762, "uuid": "43826702-b947-412f-8586-cbcedc610099", "value": "1536:3inUaqB9Wr5r7pShIK98DdtwyL6qYoTALuirPfRJMdEjK:5MrBFDvwyL6qs7PfRJMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785913762, "uuid": "5a1eb45f-57bf-42cd-ad61-ce4de3cae8e2", "value": 72472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785913762, "uuid": "5976adbc-8911-4051-8ef6-365f0e2b26e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913762, "uuid": "ea123d50-0de9-4ce6-8d09-5f51bb7e56f6", "value": "CRM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a38144e-910d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785962115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785962115, "uuid": "2ad65f71-37ed-4c4e-926c-2da657691db2", "comment": "Malware payload", "value": "ce643c8ff7f688a91f69f150ff8a8c9f", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785962115, "uuid": "6d8ea0af-1e34-4660-b243-631e4631698c", "comment": "Malware payload", "value": "ed23e0d5d55c12998aea2e4d065726301cb02257f4c9435758368fb94c7881c9", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785962115, "uuid": "a39e1884-1d4b-4e4a-ac68-8bc0055e5e89", "comment": "Malware payload", "value": "ec3f15706a546a1431fd2dde042f9cc562722382", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785962115, "uuid": "be1adeac-da84-49e4-8163-b96da2dbcef7", "comment": "Malware payload", "value": "37768ef94a8fbbaa5f79285c101789d538e7aa343b9667b9b4f964eb65a116a6981fb281b06fb7f495e41c1ab1b14f15", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785962115, "uuid": "1785f1d8-f68a-41f2-952c-3ff63199f860", "value": "T111144B5BD4D540EDEC1AC638899AE237A4B2FC5A1936BA4F2BA0DF151B50B30B71DF04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785962115, "uuid": "7c986045-f958-4ef4-b878-e3677f70385a", "value": "d1c35276ff2b8e9d448afb940bccb1f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785962115, "uuid": "a09fd017-f898-40c2-894c-20a3b897ca39", "value": "3072:GcktfAkaT19iAPkAMf89JFqTvurOX/yrfjqbplmYhle5x73k7g9/c:lD5M09JFqTma/y7ub3e5Nkg9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785962115, "uuid": "46479f6b-49d7-4c37-abf3-6b559b112f91", "value": 191488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785962115, "uuid": "5d314a3c-d717-43fe-9ccd-8e273a095963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785962115, "uuid": "0bcd1a07-7ce1-4912-b9af-4c4126d4dbef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b60d343-9089-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785905504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905504, "uuid": "d5a8709a-5cb5-408e-ab74-271b15614b39", "comment": "Malware payload (Phorpiex)", "value": "ba46eff125dcddcb991cee678f2b7c2f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905504, "uuid": "2fae7ee7-699d-4e8d-9190-898a94ba7493", "comment": "Malware payload (Phorpiex)", "value": "ed2f3110a5df028f68ec43305bded919097797dd17b7e11f78f3d3f93ce89e00", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905504, "uuid": "204634e3-8156-4702-8e72-ee184d17a931", "comment": "Malware payload (Phorpiex)", "value": "66827ae7fd5352da85e334578daf8755137c89c2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905504, "uuid": "21065c47-f300-4bd5-8f07-2d294b3827d5", "comment": "Malware payload (Phorpiex)", "value": "ce6e2168c27609ec2c75297f5217be32d5181d1e9f2387c59ad3ff10120c9f986ae5553adc636d528f77d35d210958d1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905504, "uuid": "186f022f-070a-4657-b9ec-3e7bf64eb80b", "value": "T1FD824B0FB9414326D0E11070A276467BDA79A8B637C414DBF7E48AED0A6C6D1FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905504, "uuid": "1d9dc417-0483-4e86-ad28-61ebeef917f6", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905504, "uuid": "069fcd2c-c27c-422a-ac72-fd653aff210d", "value": "384:bk6I8vVaF6OeYUQQlmLu94gXgc4lmxav8U9cjl:bkPvUQQt9K8a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785905504, "uuid": "2c77ffe0-8897-4133-a8ef-25060045a81e", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785905504, "uuid": "e48fe027-4966-4030-8d0c-f3a9eb9fdb9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905504, "uuid": "e96c0787-f27a-4a79-a36c-9978a3b1eb91", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2535438-9093-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785909972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909972, "uuid": "bb0f6e7c-f81b-4417-96a3-f3247f5209ad", "comment": "Malware payload (Mirai)", "value": "49d93199748a9841819f9b1646a28852", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909972, "uuid": "1b32247b-6b89-4fe7-977c-aefa71c41baf", "comment": "Malware payload (Mirai)", "value": "ee3124b52caf4d114bd913bffba3d912499f102a7a4ad48dcfadf5a1e2fcf18b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909972, "uuid": "677780d8-9e58-4811-a946-9acdbe531e36", "comment": "Malware payload (Mirai)", "value": "00e27929590e446b9e07e34a4dfe19c4ff41af54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785909972, "uuid": "e81fa785-0e33-491b-bef8-1c5b1be0cc1d", "comment": "Malware payload (Mirai)", "value": "97f759053e066c004be50b29f849ae387f1024a9dd63d63f07e0355f1050f799618c30b70d1c4075d6ad1525a73cb4e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909972, "uuid": "8bc1ca99-5424-42ad-b2d2-10547dfe2f57", "value": "T15E044B49BE642BE7C05FCE70052E930B11DD944FA2F6B77DA678CD4C39AA24819F3894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909972, "uuid": "80778a4a-0758-47b2-8570-7bb5a94ee066", "value": "3072:rNq3wAv7TdGkIXPR8+SGVLQlXFTFh83nuJvOX5GBhH5fU1DQQ:rc3wQ7hGkIX58+SGVLQlXFTFhTJvOX51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785909972, "uuid": "6a4cf265-3c75-4c6d-b279-013f0671bd59", "value": 185036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785909972, "uuid": "6750b476-b985-49bb-a973-d5bedff7f465", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785909972, "uuid": "bdb5e835-20fc-4bef-a23c-b15a996d446e", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d84f67b6-90e3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785944368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785944368, "uuid": "295a5bb3-f96a-4026-9ab9-b1dbb0c53314", "comment": "Malware payload", "value": "5e23b5ac24ce24866ac50d70f0fc4a80", "object_relation": "md5", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785944368, "uuid": "c35dd813-770f-4e17-996a-eee1c743cefb", "comment": "Malware payload", "value": "effe9a34b0d6663e9ca76d54047073d70f419b99379314d466e61909dcec3b14", "object_relation": "sha256", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785944368, "uuid": "9104aff3-4b42-43c0-ae83-0c638a27b7d2", "comment": "Malware payload", "value": "0b1edcd4fd88b6b104bb23244f452ff15b463d2d", "object_relation": "sha1", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785944368, "uuid": "c69dcaca-5743-498a-8fcb-b29c66c16bc7", "comment": "Malware payload", "value": "a4f2ea4b42ca5a6fc99eeff426b03fc6b72d71242b5ffd4a4045a3e624326dfca38c96121d525b81bbc096bf14cfd829", "object_relation": "sha3-384", "Tag": [ { "name": "2f719eee4e212aa5bc8ebe9ac849895d", "colour": "#EC656D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785944368, "uuid": "8e1f7010-6023-4cea-97d8-7c7027bbce66", "value": "T171E5239CBCD23EB5E032C7B757A725AEB22A379046B44C8E35D927105C235186CB736D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785944368, "uuid": "4bd51911-44f5-4442-aca6-23356ce9c8e4", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785944368, "uuid": "4a5ba12b-daa0-4bc9-bb49-9b4a0ef3e5e8", "value": "49152:bVtagah3BvXbDD8NYS0TgmQvDuA+vZjvpzeyrkURnUk6apR60F7:JwbvMY5jQLuA+vZjhzey4GUkLR6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785944368, "uuid": "656a9335-4f43-4324-aa7e-74b8f4e00a70", "value": 3022336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785944368, "uuid": "39e539f1-77b9-4b9c-b0f7-eb4d6b98eab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785944368, "uuid": "919eaab0-6387-469f-a80a-2ae1f5a03a24", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f32b07a-9098-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785911926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785911926, "uuid": "04b4b175-8672-46fe-890a-014953c30cab", "comment": "Malware payload (Mirai)", "value": "800d5aaa827412a368ab3356e3611252", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785911926, "uuid": "67e2474f-e029-4183-9936-99314d748965", "comment": "Malware payload (Mirai)", "value": "f00a77f0f42e72d61b20c2fb0b21ccab012f2dc76f5b8241e84a1c6fcfe378e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785911926, "uuid": "de3a9d73-ed47-41dc-9828-5c62291517cf", "comment": "Malware payload (Mirai)", "value": "15d3d2cb4a63e21d2946a3fcad0ea9bc2d10db93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785911926, "uuid": "467d2318-fbde-4f02-b5c8-59b244ba26d7", "comment": "Malware payload (Mirai)", "value": "ce6ece845b0b8e53ef657aa9f2b9b228c7d1bf426f71a317e8526a803bee92c0a3a406f913425d7f21decb6e1172cf80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785911926, "uuid": "4e6fe7c6-762c-475c-b1c1-e1c9899b2d69", "value": "T1F1832A82FCD0ED67C5C92776BA5E019D333263F8D2DA3203CD148E1567CE59C4A3AA4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785911926, "uuid": "6426b746-79e7-4733-9d41-9a209eb350d0", "value": "1536:HG8hhV4pdHUfyUiF5jCzamzFjPS53rhYFiykfp7w3mqq2/Aik6rHhbtGX:HGwG/HUfbkoZzxS57edkR7w3m0Fk67w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785911926, "uuid": "3a9540fa-a5aa-4126-935e-123afcd672ed", "value": 87544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785911926, "uuid": "c0794e6b-9439-4d01-9300-7349b3666b7c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785911926, "uuid": "cecc180b-26c1-4f21-bc3b-984e8f7df2e7", "value": "xd.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b03eaf-9078-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785898349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785898349, "uuid": "ddac22ae-0379-46a5-b0f3-f122bf33c257", "comment": "Malware payload (Efimer)", "value": "6c7970a95086dc63e2c9262e7c195eff", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785898349, "uuid": "7ff2f61e-9d53-4713-b7ae-8b4ae593de03", "comment": "Malware payload (Efimer)", "value": "f0a9123f4a672c76a6c61a47b8ef4d991b398526c0b072f909ccc2630e0eb2de", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785898349, "uuid": "292e3371-a3c1-437f-8234-af56b5b5c3ac", "comment": "Malware payload (Efimer)", "value": "f6739b4ad55b2377afa8a6299e81a94a03bfa71f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785898349, "uuid": "2c5fa73c-3d0f-4e5b-a070-159b5dffde5b", "comment": "Malware payload (Efimer)", "value": "f0528b00cb954df4ecb16ef1e3c8de5660f5b518ce3275bb9080a01737211bf9bbe1afb4523df4901deede48dfa6ed8e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785898349, "uuid": "53719c3b-d90b-430e-b2c6-375cc3daf9b5", "value": "T113E6334869D423EEDAF3857C8DC208AAE179B4764732CAEB1BB867971D531E08D3D701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785898349, "uuid": "7f6a87f1-5d98-4e4d-a331-a5e3ffbf14d8", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785898349, "uuid": "8e1b58d8-5ae3-4d21-886c-ce52e0034020", "value": "393216:cGmnP3gEQTMzhP56AXMCHWUjfcuI3/PGTAI:cGNEQTMNPdXMb80H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785898349, "uuid": "ca9c77a2-c0c6-42d6-b257-5e84316f8f5f", "value": 14305513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785898349, "uuid": "ca749507-3908-412d-b3bf-734031aaa890", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785898349, "uuid": "0bbd5c57-36ba-4452-9a55-8afee4144bfe", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8475e7a6-90fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785954106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954106, "uuid": "a46044fc-122b-4e4c-83e9-d1e6ea828c4b", "comment": "Malware payload (Mirai)", "value": "7dc26ed6938f392bb4b3adccbdb07864", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954106, "uuid": "3dd7384a-3ab9-4b2c-9ffb-a458d0de5a6f", "comment": "Malware payload (Mirai)", "value": "f0d265e9acaee2392108e850fd6002dfab10df02d95037d7bcc8c5ca8d3a5575", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954106, "uuid": "5a4d7fdc-9c76-4017-8d87-ae06b783abf8", "comment": "Malware payload (Mirai)", "value": "b008fe90477944d70aec8b0694dc821b4814954c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954106, "uuid": "c77d24d2-9e89-4205-9229-a76e732b093d", "comment": "Malware payload (Mirai)", "value": "ed18a54c543b44186277a78c6c5c44c16b4b9102216e533431a4b9a91df0d1662350d47ddedd8b0c836066e671ce5a14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954106, "uuid": "11383dc8-87fd-4397-ae55-df7b66e12180", "value": "T11CF32B46E7418A13C0D2177ABADF424533239B64D3DB33069928BFB43F8679E4E67606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954106, "uuid": "b1ccdad3-d1c8-4aa8-80e4-e7d1135e924e", "value": "3072:D2lRz0/VCaaQ5QSyQNDE0k2Rv6VpuQbCexM/9DT80:D2lmNCaaQ5QSymEaRiVcQbCEM/9DT80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954106, "uuid": "339aa205-161d-4445-8785-e54c68e4c598", "value": 158563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954106, "uuid": "7bccd2c5-02b3-4ab6-9f2a-69c070d8cac3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954106, "uuid": "18613af2-5ca1-47ee-bee3-b4b66fea9356", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd4064b6-9088-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785905265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905265, "uuid": "83c84a06-2040-47fc-809f-94243d2d9f8a", "comment": "Malware payload", "value": "b3906380724d0f7875dd83877364ae8d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905265, "uuid": "9dea14ca-df4e-403a-8fd6-30a5ee049ff7", "comment": "Malware payload", "value": "f191322c500ca93fed2b360329bd053310f464d5b13ee94bb05a4839daf94276", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905265, "uuid": "e0daf634-c521-4ee3-8296-03149e497a92", "comment": "Malware payload", "value": "30bd01aab0fa0354d08c0874dad9ae02778ce28a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785905265, "uuid": "0276f2fc-911a-4399-8e9f-4967f4953bc4", "comment": "Malware payload", "value": "080175022deccc5db3a5d0667233192c77fe340f00542c316bb22632dd5918c37896a2f630648015775d5800c09238a4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905265, "uuid": "2bf2ecdf-a26a-478f-9a2b-e94d07e373fd", "value": "T13F3533A58EA98E0730A6C63BD84ED95F6F625B136319260C56C46BC8FBC1630FDB3113", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905265, "uuid": "f1fead4c-0853-4959-ae66-0cd281116cd0", "value": "24576:d/Q5NHnLM/ntGK19zhThXgnhLPG4+FsNWXsGOvpI:5QfHngfEKXhy5tX4XmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785905265, "uuid": "e9f45402-05b4-4234-bed1-29ae208ca543", "value": 1110838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785905265, "uuid": "3bc3484b-55fe-44a9-8c5f-70fe18c75393", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785905265, "uuid": "500f2182-ed80-447c-86f2-5b242601fafd", "value": "requerimiento_preventivo.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1403fff6-90fe-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785955635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785955635, "uuid": "f3003546-9c71-4c9f-a575-c7b7bf41316b", "comment": "Malware payload", "value": "543099f3fb9f71758cef6282b096d074", "object_relation": "md5", "Tag": [ { "name": "FakeTrainer", "colour": "#AE8EF7", "exportable": true, "hide_tag": false }, { "name": "flingtrainer", "colour": "#7604F7", "exportable": true, "hide_tag": false }, { "name": "lolbin", "colour": "#0F95E7", "exportable": true, "hide_tag": false }, { "name": "MOTW-bypass", "colour": "#885D08", "exportable": true, "hide_tag": false }, { "name": "pingtrack.click", "colour": "#2151EE", "exportable": true, "hide_tag": false }, { "name": "PPI", "colour": "#61FB16", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785955635, "uuid": "385f3b74-50ab-4eb0-aa34-73c2652c5c5a", "comment": "Malware payload", "value": "f192d93e7a185acc5ae5968434de7adbe0ea8dcd6dd1a98b5fb3264e90e3ab65", "object_relation": "sha256", "Tag": [ { "name": "FakeTrainer", "colour": "#AE8EF7", "exportable": true, "hide_tag": false }, { "name": "flingtrainer", "colour": "#7604F7", "exportable": true, "hide_tag": false }, { "name": "lolbin", "colour": "#0F95E7", "exportable": true, "hide_tag": false }, { "name": "MOTW-bypass", "colour": "#885D08", "exportable": true, "hide_tag": false }, { "name": "pingtrack.click", "colour": "#2151EE", "exportable": true, "hide_tag": false }, { "name": "PPI", "colour": "#61FB16", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785955635, "uuid": "bd7e758a-89f2-42fd-af03-0cd3633b92a4", "comment": "Malware payload", "value": "18f0683236478de32232463e08027293f83ab497", "object_relation": "sha1", "Tag": [ { "name": "FakeTrainer", "colour": "#AE8EF7", "exportable": true, "hide_tag": false }, { "name": "flingtrainer", "colour": "#7604F7", "exportable": true, "hide_tag": false }, { "name": "lolbin", "colour": "#0F95E7", "exportable": true, "hide_tag": false }, { "name": "MOTW-bypass", "colour": "#885D08", "exportable": true, "hide_tag": false }, { "name": "pingtrack.click", "colour": "#2151EE", "exportable": true, "hide_tag": false }, { "name": "PPI", "colour": "#61FB16", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785955635, "uuid": "1dca5695-92af-4902-bd11-6a05085373ae", "comment": "Malware payload", "value": "ba971a517056b71a80f2fa3ea9b2c0f4df9d39c2c2bb9fb3c876f361fdbe99bae97331bb1cbc29a66897b02a98af248d", "object_relation": "sha3-384", "Tag": [ { "name": "FakeTrainer", "colour": "#AE8EF7", "exportable": true, "hide_tag": false }, { "name": "flingtrainer", "colour": "#7604F7", "exportable": true, "hide_tag": false }, { "name": "lolbin", "colour": "#0F95E7", "exportable": true, "hide_tag": false }, { "name": "MOTW-bypass", "colour": "#885D08", "exportable": true, "hide_tag": false }, { "name": "pingtrack.click", "colour": "#2151EE", "exportable": true, "hide_tag": false }, { "name": "PPI", "colour": "#61FB16", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785955635, "uuid": "a4a26771-2ed0-43ff-998c-4356b8198904", "value": "T1ECB6F17A0790437AF3D847C4885B345E36F4F556BAA53059A73369EFBC2A9CB8038643", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785955635, "uuid": "becc0623-736d-460b-812e-2ed83f8eb010", "value": "6144:FXMQLeZnqZ89Z89ZOXubXvUv0x/Iv5lIOmODuuo4mnpKD83joav0JzytDBq0x5+q:FIgbXvUdlIU2Q83jojJzytDc0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785955635, "uuid": "5041526b-b7fe-4a7a-8c26-9cf5874b3748", "value": 10682761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785955635, "uuid": "d365f29d-10bf-4a31-8d09-fb42cd4b9984", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785955635, "uuid": "448abab0-5914-4f76-90c1-2a2838731a40", "value": "stage2_decrypted.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad25e30d-9109-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785960617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785960617, "uuid": "cdd13949-e8c3-41a0-b449-a13428362dbc", "comment": "Malware payload (Mirai)", "value": "b19697106f1956f952ccb0b202f4f357", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785960617, "uuid": "3fa38609-fdfe-4d9e-a0a3-0858b4890add", "comment": "Malware payload (Mirai)", "value": "f3b6e9ff3bb913d481943f6eb5a664f07fdb182f90a94ba06b787800aab34cc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785960617, "uuid": "aca045f0-3e1a-4e7a-a90a-b66f28981f96", "comment": "Malware payload (Mirai)", "value": "473be4c4585a02413bf0d16e3b25f5c71527370a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785960617, "uuid": "87886bc7-00ee-406f-915b-c9b3ddaaebe0", "comment": "Malware payload (Mirai)", "value": "aba2e7a01354d6f5fdee462744a983161c3a15dc2bd68445bc28f9d2611b3a8861d3921ccd932a1a141d1091e2bde842", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785960617, "uuid": "db469785-6ca4-4a1b-8dcc-15b6caa0ecda", "value": "T112B3F959F890CA52C6C52679FB4E428D33631BB4D3D93102CE24AE3577FA99A4B3B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785960617, "uuid": "c406e4c9-a0cc-495b-bc60-e8615d9b0a34", "value": "3072:f4hxpndqmM+wiwpPud+DE44a46VSJ8OAEvKnwEB:f4hx1dqmNwiwJx4a46VSJ8A6wEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785960617, "uuid": "e9b59fdd-8776-4cca-b146-51448df9ef8c", "value": 112164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785960617, "uuid": "77ee3f43-1199-4d8d-8213-1ebd31b2bda3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785960617, "uuid": "80ec9f70-ca1c-4d24-a45d-8292c25d4aa9", "value": "killbotx.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59573fdc-90c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785932559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785932559, "uuid": "40ebbaef-a767-45e1-88b0-74e28dc5d9a8", "comment": "Malware payload", "value": "40b52845611ac0d20a7a09fd9d5ca22b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785932559, "uuid": "565c01f0-080d-498d-bfe0-a8ba3c0c44e2", "comment": "Malware payload", "value": "f3eabd1a9c420c7a648fe86b38569eaeb555edcea6e0f62ba7a8e8aac4cc8b00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785932559, "uuid": "84039e24-7989-4a94-9056-d14e523bd622", "comment": "Malware payload", "value": "775b5ecead009cd46f55bdaf80add02004a2ca47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785932559, "uuid": "9f8b93d1-be78-4bee-9d50-998a7bfd2116", "comment": "Malware payload", "value": "63b653be40dd7c595b19b1a1e52b66c3ef3133b8e12f29d8b716315c595888f7d08e6270cb491643db63da3891ed82d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785932559, "uuid": "6066dfd5-51c5-44af-ba66-49d26a9dcd53", "value": "T17F24FD6313C6212FA4E031D68F4942DBFB75460E4E6A57793B9CB981AAD0CD820D6F7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785932559, "uuid": "5e7fe4b5-736f-436f-a2bc-46b4e6ea1ed9", "value": "3072:/fNuffCNJfNb/XTJFoN5bCfbbfDlbbNwQ/CVNNNbO9ffrSb25iNoJNFfgNNfbffn:c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785932559, "uuid": "66dc9406-b30d-4520-94be-5c9278b0ca66", "value": 211266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785932559, "uuid": "2d23d235-6ec6-4357-89d6-2ce1024eefd9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785932559, "uuid": "43c72a76-39df-4d4f-af67-e15b8e49fdc3", "value": "givingbestthingsfromthebetterplacescomingforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7ac90a-9095-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785910900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910900, "uuid": "732e5e40-974e-474f-83b1-2b86209285e4", "comment": "Malware payload", "value": "fd5ed25fe0444f58b15d0e258ba3cb6a", "object_relation": "md5", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910900, "uuid": "f5142256-8666-4a42-aa3a-dffb4a74d430", "comment": "Malware payload", "value": "f4446c3e73eb11c5b8a4813f42ea6a5ac85766e38df151c3a5bcd6b302bf45a9", "object_relation": "sha256", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910900, "uuid": "0f54fa14-85af-4413-ae23-8105b8e3b42b", "comment": "Malware payload", "value": "5ad8f9e6ae6b86f26c5d79feabf5bc67da7c1050", "object_relation": "sha1", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785910900, "uuid": "699d90fa-8369-4938-bca7-8a738550db8f", "comment": "Malware payload", "value": "3c9cd32c10a8a6c9f4f75925b93c29d6a3c47f7be69baa1c78c26e47ed252a3c65fc436b24db6188bad7a9878ffb9eaa", "object_relation": "sha3-384", "Tag": [ { "name": "81a64890ca97bd87f0c9d35bc6501f4d", "colour": "#FDE825", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910900, "uuid": "490fb69a-023c-4f8c-a052-aa65b350da62", "value": "T1F5D5239A74B01970E873CBB58F93E57C706A7B658B304D1BB6DD6C008DA39849C3A7B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910900, "uuid": "86c92ff6-823d-4a93-b795-c04dfffcaaac", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910900, "uuid": "c78a41a4-70aa-438f-90b8-e292a64759b0", "value": "49152:5y2IRMagNMyBbWUsINDd1CUPKZq6AL/uzbEoTUtpGCDXKhWH/Slh:5TIRM/ZW0d1Cytn2ndQG0XJfAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785910900, "uuid": "9ddd4120-9c31-4314-b640-b4c14540ccfe", "value": 2938880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785910900, "uuid": "86558860-6429-4729-af1b-75f39912656a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785910900, "uuid": "ac6d061e-6840-4903-8eca-5cc714aafb21", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f9133f-90d1-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785936635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936635, "uuid": "f6e1a3f0-6cde-4cd3-aa80-e7f08e0b55ca", "comment": "Malware payload (ConnectWise)", "value": "973d484879a90e1a9b529e05e46dbfc9", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936635, "uuid": "7153108d-b6cf-43c2-87c5-34c2f7630196", "comment": "Malware payload (ConnectWise)", "value": "f474d3d132942b7ea97ddb7c617be6cd777f31335e3f1a9d297ee3f30f679859", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936635, "uuid": "95d7f7e4-26c8-4c0e-9ed7-3888e22ed0ca", "comment": "Malware payload (ConnectWise)", "value": "f8e1f71afa648a75fa2bc0ae57cfc00bf210d16f", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785936635, "uuid": "38304e8c-5abe-4b1f-9ae2-d05d26acc7e2", "comment": "Malware payload (ConnectWise)", "value": "bedc6c1fbb5ca72838dca1cf61104b87ccd785a2d28a499dc82d84cb6ead59c9e82a50f0119c648be14917a7358b3170", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936635, "uuid": "a414c349-b83b-4b7b-9631-913204c175b3", "value": "T18A36023FF28B653EE0295A3679B2A210943B7A6165134C1696FCF88CCF251B01D3E797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936635, "uuid": "72a0a680-de24-437e-be1b-1815f32ed59a", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936635, "uuid": "1eec47ea-6347-4fc1-a706-914668f0e90b", "value": "98304:45ORXV8Vgbzfubw+OgO08+5lpOJ75z+o13bX493Z8nJ:c2SabzfOwVgJlK7x+sIBSnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785936635, "uuid": "d7b732c5-de0d-4c42-b8b8-5e5ff7854d20", "value": 4889739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785936635, "uuid": "ad180fb1-790b-417c-b1bb-a6ba5ee5a919", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785936635, "uuid": "16dcdc0f-27c7-47f5-b181-b47e226aabf5", "value": "update.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b565940-90d4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785937797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937797, "uuid": "dd8bd8dd-7c8c-4f11-ae15-66a289f3f307", "comment": "Malware payload", "value": "881b6c1ee6be6b28f1147cce9134f98a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937797, "uuid": "96796a76-1ff6-41ee-b1aa-73fa297e4e36", "comment": "Malware payload", "value": "f48cd4256d84807ad7d4bbaf316469573cdd930e40681146ddba4c6c6761bb45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937797, "uuid": "ef944df0-c996-4fe8-a567-0225c059137a", "comment": "Malware payload", "value": "5cb114583fabae2a87d7b850688444868c443943", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785937797, "uuid": "a9ddeb38-8792-48a3-957a-91e41769a177", "comment": "Malware payload", "value": "9b2ce2e1367d1c1d6780075154fe7c06f6555448da37c90bf40df5da705f63ea0a2f4ccfd6e303cc569775beaa871964", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937797, "uuid": "5fa45cc3-6245-4d56-9eb7-f989d23f45bd", "value": "T130286C43A2E751D8F0BBD17497E65323E932BC490B3469EF12944B312F72AE0A779B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937797, "uuid": "294ce275-e5f6-41b6-a88a-373e9733c116", "value": "fd6f6d07cc33ee9a2b65bda58a07bb94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937797, "uuid": "1958b0c9-1488-4eab-bc1a-33ed7128e29d", "value": "1572864:GZa7hmguP2nG0/Vyv7UhgxIabc/x7Awby:GZa7hmguP2nUOnAwby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785937797, "uuid": "f64598ce-b66d-42c5-969c-4c40d4964a9d", "value": 97864704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785937797, "uuid": "5e96ca09-6d1b-440c-b578-5f9bb19f1235", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785937797, "uuid": "5c561d91-d087-4d37-8fc2-6fc19c2e93a5", "value": "f48cd4256d84807ad7d4bbaf316469573cdd930e40681146ddba4c6c6761bb45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "108881bf-90a6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917834, "uuid": "ce343978-763d-46f2-a16d-0b35026140f7", "comment": "Malware payload (AgentTesla)", "value": "b3a097c85fafe4f75a6b2c40f200297e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917834, "uuid": "6826a1cd-a2c9-4373-a238-978d4c1e6d91", "comment": "Malware payload (AgentTesla)", "value": "f5767e2000c9e28c20bdc16477a21e968edad3535a33663bb7ec3adaf53fd686", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917834, "uuid": "86ebc632-9ca4-4ddb-9146-a6564044f4bb", "comment": "Malware payload (AgentTesla)", "value": "8d3c788f58e47ba1d01412e3d6fb2f3d5e80208c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917834, "uuid": "f0dae1df-6c50-4be0-9f75-81fc99bd813d", "comment": "Malware payload (AgentTesla)", "value": "9ec0144ec6aa2c9c220c11e5679c75c560fab368a01d8754f4fd8770d2745223655b84910f115ef4c07a67f2217da4fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917834, "uuid": "efab725c-3220-4058-94aa-4456c505b937", "value": "T1F053A878150548D38213BD01D9431A96CFE8D21366AB1EF9C340A6CA07DE7DBC8B6DEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917834, "uuid": "3dabf24f-1cc1-4c1e-b866-a1ca2022154b", "value": "768:1xElOcEPkD7eGmTO4IzwvJ/oITXvVcyOPHgprs3JYMyoGs8b/2e0Q:8l97SOqJiu0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917834, "uuid": "107767f6-4076-4d3b-a408-556d416d501b", "value": 65974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917834, "uuid": "9c725010-f2d5-48ae-8894-88892a56deb4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917834, "uuid": "d076cb16-c307-4f98-b0a8-25c0a116f059", "value": "August 05 2026 files.pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9cd79d-909c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785913749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913749, "uuid": "c2e61db4-d41f-436f-b8ad-d2eaceb7eb2c", "comment": "Malware payload (Mirai)", "value": "2a75d35d233458b7aaf9678500e37e9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913749, "uuid": "949510fc-90dd-40ba-99c8-3e86c514a899", "comment": "Malware payload (Mirai)", "value": "f5cdc12db4618fea080a8721459d6e6afdff43516a05761974bcb462d668e134", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913749, "uuid": "3b32904b-04bd-488f-994b-de0a568b89a3", "comment": "Malware payload (Mirai)", "value": "8c8b1448d2a6e8ab3237f38070cae66e3a9c1bfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913749, "uuid": "203471e4-f3cd-4478-86bb-05e7485c0301", "comment": "Malware payload (Mirai)", "value": "908bbb18731e69155286f3a817018dce7ee34a04a013eecf90ac187c3740314cc9d5a8edfa4343b3da7a40536be48eec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913749, "uuid": "d85b7002-73df-4d36-98aa-aa0e7bec293a", "value": "T150140B01B8104B57C5C32BBABB9F439D3B375B1897DB3301AA25BEB42F8679C5E29111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913749, "uuid": "04e5e6d1-9816-4a91-b64a-b3b665162284", "value": "3072:mKj8ddNvtw6nrMLE/sndSEEGSsk2mWvkBGYRvZ2s4aG/2+LwD:+dVtw6rMw0n/EGSbWvkBGYRvZ2s4aG/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785913749, "uuid": "03ee094f-2849-4f86-8507-989970341739", "value": 192474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785913749, "uuid": "1c647004-2972-473d-8c2f-1b34b3ea993c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913749, "uuid": "38088861-2887-4f4f-9096-6ffcf4992e8f", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa4edcc-909d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785914012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914012, "uuid": "593873b2-c3cb-4e59-a826-232ee8336689", "comment": "Malware payload (Mirai)", "value": "87207c810401e3ebd376b1020634c049", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914012, "uuid": "d3086155-e6c6-446e-8587-2eb6ce6918b8", "comment": "Malware payload (Mirai)", "value": "f6d1f3845cbb0dfe7ba0126668678b925cf18b3cd0630caa08558bf50fb500a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914012, "uuid": "57722b4d-62bc-4b3e-ae8b-5569bcf232b4", "comment": "Malware payload (Mirai)", "value": "fcb0b786c6e4f84a4d4fa2a5bf16a469b778e347", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785914012, "uuid": "6eacd63b-6edf-4eed-8080-e822f47868a1", "comment": "Malware payload (Mirai)", "value": "a4f07c2d4bd03cd1495f5eb148a715956289e8a048e141b87dd62ab637830d633bd848b5c073ffc0b4b5e6ce1f445af9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914012, "uuid": "9b2ed182-5deb-4c5d-b39a-a9b602fd0bb6", "value": "T113134D3286B9491BC2C0E77B11A39372E0F62B845190974F7E5A0D8EFE5A340677B7E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914012, "uuid": "16d22bae-3249-406f-9efa-aacb728bd664", "value": "768:t66sLYeiLEK4WTTj0NrElzbFjUDK1JvyMVCnxcyXoy9Kk0nsRhwyt+vPbM+Avm:MEJTj0U1hjVCOyb02dIvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785914012, "uuid": "05d82df7-274e-4846-a9c3-8c452b0607a4", "value": 43832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785914012, "uuid": "f90a7294-72e6-43f5-96da-a15a1c7761f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785914012, "uuid": "dfb8839f-8cef-458e-b712-b27edde09a2a", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb385af-90a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917156, "uuid": "8247dc37-9b81-4429-92e7-1f3c6af0c0f7", "comment": "Malware payload (AgentTesla)", "value": "e3b25d5800cc47dfb46e358714988900", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917156, "uuid": "45e1edbe-ab00-4c3d-8c70-8c71fb0d0666", "comment": "Malware payload (AgentTesla)", "value": "f88640c38e15b4646b875f9a7ddbdd18e317a50db2897ae788d617069607b7e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917156, "uuid": "dd076eaf-6781-4230-85dd-aef0832541b2", "comment": "Malware payload (AgentTesla)", "value": "73924c97047d99b4d8e0612aea418ab47209dc39", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917156, "uuid": "1f90520f-2c1c-4810-9654-01b19e05c444", "comment": "Malware payload (AgentTesla)", "value": "a4ea5db9481aca337bac51a60cceb163c57d3d046f28cd9b66e71fc7af12dc07b41737b19d64d04d0252ef066989cfab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917156, "uuid": "438769be-44b9-4be7-823c-312b53b85380", "value": "T177453A20DD2406694E1B17ADFCA60B62CEBC861D522794F5F6DE030D62064FCE3BE66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917156, "uuid": "1ca860d4-4368-48bf-ac66-1e82d368fecc", "value": "24576:lWwkgu6JcS4VWrafTuSjr3JMlDNe2geTr2OBrr:Mwkgu6JcS4VWrafTuSjr3JMlDNe2geTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917156, "uuid": "55d79826-e752-46f9-bfda-b6b277b311f3", "value": 1174574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917156, "uuid": "6639ed5a-58ad-460c-91f3-df3ffddf5a93", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917156, "uuid": "7934dc9e-088b-4403-a246-226255994895", "value": "PO_13381-608861001026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd775abf-90ff-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785956456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956456, "uuid": "8de166b1-3344-48df-a6bf-9e350f56553b", "comment": "Malware payload (Mirai)", "value": "b926be8b30d24058c6afc7b2318cfc79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956456, "uuid": "09d70107-b758-46bb-8674-39a02d5dcba6", "comment": "Malware payload (Mirai)", "value": "f911cd24d087dc7a3cf96114b564826c7fa9c26f6239348e68ad699916458dd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956456, "uuid": "513cac64-2235-41f5-b818-dcf0d2f4304c", "comment": "Malware payload (Mirai)", "value": "4f6ad67ba101b274c7824a1910dd7f8d47c5fc52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785956456, "uuid": "b140ca6a-d705-47f4-bbcc-58c6a3812aa1", "comment": "Malware payload (Mirai)", "value": "d1868406aa37e732e9a1840e91335d88546bb9a77d25d220d08029720c8bece7765d8a1d6e52df2bb34c05cc50a0ec2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956456, "uuid": "ed28d226-fe3d-4b2d-93e7-2954e63fc00c", "value": "T191C36CC1B10C7E9EE5932E7C820617176E1C9E559C83520190B5FE47EAB72F32E26AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956456, "uuid": "f2554ee8-c596-4558-b122-4028fe52b128", "value": "3072:mS9IaAw/PAItTk1W6C3PKnnSRvSuRmCQLLjyo64:mSjHAIWXC3Ps2vSuICQXvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785956456, "uuid": "f0258f31-969d-4346-988a-95fcb6754ce5", "value": 125284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785956456, "uuid": "b7b666da-048d-4c51-8782-e8de2b6c7b37", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785956456, "uuid": "f0445f5a-514e-4662-9eec-108c77774c9a", "value": "putita.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a6a385-90fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785954056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954056, "uuid": "ecdcd888-73d1-4590-bc56-99e18d2dd02d", "comment": "Malware payload (Mirai)", "value": "d9cf423633cfc537c03910bc30ef221c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954056, "uuid": "e9dd1b90-38f6-4e33-be89-8f01ccbbf4cc", "comment": "Malware payload (Mirai)", "value": "fa58f315beeadff39a0bb0ee26f1e7820b5221b8f14a3bc5e70706e173f9ca9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954056, "uuid": "71e7525d-e9c2-4670-8932-17d8280fcea5", "comment": "Malware payload (Mirai)", "value": "24e60d10489b91aa09bdc993a1493a5d3ce05ee5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954056, "uuid": "6a8cace3-bbdd-4e61-919b-1ea4a2b13175", "comment": "Malware payload (Mirai)", "value": "4d50914841bf873e89bf6cefc5f90a7a7af602d14a498f3eafbfcb7fbd80c9a68109f876b44a81f2a11a83e7b43d371d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954056, "uuid": "76095fe4-b176-4cbe-b9b7-61d44b018307", "value": "T196E2E0A891DD0221F7FE537BE6EED886B43098E2079BC90134D15B7538BB230DB5A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954056, "uuid": "1140f8d6-23bc-4911-ab49-f1d39ce9d9d8", "value": "768:iIPBQe76Dx/AJ2ZAGaozPZgdcPuWYFSUXOCt9UHfw0pdbS/u/Y:iIPBb6Dxoon8aPRAXOCt9UHo0nbtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954056, "uuid": "9d72090a-90fd-4f4e-98e6-2322b11f65c3", "value": 34148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954056, "uuid": "fa16ff35-ca47-49a8-b448-2bab38a9c339", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954056, "uuid": "d89215e3-b172-4918-ae9f-2d1e8be91ac6", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27584e0-90a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1785916897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916897, "uuid": "aabf1b3b-cb40-4254-9101-ae64f1e8b8c2", "comment": "Malware payload (PhantomStealer)", "value": "c015b886bb28aa7fd16c44c81a7b9ff5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916897, "uuid": "2a4a7d46-b071-4072-b8f4-8f6d6b0d955f", "comment": "Malware payload (PhantomStealer)", "value": "fafe100de22df66721a1bd67c1062c5e17991132d4384fcf5b231e4a2292eb34", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916897, "uuid": "5c3f4619-e011-40d4-817a-f33752131975", "comment": "Malware payload (PhantomStealer)", "value": "88acc1e40f096e4a3a986e64cc2ddac8a02ef40c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785916897, "uuid": "c06c3279-5ddb-4378-96e2-d2625452be13", "comment": "Malware payload (PhantomStealer)", "value": "d2b6bec13c211fb4f6924507b717ee91b5c51e465c18441a4d224652d06577dd8444f32e8a415f6357146292aedf9ad1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916897, "uuid": "78a160a5-b7aa-4531-9978-980a5d924ab1", "value": "T131F529512CB58187623C0A9C414B6E6F8E1EE83F5161AD80F65CEFDF6B1F989D3C9848", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916897, "uuid": "0c6ac577-be51-4109-bfc5-abbfa9ba09ef", "value": "98304:IkxzZm3Puuq63eKyHHaWZXoe6oPEF/HCYw18zxoZHtJlOi4mG78j6hewD:aa7eoZHtTOiL6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785916897, "uuid": "9ad5c1a7-8334-4d46-99b5-4ece3034868b", "value": 3507600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785916897, "uuid": "2ad8e079-5b95-4258-b99d-0eb8ce6b300f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785916897, "uuid": "6f323ba5-5982-47bd-acca-3311bc3a4172", "value": "Order_Details.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1faa395-906c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785893194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785893194, "uuid": "e26b39eb-538f-469e-ac93-79fdff1239b5", "comment": "Malware payload (Formbook)", "value": "84890ef65a2a0ec62b1115809928c71c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785893194, "uuid": "e2544f00-1e4d-45e9-bed4-73d9612940d0", "comment": "Malware payload (Formbook)", "value": "fc04a6d3555001a8f04cf75dcdc1cb2de12f530d78603c31aadea81fb26312a3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785893194, "uuid": "f50c5f9e-60cd-4b60-ace2-a79154610619", "comment": "Malware payload (Formbook)", "value": "2872bf0290f44efed82943bead3cd16eecd8ebe5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785893194, "uuid": "76ac99e2-5548-400f-ac84-b28e9f0eecbd", "comment": "Malware payload (Formbook)", "value": "9508e4adaeeffcf5aae6b7d7dc51ec83b0396a9560eb371b55e215837cb971e531d54429379f7d4ea6a720dc8408678d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785893194, "uuid": "ecefd4dc-52f5-4b47-9a1c-95407522a901", "value": "T1FEE50AD323CD798B5D59B7B6A64CF6040BBFE2620B8235D1A9CE0949872F0D7A5D08DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785893194, "uuid": "7b57f2a3-882f-4e95-b132-29ef5fa0e98f", "value": "12288:krJDc94BmkFRIqvf2r5MaA6SVYvuQlhAyGkruQ2t5J9DDWh4dtU5VvbuNApECKNb:OJo+kPgCMVddkoux5c2oVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785893194, "uuid": "ae9d4c36-5774-4209-a8dd-4013c7dcda81", "value": 3225360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785893194, "uuid": "a83b35d2-9002-4824-ae0f-a86a5876786a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785893194, "uuid": "0dd65489-cb9a-4272-b709-c1c00f55cf20", "value": "MV ANNA SCHULTE VESSEL Q88 PARTICULARS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ac1a7f-9098-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785912175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912175, "uuid": "cc8eae9c-d14d-49bd-93b2-7f50d65470a6", "comment": "Malware payload", "value": "6b80fa4b033746c4de88d649941653fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912175, "uuid": "a7b9a11e-0597-4eac-a7ef-5da1c0d01716", "comment": "Malware payload", "value": "fda7f506ffa616c4b2cb6b8c76a53322fc5ff0b24d084fc7665e5855dea8a4d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912175, "uuid": "0a6655c3-98f4-4d2c-88ab-1d2868f93656", "comment": "Malware payload", "value": "2608c6074d9b082257a29ada617695bcb2f50ed3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785912175, "uuid": "3f76aa8b-b688-40ba-a38e-f3584c5e6823", "comment": "Malware payload", "value": "4739cdb32cfa36f51dafd66c416c3c4a42e84ad8ed56dc92de503e287d48b514e5030a4576b5b2a07dc34d4f1c6c32c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912175, "uuid": "2944e246-8641-482f-974d-4a01287c3b33", "value": "T1BE077C43ECA115E9C5AE96308A729253BB71BC495B3123D32B50F3392F77BD0AA79344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912175, "uuid": "ad7f2b63-5603-49c9-9570-ae66faa318f1", "value": "98304:bQUQvetbT10axthKbrZlal09s7VDgJyleBB0ovwNxlH9Iq1EYsKViiam5+uPxaaJ:bO6uaxm+lb7OJyw58QTKViq5YhFwTT8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785912175, "uuid": "be379b8e-bd75-4c76-b1d1-9d422e1ed6bc", "value": 17285282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785912175, "uuid": "e488d862-4bd1-4ba3-8278-86b04bd6ecf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785912175, "uuid": "d0b9337b-02a0-4029-be35-47f6199c9210", "value": "gg11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631c2e84-90fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785954050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954050, "uuid": "17e47d7d-414c-4537-aa0d-0ab07e567265", "comment": "Malware payload (Mirai)", "value": "f3a6d1247bde3cfc87404f31250ea145", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954050, "uuid": "f9f54c5f-44c6-4530-a405-aec27de000cd", "comment": "Malware payload (Mirai)", "value": "fded8790e6739360d167169e17ce6a601897e6f474a00f1eeec188f19614250e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954050, "uuid": "21ba740e-89c7-4eea-92b8-3bc3b87141ad", "comment": "Malware payload (Mirai)", "value": "2306cba805cb23edcd1d5da9330c6df66f5bb7ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954050, "uuid": "8f5007c4-87d5-4b1b-94c6-1a049c6cc73e", "comment": "Malware payload (Mirai)", "value": "ca15a0f1d56ec60a73b3234248c64c8997db1d2cf59e0c4d0c8641ce1d409a149dae3e2dd38d6325b2922cf9f9ebde51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954050, "uuid": "6139f89a-0a92-4a4b-b244-4a0803565e41", "value": "T199833AD7F801DDBDF80ED77B4453490AB231A3910A830F3A6757BA67ED321A45826EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954050, "uuid": "35e8b632-5fec-4113-ad71-4faa423dba58", "value": "1536:ZjJGU346qYvQtGuNM6W8FwGXAyy/QKYVZJfC4IpehmFVbVXHtA:pJG8PYtGuNM66X9QNVzDhmFBZtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954050, "uuid": "de2bc75c-72f2-4619-a765-eda2a464c8a9", "value": 82080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954050, "uuid": "83eec8f5-d37e-4391-a346-419583337791", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954050, "uuid": "395bd8bb-f0aa-44e9-84be-18650f46aca0", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9cdfed-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785917799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917799, "uuid": "fa4b3818-8961-4a2d-ac46-5df215de1450", "comment": "Malware payload", "value": "47331da908bb510af6e4b53c7d84bd36", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917799, "uuid": "29025705-2afd-46e9-ad6d-744e5a1795ce", "comment": "Malware payload", "value": "fe77640e6fe2f5cdf51ba6e53ca34370eee451bf8379ae6f179486f2e9491ddd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917799, "uuid": "ca979a61-8869-4c4c-a4f2-e4b6205722db", "comment": "Malware payload", "value": "83b50cad110fcf9fee9ab2e9e650849b5d7e8a17", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917799, "uuid": "6493dfd1-b1c2-4260-8f82-af0093ee8263", "comment": "Malware payload", "value": "e1f9ef67de63e557f3a615b724978c4b31b2490ea29e33af8302c2fa33f8d5db9978c192dabd3976c10003739d796328", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917799, "uuid": "85dd0a6b-dbf6-4a1b-bba0-7d6e01329fd3", "value": "T122F2EB252A9992B05CF2D67981BC18CA1FB80CFE09CD98779FD4ED73B5DE8406067E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917799, "uuid": "fd881482-71a2-459f-b18b-55a5296ba7b1", "value": "96:PbPbwIreofu2t/urftOtYcP6t0mRRet6YcPutUufIfp6t0bwIreofu2t4ct1upfl:eX4R5cH5BLkKGqYOk8Zi7lAbswYydY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917799, "uuid": "0aa30bbc-848b-4cbb-a055-36d7d40c59ee", "value": 36489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917799, "uuid": "93f8fac4-0c86-4d4b-8c62-4e68ee12db2a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917799, "uuid": "c60d2b17-905a-4147-b92a-e2961eeed1c7", "value": "MS TRC2600508 - 10107161IMG Teklif Hk.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f09ef1-90a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785917516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917516, "uuid": "1f9f310d-a4bc-44e7-9017-80351d535596", "comment": "Malware payload (AgentTesla)", "value": "5b3b27da8418c6c429e585dd9de7dde8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917516, "uuid": "ec8d335a-02f8-4ae9-a85e-50c204f47b28", "comment": "Malware payload (AgentTesla)", "value": "fe8224fd506c5e1dfd8739bdbb2c6d19b0449e6a4788485c2bb348ae0e55f1fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917516, "uuid": "ce0404c7-3074-4b5d-8dad-abe5696f04b5", "comment": "Malware payload (AgentTesla)", "value": "90c75d08e9e8faef67270839344125e6e2c99d94", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917516, "uuid": "28f9b1f1-1cac-432e-a6b5-c1bbcea47f94", "comment": "Malware payload (AgentTesla)", "value": "52a86c1787d3fad26d7c50711ceab5e7a2111a97cfc40b23d4b9833130fc517e67b7792f5e7147144eecdd0f4916a557", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917516, "uuid": "0b2269a5-8930-4b12-963f-2ef0c170f44d", "value": "T160E5078167C495B27720AB9E523ADE30990FE0431DC1DF00766EE708366DD9FA368AD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917516, "uuid": "6d610eea-ac69-4be0-9886-92acdc0938ba", "value": "49152:4LbeTWIQ3PWLV9xH2CLzCy8M6+rL0E23tx220Gl/i8RMvuJ5Et52daduoY8gnMQN:CyTWIQ/WLV9xH2CLzCy8M6+rLR23tx2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917516, "uuid": "06941867-1309-4c2d-9e6a-9318fc163693", "value": 3043594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917516, "uuid": "c7a8b4e9-c41b-4f80-b8c1-e688c9685449", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917516, "uuid": "16a9dd2c-5b21-461a-8fba-781d24849a68", "value": "Overdue Invoices.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9008cd75-909c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785913753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913753, "uuid": "a3d5a26e-7a71-4a85-9816-af9c4f5c1b24", "comment": "Malware payload (Mirai)", "value": "6e5010002ab647582f35f37d3c5034f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913753, "uuid": "d5f1fc50-a564-4301-ae73-a6db08c82398", "comment": "Malware payload (Mirai)", "value": "feb637f11f2e3e560c248ee1340751ba163db5504a5ab934aafd741dd0bf2bb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913753, "uuid": "e1259cdd-9890-404d-8476-6deb83701d20", "comment": "Malware payload (Mirai)", "value": "a2763a36d79ee729483be4bf5941ed86b9c9e218", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785913753, "uuid": "6dca4adc-7222-436f-8bae-9771279a881f", "comment": "Malware payload (Mirai)", "value": "811f18fcb0ea5947644d62e6b2c81566d8807dc3ac9271922e23f40b2d8cf6532d7f330caa04aecfdc8b8bedccfc2ec8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913753, "uuid": "516cbb1f-984b-4060-bd73-a3e01f02e019", "value": "T107142B05E6404B53C0D327BAF7CB434A73239B54A7EB73059628ABB43BC679E5F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913753, "uuid": "bf470883-a54a-493d-b073-9f6c8d9162b5", "value": "3072:enBrwO2vLsNGwJ3eTaEy+CC3KpWTF2E7Ir5uFxGHrM/RW6KQejQZGRuM:Kw1okwJuTaEy+CC6ce5ujgrM/RrKoGgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785913753, "uuid": "335dbe3e-cd7f-442d-8803-ea308835c405", "value": 194083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785913753, "uuid": "f75e02af-6ada-4eba-9428-761e66e53885", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785913753, "uuid": "36b03df6-ad05-4a70-a52b-33344c99a6a5", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a784368f-90fa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785954165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954165, "uuid": "cf09fea2-357e-4b40-8070-6590a2cdd571", "comment": "Malware payload (Mirai)", "value": "c5b3cfa52e48f5cd018eadb6b2565a89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954165, "uuid": "5feb26d6-5816-4314-9f74-2aabda2c736d", "comment": "Malware payload (Mirai)", "value": "ff3055533a5f0ce9d44dc7242f6175351f118c8fa031dd06e6e36ef310066b13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954165, "uuid": "44573b8d-b5ec-49e4-8145-a3815420ae00", "comment": "Malware payload (Mirai)", "value": "dca2595deb9f41e5d63c734605dc2f4bc8b6d159", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785954165, "uuid": "fa9ab13b-dced-4139-bcf6-b6773af078a2", "comment": "Malware payload (Mirai)", "value": "35dc6fa5b17533b6c05b0b1d5ba7ee1ff9be498f335e0363eeead1664d9a32cc18e58cbdc09141b6af8a09ee6db26c5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954165, "uuid": "52e12512-9eca-45ed-a91b-af1704b3b65d", "value": "T11703E199E4F872A6C8BD093E905E0FF6DD0170D1235C4F0B7AAB5C9DB56088B385A5F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954165, "uuid": "5ca05315-c14e-4b90-994a-61604e596f1e", "value": "768:5soq+Ugdom7WdflIylta5Lq/GsSbyF8MVfaOatXmuJGgFWlg:1dHom7cHPalqYbxzxlUTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785954165, "uuid": "d57e969c-0392-4c91-a60f-16c115b44201", "value": 38316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785954165, "uuid": "720a3795-75b7-424b-9d75-4b17b6a6dc5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785954165, "uuid": "17ba5008-8178-4634-b0f6-1da87eb0ac93", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c072eb-90a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1785917351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917351, "uuid": "6d4de509-7d9a-4bf4-8648-3d58a0a95e4c", "comment": "Malware payload (njrat)", "value": "f9f1af9ddf440bbf0d6f14f4e3742386", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917351, "uuid": "0a7df294-5809-496e-8121-6b4d4302f47c", "comment": "Malware payload (njrat)", "value": "ffaf92bc6677ccf4669d995e1d3fd278603cb25edf42fca39d21af195a53d1b4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917351, "uuid": "38b0ff4d-6662-42e7-bfcf-6a8df7d18264", "comment": "Malware payload (njrat)", "value": "1ffb555208da92d2ed9937355bfb0e61e2ca2786", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785917351, "uuid": "b4493d9d-47b9-4316-a403-c49a72fbd226", "comment": "Malware payload (njrat)", "value": "73e48b44ed4723e69a216843b4b912ae81aeaba4bf066002c86111963586d79818ef5e34e49d84f5a86a1636541265d4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917351, "uuid": "7672275f-db49-45b3-8b7d-0625309ff8b1", "value": "T1B03554E2F3AB440DD59343DB89415246ABBA57687BD4FC943E20A394360149C13FAFEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917351, "uuid": "c0e64f09-e2b6-441f-8da6-355fe44a7723", "value": "1536:SB1B/8jKkEB/k8BDUrEF/r4mr4226D8jKkk81h1kU81BkkrrrkkkkoO/krr8FQkx:ip9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785917351, "uuid": "88a03b9f-aeed-45d1-84ee-9fdbc1d7131d", "value": 1133178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785917351, "uuid": "a529b955-4918-47d6-bcb6-096f8f16d57e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785917351, "uuid": "31bdbd62-cd12-40ef-a39c-5c1d6b448648", "value": "BANK DETAILS FOR PAYMENT.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }