{ "Event": { "published": true, "date": "2025-12-10", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-12-10", "timestamp": 1765411381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "18f7e870-d323-4447-9987-91e4879953dd", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e519775f-d623-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765411010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411010, "uuid": "72386e22-28d4-409c-9a5b-3c56b463b673", "comment": "Malware payload", "value": "8290daab1aad3663a5d09c9dc19e4094", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411010, "uuid": "3aef83a6-8888-46d2-b86b-f8134e80e7b1", "comment": "Malware payload", "value": "0054f1209e40acc5913d601e4f00a73c230bcdd6d8a4e9263b7fda5565ac56fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411010, "uuid": "bc830436-6732-4f79-a2cc-90e4e9237c9d", "comment": "Malware payload", "value": "56d0b43fe158d07b5636171edc584846fb183fcf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411010, "uuid": "6b8acf2d-a63b-4ffa-98c4-7220e9903faf", "comment": "Malware payload", "value": "ea0c0743bffc362550d2e992aa40076625dc69b6be1fae17a84c4b2afe212fa968a425c2049bf3a750018c682061a028", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411010, "uuid": "f9312883-f7d7-4990-9b55-294952e48667", "value": "T19E736B81A290DAF7C18316F116A7ABA40736FD3A097BEF85F3587CF48B710847925B19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411010, "uuid": "a881886a-b768-44a8-bd66-901fda0c1236", "value": "1536:2lIaQuch3Jrl9x2jsKUUJZY9fjRy116XfjNsFjmTXs9/smw2p+jPMLZ5:2l1cRT9x2jsKUUJZYZjRyiXf5ajeXsum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765411010, "uuid": "39fb372d-ff47-416f-bb1a-7c871e5907af", "value": 74492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765411010, "uuid": "87152dc8-df7c-41d0-986b-08555d941ff7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411010, "uuid": "d3b1289e-cf8b-4ac2-bd1d-5f83558284a8", "value": "ftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b293db9-d5b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Sliver)", "timestamp": 1765363856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363856, "uuid": "0203c3f0-2d97-410b-9999-5e854cf38962", "comment": "Malware payload (Sliver)", "value": "b772b6f7f5b3bee4f0a25eab9161abcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363856, "uuid": "69596f14-8a7b-49f7-b3c3-f32d4b8d154c", "comment": "Malware payload (Sliver)", "value": "00f799dc6756579035e233ae0212704407dc30cfba938152baea9e2cfc21edf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363856, "uuid": "acec91f1-fb72-4005-a1f6-f5ca9ac74251", "comment": "Malware payload (Sliver)", "value": "5e845ac40ec098997ed5ba061dc845b6f0d5c6a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363856, "uuid": "02ae3687-c67d-4713-b365-ea68fe3d6292", "comment": "Malware payload (Sliver)", "value": "7ef8f0e50322b651512ce772ed1b54dff13f5d9dbec1abc742ebdc2756d3272841245c19602a714e9bff35bd1b3d19b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363856, "uuid": "52eb30be-22ca-4216-8831-ceb5630edf77", "value": "T182F62A03E89511D8C8F9D2B4C9214222FA71785C0B7963DB2B61F7B42B327F05EBA795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363856, "uuid": "a5c0e505-132a-4b51-b5fc-86e69dbedc8e", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363856, "uuid": "022e8dc8-1e5b-4599-aa60-11552ee73583", "value": "98304:D30/lTLkGSwd4S0zMvh2A75Ntq4tcq7EaGPkKJ:L0xyS0zMv3tq4tmMKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765363856, "uuid": "adf546f4-c778-4d03-bac7-5cb7770f49c3", "value": 15568896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765363856, "uuid": "29b5951d-8a34-4c24-ba53-51cca4db3048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363856, "uuid": "a9c37c2a-fb93-4ba5-b491-837f5f1f9226", "value": "lapland.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cc866c1-d5f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765392635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765392635, "uuid": "9f340ed5-f31e-44e6-9926-0ac66e66c1f3", "comment": "Malware payload", "value": "fc7679ef10b360ec74d8996ef55652aa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765392635, "uuid": "6dee342a-fd6e-49e7-b2a2-f69170174f60", "comment": "Malware payload", "value": "00fdf3195bf81be2eadf92339108a635871358c37396e3d9ceed6f9ca8a4acf3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765392635, "uuid": "fd2b199c-95c6-4b28-99da-621107ed79f1", "comment": "Malware payload", "value": "3b4f2c1b19026f5171f833c70aa2d6fd079bd3a8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765392635, "uuid": "9b1dfbf3-b804-463a-8780-01faac76ff05", "comment": "Malware payload", "value": "4e9f2f3c861a30c0eee8c8ec0bad890ee07bc7d2c2c3eb8190aef7a38b4fd2e07a1875acfd729163d49b89b701030c4a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765392635, "uuid": "fba9f935-1304-47de-803d-7b695a34df8b", "value": "T102C1D81481603CD94D2D6BC002757EFA34B994575BBACA27CB8418F730D6CEBBF9809A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765392635, "uuid": "f5033726-8a55-44de-8c5d-49bc3e3b2f4a", "value": "96:oC0uWcq4swQPkzJwgw9CdUl4p5QOOaK4rW8CbaNfv4MImEVvcrTErs7zTiOP7ayT:h0QNBtGcdUl4p5RK4rW8C2Nnj5ocvB73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765392635, "uuid": "caf2fba1-1af8-420d-a235-86dbdcc66e79", "value": 5656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765392635, "uuid": "b0b4c528-e9d4-4bda-b25c-4ec228f63d7e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765392635, "uuid": "d8bb5898-7393-42a1-a2c7-024b497565fb", "value": "conf-nasta.mp4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d14d9b-d588-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765344461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344461, "uuid": "157b6fe5-3d1b-4e9f-8bc6-55875d0dfc4d", "comment": "Malware payload (AgentTesla)", "value": "e6f01c743404ed508b8c2a39f7a85585", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344461, "uuid": "d207ade6-4543-41fd-96f3-7a2a66fdfdab", "comment": "Malware payload (AgentTesla)", "value": "013b9884d3f7886ffd48b595bf1c6004f6d018649e5c5ce0c994f19a63b8e090", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344461, "uuid": "0f3a9f36-002a-44a6-a3b4-e33d72409261", "comment": "Malware payload (AgentTesla)", "value": "d6134a3eeacaa3d34f9d9f81c57e6e0e402c25ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344461, "uuid": "434ce685-e03e-4c86-a128-073f1881b472", "comment": "Malware payload (AgentTesla)", "value": "3a095b6189b4a08fd7ad7765dbede7faa872bfcf4230ef0dda1dc8a8751b126bb281a2d631c4f55079bde062cbf5e6c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344461, "uuid": "dd29aa8c-416f-4b38-85d8-6076001da5e0", "value": "T1A635AE0273D1D062FFAB92334B5AF6115BBC79260123A62F13981DB9BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344461, "uuid": "144d5c4e-4ad6-4e0a-bc2f-1dcedb3e58a4", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344461, "uuid": "f8a9fb10-22e5-4b98-87d1-bcd2ed47a860", "value": "24576:t5EmXFtKaL4/oFe5T9yyXYfP1ijXdaEeX9cbewIKNS:tPVt/LZeJbInQRaEkAewI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765344461, "uuid": "8c656529-4518-4230-ae5c-c87c0dbc0da5", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765344461, "uuid": "e941a72c-8eaf-46f3-90b4-33f0011c8b60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344461, "uuid": "fe79a6f7-cb16-405e-aa76-454ba3543583", "value": "Customer Contact Form \u2013 DHL_Contact_Form_23647892145.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fbdc0b0-d5b1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765361716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765361716, "uuid": "3ef57951-fea5-4708-99e4-19fc023e35e0", "comment": "Malware payload", "value": "05990ef9d0cfb0e2c427641c05824bb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765361716, "uuid": "c70bc476-1e31-46d9-9224-fadedf668dd6", "comment": "Malware payload", "value": "03369bf3a8f0feeabdf6b16e7640f6f40eed5a96bff06a884ff30f10f55b5b68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765361716, "uuid": "4aaa8f4d-b711-4f72-999d-d762164e103c", "comment": "Malware payload", "value": "24bb090f2ab7b16b367c5405104931348dab6eb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765361716, "uuid": "3b36e178-f479-4cf6-9046-4c80ffbc48f4", "comment": "Malware payload", "value": "1ee5162bf1b02ef23125ec018da88561bc0122e0456764df2c9d0d0475a035c21f571d4d569364413c7cd5b9ce8c2389", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765361716, "uuid": "2e9d9c9d-e491-4dd9-80a7-115ca40c2646", "value": "T11E172311BBD18C37C43706389C2B9BDD6E25BE101D2899EB37F17D4D2E3A7827819296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765361716, "uuid": "ef86f713-7f21-441b-859e-ec7f7d10291d", "value": "f9a1dab1b356dabe646a14b95d3dd580", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765361716, "uuid": "9d7fb3d1-7123-421b-8af9-3c7e27be1585", "value": "49152:PWviDKgv1Mx8V2m2gW7Na4mH3wrnGmm3hjon6AT11h7k5HJxNtrjFFCxaQSZ1dS5:PpDTSbmKpaxH3wrGmm3ni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765361716, "uuid": "dc9d5ab8-2b83-4f20-89d2-7a088de431e0", "value": 20085248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765361716, "uuid": "a4349be5-0a60-4204-9013-c0bfdfdd11af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765361716, "uuid": "78665292-772d-49bc-bc80-8de3f0cf59b0", "value": "Comprobante_Facturacion_55342918C.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a132f87-d5c1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765368552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765368552, "uuid": "30a85bd9-0b93-4c1e-ba9f-56f28a8e42c0", "comment": "Malware payload (Mirai)", "value": "f67c62177cc91c02cbd7a2c711d316d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765368552, "uuid": "d57a9cab-497c-4961-b1b4-7c626f070aa6", "comment": "Malware payload (Mirai)", "value": "0620fc817e3fe29e6957ad141ff6b1d796ab1eaf5df35de8d3c7d03659714913", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765368552, "uuid": "211e9583-5fed-4c28-9fc6-21f80d8e9256", "comment": "Malware payload (Mirai)", "value": "a6a6653d667e57ad3b216d3ae41fe5064ad2284b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765368552, "uuid": "f125f924-650a-4a6d-9e53-8cd015818a7d", "comment": "Malware payload (Mirai)", "value": "46fe451ea494909f62c5b25a01f16179602472c341f0a6f979661f2644de836083ba95a9693375f6a9be083af6aa441e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765368552, "uuid": "1d30ddd3-2113-44e9-ba7e-3835c3fe0e13", "value": "T1FA74D50AAB610FFBE8AFCE3752E90B4525CD641721A82F357270D918F54A64F1AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765368552, "uuid": "e245cff0-3a87-4997-b34b-9d21a9b36d90", "value": "6144:v1sJ9Xidkc4MAdpHqr7S4Answ6JkCAlXNuSU/:qJ9XSpSi1kS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765368552, "uuid": "2dcc0f5d-ee46-49c8-a576-5dcf8b187c29", "value": 350060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765368552, "uuid": "f0fd1c50-6747-4f35-a316-bf0ca9c46c70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765368552, "uuid": "66c2be3b-6dcd-4179-9587-2a9e3fd93085", "value": "ecco.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a0a2f3-d619-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765406573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406573, "uuid": "67f0777e-b56c-4788-849e-fe8d1e9f3aaa", "comment": "Malware payload", "value": "00e2ad8148406edc7b6cdb45f68a15f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406573, "uuid": "acc89c73-135a-4c23-89da-9b82c15925e3", "comment": "Malware payload", "value": "06aba697bed0e80787714cb51541f970be6e7023c2b1b4d5c755aa3ae4cd5692", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406573, "uuid": "618bfec6-1234-49dd-82a0-80d73e7a50dc", "comment": "Malware payload", "value": "60fe75b67c7c2b6b4436943a6e3e877940331ef0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406573, "uuid": "28a8e5a9-4434-4584-af10-0ca994c33727", "comment": "Malware payload", "value": "bfae24676717be856cabf325af0e8c72c48b11bfdb8999887a361c6ee561650a112a8525fdd44663f436afa96089ac75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765406573, "uuid": "ccceca7a-2d63-45f9-8f11-bd9af5e7dc19", "value": "T1FF634A96A801CD3EFD5EF67FC4250A04B56A631062530F3FA36AFE935DB2084CD5AD42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765406573, "uuid": "2d377ef0-9988-4a88-8a51-c058000353f8", "value": "1536:wA/WMCPfL3EMq50pXBQjJJJJJoNyC38u9G9C2g2tyvk3yPO:wA/WMc3EjGpWJJJJJoNBfegYyMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765406573, "uuid": "c3d5970b-787e-4b80-954d-4e3120353ba5", "value": 67532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765406573, "uuid": "ee6db40d-7b05-43ad-b1c3-2de3d75a7a4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765406573, "uuid": "9ae81b95-6d82-4bae-81c1-16963a275170", "value": "jklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c77f2cc-d61a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765407023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407023, "uuid": "b71dc280-2c44-4aac-8c24-b5e9e2d88e35", "comment": "Malware payload (Mirai)", "value": "93d647f78ac556918169d67013823e06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407023, "uuid": "77656114-a7bd-4bdf-a0ca-5d0041f45dba", "comment": "Malware payload (Mirai)", "value": "06ec6afc037252fdd473b61340171865bc17a9122749f2c424e2ff407f58b774", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407023, "uuid": "76f05c88-7724-4765-9a24-9bfca8702470", "comment": "Malware payload (Mirai)", "value": "a2f083337e0dbf92bd4d07f6317c2b1e02288319", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407023, "uuid": "c2f7effb-2d14-4ac8-ab65-5640bf2cbba9", "comment": "Malware payload (Mirai)", "value": "1dbb8b6ce4cf9c700a45629ff54bb87ecb6d2d78c11f576a6ecffdaffe4dc269d82b3f48a263fdef510d58395ce1dcb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407023, "uuid": "52ce3170-9687-41a8-b365-7e603846d78e", "value": "T1B723F9C7A800ED7DFC8DE73AC94A4E19F2617A5482510A73633EFD639D712C8982ED46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407023, "uuid": "0a4845c3-d3b4-4113-a635-f1b028e4d4ba", "value": "768:qgBoXgJEwOTSLISb/S+HxOOOOOu/8dUAOA8u2hIEKKTA0IU45EhR3yPlF:32QJElTSLnb6COOOOOuUWpA8u2/KKTni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765407023, "uuid": "a8066d95-3faa-4060-a54e-8829b7bb2312", "value": 48684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765407023, "uuid": "558025e5-b488-4fdd-b774-f1c23977bba2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407023, "uuid": "52f57a63-ffbd-4f78-967f-48dcdb16acd7", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a63f3490-d5e2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765382987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765382987, "uuid": "daaedfc7-4980-46c0-a0ad-20c176448e12", "comment": "Malware payload", "value": "c9cd3aa8e8fb71c94aa887b93996ac47", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765382987, "uuid": "036e0814-a116-4e09-a6b9-03f7dab34d86", "comment": "Malware payload", "value": "07fa63051f8ac2cd4dc1c06a066a0130da15361d7d657cedfb1df1899d4ef3f7", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765382987, "uuid": "621e9402-9544-4fba-8eb6-05000c0a25ec", "comment": "Malware payload", "value": "7d98b2925bdc55a96c2959d2ccead13101b825ea", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765382987, "uuid": "7c2b2495-c122-4e25-99e8-c12d0bb2dcdc", "comment": "Malware payload", "value": "188a402d7f6d056faf26ebb9cd7db49f0be744c7ec8e0cfa6555daeb5ec94d0fb4eb76149fea095f9ba76e7f889adc13", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765382987, "uuid": "956e2c17-26d8-40d4-9b28-e9c42d95f161", "value": "T14D1462890AAF40E7475F2039A20B8D4A9E5D2A1B054C9DD079DEBF862F329F4B5773D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765382987, "uuid": "d7cfe797-d25b-43a9-81c0-8cae4090840d", "value": "3072:SP8xwkNpTMOinV96LoSxO/x4/W6sKCKQMsg9ZC4SzxHwEA6p0MZDA9OBfgviv5jP:RLoSxO/4FddLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765382987, "uuid": "0dc5aa83-1aa4-49fa-af9c-44858c3fffa8", "value": 202062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765382987, "uuid": "dc6efcbe-412e-496b-a33a-1793606235ec", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765382987, "uuid": "2996c91f-8b42-4cd8-bfe8-59e4e9c60dc4", "value": "Testing_Template_Updated_5625.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f03a3b8-d598-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765351058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351058, "uuid": "93a4d01d-3686-4a68-a080-b5fe3d6850c3", "comment": "Malware payload (MaksRAT)", "value": "15bc273dfe783cfd2073384dbc3732c5", "object_relation": "md5", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351058, "uuid": "740d1484-e3bb-4a65-8c7e-4faa1a3ac463", "comment": "Malware payload (MaksRAT)", "value": "080361448ca3f797dd8c2f48bbbf736f397860df7474a06ce4d271a0fb676a4e", "object_relation": "sha256", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351058, "uuid": "4b5c2772-f2ad-4ccc-9a2b-594289c42464", "comment": "Malware payload (MaksRAT)", "value": "850bee257ab570483cf024ce09917099c4fdf45e", "object_relation": "sha1", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351058, "uuid": "85017d8b-812d-43b4-8729-cb6a6b0bb66b", "comment": "Malware payload (MaksRAT)", "value": "59863a01a03ace873361f07a251ffcd2af958538ca74ca54b62e0ebb94d99cae6d112a3c840285907c31b1e69731e844", "object_relation": "sha3-384", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351058, "uuid": "02d00c0f-67fa-4a63-8666-050511235d07", "value": "T1D6E2F143C5AAB309C48BD0B557E319364D228C20741FEF3B61A14690A9F5F8D3DD3AAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351058, "uuid": "0032a48f-1ff8-4e80-b016-bccc77f0edea", "value": "768:xEcqD9ussUNCIWtR6h2NR8bKQRGnXbPo/ulz:ucqJsUewkRAgnXbPo/ut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765351058, "uuid": "a816e661-4338-43a0-ab80-34fba5f342f2", "value": 32172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765351058, "uuid": "aa973e69-c11c-4e64-9e82-379554c20e76", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351058, "uuid": "3442f233-abf9-4ad8-a9ab-9653f91ca726", "value": "080361448ca3f797dd8c2f48bbbf736f397860df7474a06ce4d271a0fb676a4e.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52602c31-d61b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765407328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407328, "uuid": "d0375b94-a283-434d-8b12-399f96f14f2d", "comment": "Malware payload (Mirai)", "value": "1ef9b0bc61ee2c7450121c4f88a33a1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407328, "uuid": "86dfbba6-3416-4b02-9094-8a87e7a0321e", "comment": "Malware payload (Mirai)", "value": "084c7adfe93d8685f368008cb2120886711ca926b75ab6921795f5b19cb058cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407328, "uuid": "c1dbd477-e008-4532-86b5-3719947b81ae", "comment": "Malware payload (Mirai)", "value": "ab6dd6508925ab3e7255f78264fa027c58de0f63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407328, "uuid": "3f9a9c49-b547-4c06-8c1c-db5042ce8747", "comment": "Malware payload (Mirai)", "value": "663231c4ee061d30757ca16c0e6683f67e0f2ddbedf711ba78cdb10069f58913404bba20f6906d06768bacac4b35476b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407328, "uuid": "6cbd76f6-9843-4133-9a86-27cb00e5098d", "value": "T15A83EA1ABF654FF7DC6FCC3B45B95B04249C960622A83B757930D818F25B24F1AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407328, "uuid": "8225a265-82b1-414b-962b-1d08aaaa4643", "value": "1536:FYJMCHimmjcc7tG7D71IRiDGAU4ztXEZN61T3bsRX:F8himycrjD91T3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765407328, "uuid": "7be8bdf8-02ef-42d5-bb00-35414340aa96", "value": 88396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765407328, "uuid": "7107158e-dd25-4069-832e-51dc6bb99f05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407328, "uuid": "ab0464e6-e1ce-4fca-a985-9b40c2277a79", "value": "splmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2193f3e0-d5b6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765363867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363867, "uuid": "45b70ce6-f1a5-49c5-92db-2e4eac575bbf", "comment": "Malware payload", "value": "2043d090438c9a6c6c8e52ea5dce6e95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363867, "uuid": "8f222dcc-7425-400f-acae-347e384ea63b", "comment": "Malware payload", "value": "08790f082e9636f095ba679f927a35bb945b5e680d9c62f5029364698171623f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363867, "uuid": "777a189a-c155-4f3f-bd7c-9e19c9c80f85", "comment": "Malware payload", "value": "b246f3dcde98365cd6c6214d8a6f8c075e1e84a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363867, "uuid": "80b9c918-be52-44c7-8766-3b738d38336c", "comment": "Malware payload", "value": "2629c88294dcb7a6ea51c7714c674ec58df399877c0a70e07d17e22126d1ba29e1bfc499fc5bc038ad0b3a595eece533", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363867, "uuid": "62ec66ad-2dbe-4661-a090-2ac6d234a962", "value": "T145741954FA45FEF5E44D8BBD24E2630A52DEA280EB1DFA373440FD68054EB6807B3985", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363867, "uuid": "6ebe877a-c4a3-4338-9eda-c5f0612b97e4", "value": "32c5d4e796155178680ba431c0f9d469", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363867, "uuid": "9810c9d8-5bd6-4746-ae01-792ec6e72832", "value": "6144:VgEWjlPs5t38dX6piE4HU7kpfTcnFOHuln+Otc+EkzI8jSejCE8aKP3sGvL7hcy5:VtHnZXFftAAcdPC/7OuHEBR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765363867, "uuid": "f3f3a485-b483-445b-8c31-20cdfc2498ae", "value": 360828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765363867, "uuid": "b8f7af5b-4c6a-4069-bee3-4107bc1086fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363867, "uuid": "84079b66-351d-485e-87ef-12492aaf31b3", "value": "rev2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd9c706-d5b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765363756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363756, "uuid": "bcb7ec57-13eb-46c5-835a-9d128098e072", "comment": "Malware payload (Mirai)", "value": "506cc7d39e766a967c6f1c624eccde9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363756, "uuid": "9344a268-c1e7-47f3-b9fe-e67203437f95", "comment": "Malware payload (Mirai)", "value": "088780c4d0f72eda2d08bc53f82f7d10d418550fce58abc1232d0957da611970", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363756, "uuid": "35412965-a8a2-459c-9c23-66515b5952ea", "comment": "Malware payload (Mirai)", "value": "d559f489e7af12cb5eb7a5fab4a50dc5732adf3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363756, "uuid": "254fe7c6-3f31-4304-9304-f5dfa383c782", "comment": "Malware payload (Mirai)", "value": "3b6acbad69da591fda855230e5659fb173cb24d1eb0638e94e7103dee52b6e0d76cffb75682384e2b40fd64bbf13939f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363756, "uuid": "6cdb4701-d1ad-4a83-a98f-beceff5c0c33", "value": "T185442985FC919E22C6C417B7FA6E018D371A57F8D2EA72029D141F3437CA85B0D7B682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363756, "uuid": "4aa76db2-9482-4b1d-ac27-783f2e849822", "value": "3072:blVAkgVCHC2tXeeptnaWZwRwAZS0vRW4LXZFq4NvJCW2gulX:gkgVCHC27as4ggRW4LpFqcvwW2vX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765363756, "uuid": "e9cf24c3-d05b-4b8a-84d2-dda4690ae600", "value": 261248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765363756, "uuid": "6169ea81-25e7-4f7a-975d-6d3e2b52fdef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363756, "uuid": "ca834fda-6cf0-4059-af82-f9ac232981b0", "value": "ecco.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9386447e-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1765345160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345160, "uuid": "1a943b71-3185-483b-b296-98e8d54d64ed", "comment": "Malware payload (PhantomStealer)", "value": "8b598726934a0411955c615776b27b6d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345160, "uuid": "6eee6883-c980-4fa8-b98d-f33ab5658892", "comment": "Malware payload (PhantomStealer)", "value": "08ab1a08488e08dc36439f47ad512363885968d9c41328229a28c174cbff3b12", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345160, "uuid": "15d5f9e8-a238-4a93-a052-d488f685ce27", "comment": "Malware payload (PhantomStealer)", "value": "e2c023347a9a82ad60cc8b9e361ea3bfc8d18964", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345160, "uuid": "d50cae82-f79f-44f4-a135-c60f7cfcf95f", "comment": "Malware payload (PhantomStealer)", "value": "383324feee7922e62465f00de36986805167a57eadb8b13c963b6886d6f2242257257e0c2c2b3e0793e1effa90199ada", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345160, "uuid": "09a259f4-7ec2-4058-bef7-871779aeff94", "value": "T1591612F99A3831DC99020D07BCA5C6E88775D61F10127A99B9C7F9C8DA9764003EEFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345160, "uuid": "85ebac58-4879-4a83-8fb7-7ce4908dbda7", "value": "24:lffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff+:OIcBWwcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345160, "uuid": "9c347880-903f-413b-ba7b-6a5b83b99781", "value": 4214540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345160, "uuid": "bf0dfc36-4848-4285-bb1f-9992e3109362", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345160, "uuid": "82a9abc8-fc20-4324-b3bc-84b1b6755e1c", "value": "Paymnet_Advice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fa4352-d598-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765351050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351050, "uuid": "415680be-e64a-470d-95f3-473b70bc745c", "comment": "Malware payload (MaksRAT)", "value": "385b81066c339a69f762830366d59dd4", "object_relation": "md5", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351050, "uuid": "0fe9e80b-59aa-4e7b-99ef-73ff3f3616e1", "comment": "Malware payload (MaksRAT)", "value": "08aea73cc2323dee1423005119d585cdf3d6725929fa1df1fec9de49266102ab", "object_relation": "sha256", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351050, "uuid": "5e25ca18-00e1-4dc9-b280-b581c0989c5c", "comment": "Malware payload (MaksRAT)", "value": "0ed5cd4c1311c9ce8c2c2a93840ffc951412fb4a", "object_relation": "sha1", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351050, "uuid": "2cc800b0-6461-4ab0-a48b-b5d78ebcd1f2", "comment": "Malware payload (MaksRAT)", "value": "9acfd5c15f975f288945a486fc106ff45440e3edc766e546d1c860f863355e397d260ec4f2a4709c04f5bc48b2120770", "object_relation": "sha3-384", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351050, "uuid": "7c9da4ec-d51b-48ec-83c5-963a2237fe33", "value": "T19BE2F10DE9B3C9EED10E61F46DA3DAC05EF9B3C4558D68226A6CC1AC8D15D3422359EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351050, "uuid": "12618b86-c127-4238-8bff-99dfbd579673", "value": "768:ZytzvaAh5DRniw+t0/4rTYG8NMW8IRTbfbCwL:Z2baAXDsx0g3YGr2bjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765351050, "uuid": "8f0df8c9-52a4-41e7-997e-6ec07f935c34", "value": 32902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765351050, "uuid": "e97532e0-fe26-4b98-8771-aab39077ad6a", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351050, "uuid": "b5c73638-3f94-4c56-9586-beb9b350b2b2", "value": "08aea73cc2323dee1423005119d585cdf3d6725929fa1df1fec9de49266102ab.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325e799b-d598-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765351010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351010, "uuid": "a630b316-f9da-4410-82c6-f0c14f5b886e", "comment": "Malware payload", "value": "6354f4d009ef465d23916850208c4519", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351010, "uuid": "602d27d2-7343-4d61-9991-29331d5312e2", "comment": "Malware payload", "value": "0a708b91a0147fee993c9b0a0e1ef15fed9c5278b15ff406754d4a3dee1f256d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351010, "uuid": "73f07f22-9ee9-4026-b1ba-2d149c8487a6", "comment": "Malware payload", "value": "2652cf0bfb19ec808fb5fc5610f052890b1a3c45", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351010, "uuid": "8e82b7b1-e33d-436a-b8ab-aba3a78f3a86", "comment": "Malware payload", "value": "433b6002db0971a5e4fc04013a3529b568cf432ee0b269ab5d0abaddf0274c15f1fe0ef1d45b363df707056b83cde268", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351010, "uuid": "6426c414-cb52-4084-9580-d8e205565995", "value": "T1F412242630694576CFA551BCC4DE342AB3BEE8431A1E2E8162F6591C34055A8B3FD6CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351010, "uuid": "ff20232a-f8b3-4269-b190-e708b0dcdab4", "value": "192:oIUI3B7zhhd/TsZ8eObqYBFzy27zhWd/TsZ8eObqYBFzkCGsxBG1sxBbsxBHxBW1:9zNACeObfnnwNACeObfnFmoajiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765351010, "uuid": "5400a1d8-191b-4070-a27e-d1996f385c38", "value": 9792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765351010, "uuid": "96b8c948-c3a1-498b-9a46-91f42c103680", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351010, "uuid": "637d3489-a387-41dc-8e61-86c3be4ab213", "value": "PAYMENT-00000021450USD112015.pdf (-75kb).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7e2b3e-d61a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765407021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407021, "uuid": "9f00809d-52f6-45ae-aa06-eba5bc333159", "comment": "Malware payload (Mirai)", "value": "7bef64f1145bda3be0287589521f052a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407021, "uuid": "e3e3168a-36d8-4f70-bc53-51b0af19e170", "comment": "Malware payload (Mirai)", "value": "0aa7187ca9dd29e6d8ec9400d0bddc549e98279bfc36c967f2a4354657ab0a8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407021, "uuid": "5c2f3260-9211-4a53-a8b4-003552f3a730", "comment": "Malware payload (Mirai)", "value": "7d412c63ea540af2370ed2fdd120623b67c67b0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407021, "uuid": "53c1cc0a-db49-40ef-9e97-0c215b77347e", "comment": "Malware payload (Mirai)", "value": "b78178c96f083d1e508fc7e8c19e65cdd9611ecc119b211ca6f80b315e2f9deab692f027545b1da0c1834b19cfce0eaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407021, "uuid": "2c35bd76-09c7-4dee-90f3-073b13340085", "value": "T193134CCED993D4F6EC190DB22877E7315A32E47924A4FB82FB98D530B812216B1853DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407021, "uuid": "47c964a2-c717-4715-ba16-104f28c59911", "value": "768:k+Zqpsz7nNoLRKxamVIBeB+eC6xnHL5knrYSi2tiMfaQRj:kgqpsz7nNo2amVIBeB++ZKnrYXciMfaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765407021, "uuid": "373e2de8-8d16-4879-bacf-f0add91942c6", "value": 41860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765407021, "uuid": "7a4edc2d-3bf9-4bf7-806c-535363ce4403", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407021, "uuid": "47fe4020-991e-4677-bcfb-90a1f224753b", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956d8e8a-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765345163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345163, "uuid": "4426b337-63d0-4457-a2b4-247428b90e15", "comment": "Malware payload", "value": "4308234d790ff9e2486ef895a3ef5060", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345163, "uuid": "15bc9062-3c9f-43cc-9f58-797a2b8307b6", "comment": "Malware payload", "value": "0abd05530ed731c859cc6e2f76afe5cf4d4597f2d39bde8508ed5fcc1aed3abb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345163, "uuid": "b5bd26f1-cb89-4f13-9bfd-53462c7d8f2d", "comment": "Malware payload", "value": "045d7e4b352cd956b720f9737a89bb7c3c899498", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345163, "uuid": "1e69848f-f8a4-4c2d-a33a-df5d83e685f3", "comment": "Malware payload", "value": "92208a168bd4ad658c043ae1d510f413e429f85e34ceb9d1f39f9087d96032cd1f3cab3319c30b7e1b924ea7bfa653fc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345163, "uuid": "ca043532-2a8f-40ff-8565-817358fed48b", "value": "T19FD44A20DD2416B94F071BA9FD540F61CAFC960A552A94F1F6DE070E61029FCE3FE6A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345163, "uuid": "ea3d3c87-b99b-40ba-95ea-4b84cd987e4d", "value": "12288:sKjKSKlJv/lKlJ7KlJg+Ih7KlJg+LKlJg+IZKlJg+IPKVKlJg+InKlJ4KlJg+ISf:sKjKSKlR/lKlJKlxIFKlxLKlxIZKlxI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345163, "uuid": "61862742-a3fc-42bb-a467-98fd1ee0f0a6", "value": 598617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345163, "uuid": "d424c3dc-58f3-41af-b39b-50d199f50e3d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345163, "uuid": "22f7435c-8e0a-4e97-846c-f02345a78022", "value": "Datos Bancarios, PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22352ef8-d5a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1765356566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765356566, "uuid": "817a6aff-e022-4359-9ddb-98770cd8a176", "comment": "Malware payload (Formbook)", "value": "af652825a2501a10d3a531655368d480", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765356566, "uuid": "70a83404-3795-4f94-9e38-7b6c388f0b4a", "comment": "Malware payload (Formbook)", "value": "0ac74eafee626ebec80376eb13837525572a52e04cd595ba1a501dca0606cb8d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765356566, "uuid": "cb2473c0-684a-4d3f-bd9f-3a6504d06f70", "comment": "Malware payload (Formbook)", "value": "88a9a7abc8835d7f6a96b5d274ff5cf88ff682c2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765356566, "uuid": "637c8ac5-6f30-47cd-a88d-48f5d8e57aea", "comment": "Malware payload (Formbook)", "value": "7558741216449f70d05d134d921c569b56e721965f6d48eda3cbc1ccfd4133d9d9172390c2a13675fa276103542f2259", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765356566, "uuid": "d03153c4-aece-4eeb-a7b2-1af04a6d1ac5", "value": "T18FA5A05D84B1ACD2A054FEB4F685FFD78CDB5385162B07520FE4858A3312C83FAA72A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765356566, "uuid": "9f7420e8-ecf2-44f5-864b-b5169b1dff2d", "value": "12288:d8AIuNXMRfPY35aQnIGzEJ6+ejBNmnDpDI9kdfZxXxSVomMGNY9G27xvzubm:TXCktE0HJiSgGk2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765356566, "uuid": "e6713659-bd36-4bb2-9824-006b5910561c", "value": 2112464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765356566, "uuid": "48b068a5-5239-43ea-a2f1-4af3446c05f7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765356566, "uuid": "1250a4d7-8c6e-43bd-9132-d18cfd3c265c", "value": "Order Specifications 10-12-25.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3e12cd-d5a7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765357496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357496, "uuid": "29685b26-8bb7-4b59-b0ef-0d55afa629ea", "comment": "Malware payload", "value": "f48b18efec8568375b4aed80bfc5b4dc", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357496, "uuid": "b325e231-5278-40aa-b0d1-0fc8b75791b5", "comment": "Malware payload", "value": "0c4b5414d9504abb6cd774f99e46b1ed52a87e4e876704c5e8efea1a5deed5d7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357496, "uuid": "ad437971-c09a-4ab3-93fa-83d853d0c5f7", "comment": "Malware payload", "value": "3abdc59ab311042e3b5f02041dc21ba05654524d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357496, "uuid": "18d32c3f-371e-4429-ab24-0d8d4504b945", "comment": "Malware payload", "value": "86dc3333cfd11f54c4c43747b8041540aa816d28e3f0fb78a8d5242d6790efca8860aa5dbd77ac4d1c10c2e165998e53", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357496, "uuid": "e4faf1d2-e82c-43e8-a268-252c62741154", "value": "T165572349F709981EE4F3123739B2436269135C628F03D6876921F33CAABB5E14F1EB95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357496, "uuid": "d3fbd773-230a-4977-95bf-5f5fd2d3fc36", "value": "786432:Ilvmnm74FzGsnZlwEwDRM4xxWNx2xtDgn3aTnIWxc4c6Z:I8vZLnjwEoz6x2vOaTnlD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765357496, "uuid": "2b5485d8-d488-4a97-add4-e56c1a612f1a", "value": 28807098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765357496, "uuid": "a146cf8b-0b71-40f3-aaf8-cb1f660a2007", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357496, "uuid": "5918e693-cea7-4c1c-b1cc-23cbf44c6a19", "value": "TV-Garden_Ver_12.03.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6cf7e6-d5ec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765387022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387022, "uuid": "7a28e8cc-6795-4a2c-8ee6-f34967c3881e", "comment": "Malware payload (Mirai)", "value": "2ccacd296dd5d29001b8abaee1bae822", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387022, "uuid": "d9e6be8e-14e5-4c57-92aa-8276d4a216dd", "comment": "Malware payload (Mirai)", "value": "0c59e69f26fb1625f225e51a5cd7e4b5a01df562278c358f91bfce6f6ca2bc63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387022, "uuid": "32c92b79-3910-459a-aa3b-0018b955e8a3", "comment": "Malware payload (Mirai)", "value": "0d8ea8f5d027fefb4039b7f5838a7e8af0fb7281", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387022, "uuid": "44006633-6c29-4695-b681-f3b10bbd680a", "comment": "Malware payload (Mirai)", "value": "3c6cbc1266e1364763653c53edd7debbaa9abd23ca5c6221eb4733e366df857845b80199fceae3cf97366b664dc8cae9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387022, "uuid": "36224105-e619-4550-a83a-d173c690eb9c", "value": "T16AE35E8AF4029E7DFD4FE5BE44670E09E931A39131830B2A53DBFDA3A9311994D17E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387022, "uuid": "56ffc845-35f5-4e74-9156-a01c491d39b9", "value": "3072:7oDlIyA+oy+ZGiTar3aiIHH5lgLOoe97dlJ8j8S:1Dy+ZGtIXxoe918j8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765387022, "uuid": "6ea1b42e-ea92-4a68-8620-fde73d73965f", "value": 147336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765387022, "uuid": "b97bd1e8-8e63-4b83-af51-8916dc89d799", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387022, "uuid": "b2df445f-0d77-4b09-9893-f5570b59f44a", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7409e89e-d5f0-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1765388916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388916, "uuid": "6af21254-bd26-4dfd-ba13-e4acedec69aa", "comment": "Malware payload (MaskGramStealer)", "value": "cd33a367ff91d16e093af3a003927f5c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388916, "uuid": "a58dd014-8b35-4e30-a651-9dd64b89a3dd", "comment": "Malware payload (MaskGramStealer)", "value": "0cf0547fecacede8b964cf7e05f176ef20558e877dfe01234362ff5ccb900542", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388916, "uuid": "ac895468-cd13-48f9-9ca5-910dba015c65", "comment": "Malware payload (MaskGramStealer)", "value": "f26fdc40151bbe605d4b760fecc0cff08ffca28f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388916, "uuid": "af515c4a-8854-4bb9-97a4-1b5cae0ae1f1", "comment": "Malware payload (MaskGramStealer)", "value": "747bc1e511ae8ebef9b95517289fb54489cbc4139d28f547e1b68ba54bad4ab42c5c083e265357030c40e77911e30a8f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388916, "uuid": "96f18a42-8faa-4050-9a42-5f129a8d54cd", "value": "T103660683B98555B5D6EBF13494906261B7317C2943303BD36FE91A690C3ABC22B3EF19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388916, "uuid": "1e82e7e1-7dc7-42d3-bceb-b1d1093d8897", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388916, "uuid": "2653583c-0480-4ab0-a26e-89b9934c5b69", "value": "49152:K92S308W18pEFEx5woXaaMn8hkT/gvD7R+NbCKK1bVhkT/gvDO:VS306CaB8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765388916, "uuid": "1f471bfb-96be-4399-af8c-30594cb8e69c", "value": 6987392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765388916, "uuid": "89455b06-9494-4917-98b1-600c0b2a5e2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388916, "uuid": "fa321c12-75e2-462d-86ee-930a9c02c604", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ca9e1f-d5ec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765387035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387035, "uuid": "e2b1be7c-fe96-44a0-b37b-dc351faddf3a", "comment": "Malware payload (Mirai)", "value": "7342df56e31a37490465ef2a6130e2bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387035, "uuid": "789d81e8-ba2f-4b5b-9501-42fe8cc92ed0", "comment": "Malware payload (Mirai)", "value": "0d24ee35cf06c1519b2b075ccaf2bf491635639b8756223d3b93c8a3a6afe7b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387035, "uuid": "358cfa02-196d-4119-966d-f72738ce33fc", "comment": "Malware payload (Mirai)", "value": "0823acbb666e9b514689d0e0f5b101ce498cbae3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387035, "uuid": "6eeb49dd-cd08-4bab-b91e-651becb63d6d", "comment": "Malware payload (Mirai)", "value": "3e0b03900d275a0c502681848544b9d2e6333bcad9337ee05f90df40e867024f27c1cefad0c6fc7532bddaadbb1481bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387035, "uuid": "ddd7a278-7966-49f3-b417-b0201f0aba1c", "value": "T1ADD35B0673180E17C5E349B02A3F17E483FEE5D121F4BA89691F9B6A4672E771482FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387035, "uuid": "e9bde2a6-0cca-4992-a5c6-28f51aa213e8", "value": "3072:oWGIf1/UwfhJdU80r/tbYUaDGMsMA9TK+t:oWxN/UUDGVbYUaiMsMApK+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765387035, "uuid": "63062871-b5bb-4e0a-8d0e-e19697ad4ec0", "value": 134840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765387035, "uuid": "79195e9c-b6ce-4d25-b0cb-286dee27291a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387035, "uuid": "f736f1a8-c5cc-4ae6-8934-51b36100be56", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f316f5-d5a2-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1765355343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765355343, "uuid": "cb3cade6-7b24-4b8d-aafc-b10dd44babaf", "comment": "Malware payload (GoToResolve)", "value": "b7231e40ae12fabb67812569963915fc", "object_relation": "md5", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765355343, "uuid": "28a9a986-8575-4ea2-bf67-442c402cf5e1", "comment": "Malware payload (GoToResolve)", "value": "0d48661202d7a48da07869eb9a27d5040328bb05a87c7751222da52ead4865c1", "object_relation": "sha256", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765355343, "uuid": "0b46142f-a6a6-4cfa-b1d4-6c920954f579", "comment": "Malware payload (GoToResolve)", "value": "ebdffb0e2b75167a6be4a10f3c5f4f22dac0aaa4", "object_relation": "sha1", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765355343, "uuid": "c979db38-fe40-4c2e-86a3-24ef70279e0e", "comment": "Malware payload (GoToResolve)", "value": "f605b79a84245e52425327e25b86883a3766f04729a1719d54c04fba26c4d86078ffc9a200afdfb771fb548eec8c6ed0", "object_relation": "sha3-384", "Tag": [ { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765355343, "uuid": "cbe13f51-1e44-4829-b330-6d350447c808", "value": "T1C937332576888133D5AE02B358695BF956A9BC714F3008EB73FCBE586F303D2563670A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765355343, "uuid": "e91a0c30-e48b-4096-b3d9-060ade9d2f7e", "value": "393216:0ubgigagnh//KIaNuar3Y97ap9221WIOUBJyb6lWc0/mMFN2KPH5wRrAhHVvD8FV:nbBjSZCIKrsWede1BkmMDhPHuRovYnFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765355343, "uuid": "46ccf216-ee7f-450d-ab31-049e03960226", "value": 24522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765355343, "uuid": "3d600731-9233-4e46-a6af-94b3b34392e9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765355343, "uuid": "132b1546-786e-41bb-b005-cd7f418c2f4d", "value": "Evite.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8c6db1-d61a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765407019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407019, "uuid": "a8a11879-cf50-4155-812f-84fe166c2faa", "comment": "Malware payload (Mirai)", "value": "ab7f207c38fe7a348878250584892c81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407019, "uuid": "77234aa9-85fd-4d63-b3db-8c7a84869420", "comment": "Malware payload (Mirai)", "value": "0d68e1ebb0d5401b9e4562dcb0bcde2358a3be2e5319a0dde53cdc5ee43adff2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407019, "uuid": "c581ab41-dc4d-48fe-82e3-602a99b33467", "comment": "Malware payload (Mirai)", "value": "724e6c2be9300df94e80a41512f35891e667ce1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407019, "uuid": "a5e7e323-42e1-4230-a114-84999e279a2a", "comment": "Malware payload (Mirai)", "value": "b9ebe39ed6ba417544397e8f50e1e413e8762cf8495f7ab4f5b79a5c77b931b9f6594c46dc20ad4af9cc819fd7f90c6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407019, "uuid": "d1776141-2d07-4af8-be89-cb062ba26fd2", "value": "T1E4631A91BC828A17C6D462BAFA5E41CD331213F8D2DF3217DD11AF657B8682B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407019, "uuid": "a9daa5e0-8d0a-42d8-82bf-6170c2e49f84", "value": "1536:si7W6sC/setrIh8S20HN8VEvOOzzsH6T3bsR:H7W6c/HuVEWQzsH6T3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765407019, "uuid": "e86f8ac3-1c12-49cb-9697-1182512b4dfa", "value": 67652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765407019, "uuid": "b868ae5e-e760-49c8-b95d-225d5ce4094a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407019, "uuid": "fdd3743a-70ce-44e3-8f27-c566efe28527", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a7cbf1-d61d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765408167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408167, "uuid": "c9d44373-0fb4-4231-8e16-a205424caa5b", "comment": "Malware payload (Mirai)", "value": "54eaa2736771921f2f12aecfe4564e7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408167, "uuid": "0b0ce4d4-fd2c-449b-8fc9-32f8513c2282", "comment": "Malware payload (Mirai)", "value": "0e0936040f12f4cf15a2e212d25ce000f3dfb38757683d4456c26d7151312444", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408167, "uuid": "d3963942-5800-4ed9-8656-cb2cb74a3e77", "comment": "Malware payload (Mirai)", "value": "41a26a60ea12f877ae8c2b50ae6aba4a623b5181", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408167, "uuid": "9f227ed0-51c1-40dc-8b1d-a88386f9a571", "comment": "Malware payload (Mirai)", "value": "f70d2eaff3b5de7e6ade78a104623ec9f0c5d3c1686fae34f57f0ca8151c72db2c8c02f935acc98d733dd303812345d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408167, "uuid": "d12003e5-04a2-4e82-bf22-b3c442215fb4", "value": "T1B3534B42721C4917C4971970293F1BE5D3FE9EA021F4B78AA90EBB4E8676E325447ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408167, "uuid": "6095d78d-38f5-48a6-b370-ab7df3181811", "value": "1536:ePagQJ+Scpw1Ky85Z+35faIhThigYFT3bsRf:VgzQFBTgHFT3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765408167, "uuid": "02f07732-afd3-440e-ba9b-58428545eb7c", "value": 65600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765408167, "uuid": "47524da8-6631-40ef-9482-4f39e3486036", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408167, "uuid": "e7572d02-686a-46e1-a672-7ddbdbc9c55a", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35bc5e6f-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350157, "uuid": "a693abfe-ec61-4e7e-ac68-acfc6c69a964", "comment": "Malware payload (MaksRAT)", "value": "cdfb247a019a52047f350ce6b05d5b48", "object_relation": "md5", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350157, "uuid": "83040f03-4181-486b-a1a1-99a048a42179", "comment": "Malware payload (MaksRAT)", "value": "0e6ef2659ee07dc80309719ce06d57240bc97f06385f03fa665969b30a866a3a", "object_relation": "sha256", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350157, "uuid": "8e05de27-cec9-4e0b-8a6f-cbd13a1afc1d", "comment": "Malware payload (MaksRAT)", "value": "0feec1be8a83a47aad823f9b9bb7880d7d0eb74b", "object_relation": "sha1", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350157, "uuid": "c5b3fc61-18cb-4857-85db-1fa79602f00d", "comment": "Malware payload (MaksRAT)", "value": "b76fe2431748d254f13e05e4981e3f986db4a3a9e2cc1eba3ac17bb0348be19ae7971bda3d14943173729bc606454a82", "object_relation": "sha3-384", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350157, "uuid": "bb59d494-6422-48a4-85a0-d2d0ef7b8267", "value": "T1AEE2F1F2AC2FEA98F7FB8C78BD0A01671529C65CFE848593531450583F61161DB907EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350157, "uuid": "a357bd51-54d8-47c4-99c0-37325fad7709", "value": "768:/Uk4xYWluuO2vTZITK+GpSqJGynsR2fQ55OtXtxCG7mhPGVN:94i2vTycSqbsUfu52ywmtGVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350157, "uuid": "7cc44b1c-c722-4f37-ae18-b39296605209", "value": 32608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350157, "uuid": "f0e72579-df16-4a0d-84a0-41fbcd54fce0", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350157, "uuid": "1b308f18-cd79-4d10-8312-8fb710d6675c", "value": "0e6ef2659ee07dc80309719ce06d57240bc97f06385f03fa665969b30a866a3a.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4384ca23-d598-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765351039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351039, "uuid": "84bca3c7-ca52-4674-b36b-5c4c5df88613", "comment": "Malware payload (MaksRAT)", "value": "a18d24e132f092c2ce43422a335f4bfc", "object_relation": "md5", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351039, "uuid": "2da0baf2-06d0-4ce1-b730-9a4d79d09136", "comment": "Malware payload (MaksRAT)", "value": "0ed7163b51a4eb62ce4f4d726da774ba9cdf8a9b28ae231086872f7bda399552", "object_relation": "sha256", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351039, "uuid": "d5283746-1555-46d4-a6c1-9e6d331917d1", "comment": "Malware payload (MaksRAT)", "value": "2ed1898a40ad25bf966d24962f66cae7855182d6", "object_relation": "sha1", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351039, "uuid": "31593382-f0d3-43ea-98b6-ae56d4e023fa", "comment": "Malware payload (MaksRAT)", "value": "2facb88ab40cada0ea1ab800702da848aa1b963b8df18d81a87f439777305ea62aa8723316853a6be3453d3796d0b7ca", "object_relation": "sha3-384", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351039, "uuid": "4b4b4fdd-3c45-47c7-a31e-ddb81d0da5ee", "value": "T111F2F15982795A44F09FADF468377B9D1358A45466CED25081F3A0FA4FC7C1B6C9B802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351039, "uuid": "d5625500-3673-4f71-8199-919e4107de49", "value": "768:+p4gDbOgNnZApSEVPESRY2x6T4QqiH0BO/HlycebhbiHfXErwT/t:+DSgNnZA4ARYTcOs/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765351039, "uuid": "ea1836f4-d54f-4b48-8048-fddf59a256a9", "value": 34770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765351039, "uuid": "4483a283-a331-46d2-9d9d-089e529b5875", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351039, "uuid": "bfb75d76-23e4-4290-8e59-5f933ed3ef2f", "value": "0ed7163b51a4eb62ce4f4d726da774ba9cdf8a9b28ae231086872f7bda399552.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9d0f46-d57d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765339570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765339570, "uuid": "5b291bc1-79b2-44aa-8575-d498383e2b6f", "comment": "Malware payload (Mirai)", "value": "0fa1e8cfd9226ece92ca1b37d2531fea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765339570, "uuid": "74567aea-6c52-47c4-830f-ba8ee62afccd", "comment": "Malware payload (Mirai)", "value": "0f0113faa5483a42c67b987c72576abbd5f47b876972bcd99f1f76756a09e37d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765339570, "uuid": "8c740e3a-9dec-45d9-9907-60668da361c1", "comment": "Malware payload (Mirai)", "value": "241ff78d80825e74d125a4ae75b6531afd67c6ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765339570, "uuid": "7e9c17e9-8d77-486f-b7fd-998abbb33f37", "comment": "Malware payload (Mirai)", "value": "8d0bc195c4bf87c428abcca6ce12683003f028c65804985b25f7ffc0db9bf66680ff81f1d27ede4bb794a8c6aa135398", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765339570, "uuid": "410f457c-c7f7-4942-b9c7-181c8decba56", "value": "T14AE3D60E6E228F7DF6A9823447B79F21A75933D623E1D541D1BCD2115E2034E682FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765339570, "uuid": "ebb83bc4-b1a3-404d-b74d-d5bb66ca448a", "value": "3072:iLnI/W5CsWfRdy9BGehweB5hz+WX4MRaW21R:iLn2QWfDy9BGiNjJ+fW21R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765339570, "uuid": "21e19f73-85c2-44b1-b1ea-c20640d4a0be", "value": 146960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765339570, "uuid": "8ccf5ab7-93cf-4fd0-b813-b6889f08db01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765339570, "uuid": "7f10c718-7c81-48f0-96d9-cb64d589721a", "value": "colonna.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b81a43e-d5a0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765354488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354488, "uuid": "c3b6c6b6-a410-4557-8436-04d0ad754e51", "comment": "Malware payload", "value": "196dac7e117671e5856b693325fdd0c3", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354488, "uuid": "ff3d332b-2a78-453d-9b9f-bc15170b8f28", "comment": "Malware payload", "value": "101dcabd820132e104e167619bc9d84084a404cad4bcec29dcd234c0dfe46afe", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354488, "uuid": "905139ed-60f7-4f67-b422-50bac7cacb63", "comment": "Malware payload", "value": "16b96a9fd2f79dcbc0a8c11bdb85f3e594ef72c1", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354488, "uuid": "28cfb374-1fa8-4591-8180-80e747343cf6", "comment": "Malware payload", "value": "07249e101ac21a30ad9c6185aaceb4e9f54f807460a74cd4591607331820114d2bfa136ef1345c8bde63356224173c65", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354488, "uuid": "1052d710-3a16-4f6b-8876-722b656e9749", "value": "T129B16ACA752173728D389D2AF275891BB082C28702334F99766970F8BEFBD4AF550D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354488, "uuid": "ee40737d-cb28-4630-b4d8-81e95f119323", "value": "96:UIuUdbU10lpGxrcfL9BH9pIBVK1ngTXY+EOkbWBQd5Qin:UWXXn92BVK1gTXX3meQzQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765354488, "uuid": "9c265d44-23f2-46d0-8bd3-ea4ad5ab2ee7", "value": 5166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765354488, "uuid": "8b5d61fe-aafa-4cf4-bebf-5c83088450a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354488, "uuid": "5d8ae70e-f44e-4102-a1a2-7faf88f025af", "value": "create.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6479183e-d5b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765363549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363549, "uuid": "e25ec9f1-a9e5-4faa-9745-d93c402d6039", "comment": "Malware payload (Mirai)", "value": "c159b77befd1f6b6a436f6617f0e9edb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363549, "uuid": "7b00cfd3-0f21-41f4-97aa-0e220c1fb32a", "comment": "Malware payload (Mirai)", "value": "103907e6ca47f6bbe07532ba717b2b96cfd763c8e73c9de04745116ee65e9ca6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363549, "uuid": "61785e31-165e-454a-a679-de45882a5e86", "comment": "Malware payload (Mirai)", "value": "6d63e89d6979694673a3ed1cad4dc585d7cc8370", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363549, "uuid": "c56376d4-565c-4bcd-938f-b04916e63a82", "comment": "Malware payload (Mirai)", "value": "509c0913768318c9ec56b8181721bd0274065ef464f3deaf8d31135e3bf4c38b74f55b5be7c4e10be6a16799da4512d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363549, "uuid": "18b27c47-1769-42fc-9821-e1f5c08d99c5", "value": "T1998302C68AB407E5C16E557A2C79E31B405AA13449DF5B84F9D46379FA33FE08CE20E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363549, "uuid": "2634fc27-7f55-47e7-b345-69e15b32e95f", "value": "1536:vW+ret5Kqfj99PoH+8Ujx0WOdiy8CHmQEahRQRz+vnouy8GyT:vW+rq5Kq79toRUYLHmQEaTp/outf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765363549, "uuid": "3fe8d498-e358-4138-8024-b47061a3d9cc", "value": 81700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765363549, "uuid": "5cce9df9-694d-4d93-a04f-fed231b46bc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363549, "uuid": "a7bfcb9b-9a8a-4ec4-ae49-06f13e283bc5", "value": "ecco.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45cb511a-d5f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765392704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765392704, "uuid": "7b46081b-e7a9-4219-9a6e-944759f4f83e", "comment": "Malware payload", "value": "511e06df40375a2f88324f417df2f15f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765392704, "uuid": "66e5a13b-0ad2-4974-abc8-42138308fdf8", "comment": "Malware payload", "value": "10cfbba309590b580be85155fa455626657af18849f672ae36762c6f6e29b658", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765392704, "uuid": "098f49cb-72ef-4b36-8bcc-ca81233cc322", "comment": "Malware payload", "value": "4a2400e52c59f987c75660f7536012afa9b30245", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765392704, "uuid": "f3c243d3-b838-423f-97e6-b3c9ccdac964", "comment": "Malware payload", "value": "de264cee58a2364f65c8a854d1d26fbed5e67ae5a73fffc80585babc1ecfe1d29d9bb7f7746a97f44f2a9ae60cb398f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765392704, "uuid": "e36dc457-2bf7-4fc8-8449-5ebf5306dcc5", "value": "T1E9074B7F76658669C21EC13AC0A38F01E5F370B90B33C6E793A0076C5E5A9E45E3E661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765392704, "uuid": "39b5c7ec-d223-4fe6-95e0-5a18fd588e58", "value": "af9d2a9ada31a7fddb8f17057cae9e2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765392704, "uuid": "ed7d7107-c08c-49d8-9c3f-81611d3f5582", "value": "98304:HLctH1Jqiq8ORMYBY1g62OBWJkKg93UuvjniRzQ4jrgT9o7qdQI:rg1Jo8ORMQYbZBWq9LiVjoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765392704, "uuid": "c1a8f248-c307-4a39-89c9-379e8f591006", "value": 17360896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765392704, "uuid": "ccaf8561-26d0-4e33-95f8-29964d13f913", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765392704, "uuid": "4e2860bc-eb78-4671-8574-4bdabb928c11", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a3e47f-d60b-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1765400408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765400408, "uuid": "1d4a71a1-346c-453a-8a06-6f7e56849bb8", "comment": "Malware payload (GuLoader)", "value": "d0ed0abcf3fa360c725e0dbce00f96de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765400408, "uuid": "873367f1-f090-4a97-b0e2-e3f262dabb8b", "comment": "Malware payload (GuLoader)", "value": "11f392975699cfc7bae3ec4a5cae53d0a16f182038416728b24813d0e78cf3bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765400408, "uuid": "10865bd7-1d59-4b34-ab38-37928c59eb88", "comment": "Malware payload (GuLoader)", "value": "ac45b48bb58fc7f7471c1e2bbd639727e1707e4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765400408, "uuid": "443b3647-b497-42b5-93ce-e1c2840e863f", "comment": "Malware payload (GuLoader)", "value": "59f11b2ac63e4a43f9a9242378daa0b23d83307f1f4f70105a7cc51b304c23fa17cbea30809830e345ebf9febeb56c80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765400408, "uuid": "2ab2e36e-3714-4f1a-a6c2-e48aabcd4c1e", "value": "T10D051201BF24C11BC8729E300DE7D7A1A6B57E2C39959B0B73A8B71D2D762811E8D36D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765400408, "uuid": "031e243b-f717-4a4c-b50b-de9f43ef4d6e", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765400408, "uuid": "98cf0cfb-a6d8-4b6e-8cc8-d10d25e9d2e3", "value": "12288:pmdBoBJIEIoCoVbFPy1wlbtjHbKeOCa7JFBg9azzatENpZ9Z6r4st2vw:yBoTIEDr7Py1wPOQa7RgQz0+NZya4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765400408, "uuid": "898aee90-90f6-43c9-8a44-8da63c2a9551", "value": 799672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765400408, "uuid": "678fcc39-7d2a-4beb-abfc-0fce50817e02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765400408, "uuid": "a3169481-7852-4372-bd15-43609ece9fd3", "value": "rdiciembre_2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff5415d-d598-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765351033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351033, "uuid": "5ae1ac85-38b7-4e95-b438-6ec770389fa5", "comment": "Malware payload (MaksRAT)", "value": "79337c698dd3b2cbdbd1ed0b9fac2b2e", "object_relation": "md5", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351033, "uuid": "224450c1-b5ee-4d0b-bda2-296b8c86a202", "comment": "Malware payload (MaksRAT)", "value": "1292e60b0894c0d4a95a9a44fe102d82f1a9bf1864e6dbd934b2cbff83b3b7a2", "object_relation": "sha256", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351033, "uuid": "086f88f1-e259-46b9-aeec-779ea3c6154f", "comment": "Malware payload (MaksRAT)", "value": "c6aa2753ccb9212a9a5f897d932fef0a7a224925", "object_relation": "sha1", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351033, "uuid": "5170872b-a2f6-4c34-86ee-c3190443a9ce", "comment": "Malware payload (MaksRAT)", "value": "9e37333afc16bf019c2101e519d6e3aa21325f93715646bf0bb653f2070d95bed5fb413e402f3b4a984fd2db68096132", "object_relation": "sha3-384", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351033, "uuid": "d9d44bf1-6b57-4c8a-9468-22569f979362", "value": "T180E2F17F2D3DBE2EEAC53373417161B2794F57C4AF55804289F3C2100560EEAAE874A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351033, "uuid": "19f1ef95-7799-41c8-88d5-1264d82f636b", "value": "768:oWNAmSw/bmnt2v4iGAqjX7UqnAe1kuXH8yI7r/3YW0tY9h77W:oV1UiovuX7UqnF2uXI7r/79V6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765351033, "uuid": "d2079705-5fd9-41f2-b6dc-352f25eea1aa", "value": 34232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765351033, "uuid": "c45ae6a7-58bb-4761-9e16-703817ae665c", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351033, "uuid": "5248a188-35c6-4ad5-a2f5-82cab4f40799", "value": "1292e60b0894c0d4a95a9a44fe102d82f1a9bf1864e6dbd934b2cbff83b3b7a2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329c6a67-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350151, "uuid": "dddafe69-d9ef-4f46-b052-b95561a2ded5", "comment": "Malware payload (MaksRAT)", "value": "59e78a6689089db8323b129db51fc304", "object_relation": "md5", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350151, "uuid": "f21dbd54-e3aa-483e-9771-7196bf99f71b", "comment": "Malware payload (MaksRAT)", "value": "12d4d1cbda16674be7884fc906132ff16b0b8d533b700c11f3f06cd3f4733d54", "object_relation": "sha256", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350151, "uuid": "17b7b683-47de-4b34-b1cf-1502135af76c", "comment": "Malware payload (MaksRAT)", "value": "46c169ddd9ad55c640b766f46f505731f5a29cc4", "object_relation": "sha1", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350151, "uuid": "a80f1dfb-aa00-4d28-b46f-1c6f66ac1f53", "comment": "Malware payload (MaksRAT)", "value": "13ec4e2f11665a2e50828c445c71387026f18f7ed8b2f51d89de8a60df0015347925b64e7ecabd0ee35ee812a350767a", "object_relation": "sha3-384", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350151, "uuid": "e7376cba-9d9a-4b96-8153-d5c317f1df42", "value": "T15692E15926705C24F892B176B3CD2107EF4F4FAC4A09191A36259ADCCCE477E0B23BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350151, "uuid": "d59b04e7-98cb-4d90-bb25-119066b26307", "value": "384:6ncZfTFhC+hDS/2XOztN5ooYZ6zw6cuW/EjVySB0Dxbl2VQ9IJy7hX:Q+TF7m/2XOJwoYZoJz/Slbl2Vg7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350151, "uuid": "db868be6-7fe2-47fb-b835-e204c568c8d5", "value": 19817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350151, "uuid": "f5651078-6a0b-48c1-b7e0-94fcdbb66ee8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350151, "uuid": "fa3e1456-f10a-4bff-97a9-1c31db98c20c", "value": "12d4d1cbda16674be7884fc906132ff16b0b8d533b700c11f3f06cd3f4733d54.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea491b83-d619-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765406724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406724, "uuid": "cfc367f5-8735-44c5-9257-86c64d7497d5", "comment": "Malware payload (Mirai)", "value": "df16aca73a2b1d25904b635224d128d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406724, "uuid": "476728ea-0540-4adf-bd8f-9643a07dfc27", "comment": "Malware payload (Mirai)", "value": "12ed728c1361a4caa2de6e311be99b0e713249cf0aad940a971a4ac7704e3900", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406724, "uuid": "6d22ff20-e817-4c19-8291-7579457d6683", "comment": "Malware payload (Mirai)", "value": "8de6b5c4104bfa3d2cf505cc9b9c75df34eced5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406724, "uuid": "badf1482-2206-4352-ae78-314c4c534031", "comment": "Malware payload (Mirai)", "value": "ea7c547c3b371af0b17f3530908b75fcb012e5eae3d40375fb9dc13f22b68ec90ee14f80a2f6478e82d471f2e24d4377", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765406724, "uuid": "54c010d7-4e2a-4c2d-8329-beaa9e017b3e", "value": "T1F0432BC8A503E9F5DC1909751472F3335A36F57910B9FAC3EB94EA327812A51B90B2EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765406724, "uuid": "2008105b-c978-48b8-b4b6-ff18449881ac", "value": "1536:YtnykkjCvsMg7OEJNiDpswOz/XAQW0KbVW16WqFLmaQR:YtnHKCvs57OESlswQAQW0KbVy6x5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765406724, "uuid": "63aa540a-25ad-47f2-9160-bba96ca18be8", "value": 60212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765406724, "uuid": "88ce22de-df59-4d8c-a50b-03fc3baee179", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765406724, "uuid": "82ce9f60-fdcc-403a-8e43-b446cef8cdbc", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d024961c-d588-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765344403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344403, "uuid": "1475ffb3-2fd8-4698-ad7b-4789213f0839", "comment": "Malware payload", "value": "7a63e325353f99fd1e4b25254a4db385", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344403, "uuid": "85628fd5-d9a3-4226-9a6d-ab97a8951395", "comment": "Malware payload", "value": "1382758e83dc6a35d204fc44aa2e4f9e4cccb18df4b98e1c6de7d5aa1b0c4290", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344403, "uuid": "34c6e7b2-6f3e-4c88-b141-4503dad5b9d3", "comment": "Malware payload", "value": "01ccce7ee53eff357ec5ac3c227a75ab6f8a26cb", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344403, "uuid": "f53f47bd-703d-40a2-a8e2-04a5831f10d8", "comment": "Malware payload", "value": "a7859fd9b0fd123198a4d6cef7dd9d18ce948f35111313a84cacbaf32121dcd933f1719cb235e16b5d182d66f0668c1c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344403, "uuid": "a93a85e4-cbe6-4ab1-9a3e-cade2feafb5c", "value": "T1ECB175562D87921509B0C3B6BF2C02D0EE2D53EF532166D93578E6DC2F2A0D7C1EE58A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344403, "uuid": "b966b0cf-90e6-457b-a0e4-f84ddfc1978b", "value": "48:tX60UjZjZCjbheIVh5O6d4Mautztqzzjm1KqwjA1KfG41POj8mrZcR1KRYA1Kzwq:U4h8eBLQCsG808mrkcn42Jpb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765344403, "uuid": "25a48a66-ef3f-4cd6-8800-78fc57d1aaeb", "value": 5335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765344403, "uuid": "e04e8d3f-a9ac-4fa3-a3b0-979abd18f939", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344403, "uuid": "bee718ad-e131-46ae-bbc0-831b58840744", "value": "Phsep30.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9164e277-d602-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765396696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765396696, "uuid": "4351e33a-50ed-455a-a0d8-96942fa856b1", "comment": "Malware payload", "value": "9784bc8062f39036b693fe3c27db7d1e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765396696, "uuid": "8af6792d-53e7-406d-98a5-7ab9c78439d7", "comment": "Malware payload", "value": "13d6ed38714c68446cc9efd2c7806cf50429ee06171702a80633cd67c62d9ab5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765396696, "uuid": "6a1ffbf7-ceb3-4f05-84fe-4e9437e7737a", "comment": "Malware payload", "value": "ff9f383b2ce7891faf13bdd7ffdbb4072f1ca1e9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765396696, "uuid": "8360b6cb-1309-4abb-9fa1-b7c4be07a43d", "comment": "Malware payload", "value": "540ee64bcfabc51e31f45d160747f81adb196e1791a6d8b14eb4b0e607bd691f3adfb5124f6d1dd1bb6968ce5a955569", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765396696, "uuid": "afc005b7-7442-437f-a3a6-1b422254e795", "value": "T1242473597E9F5270838BA536A11F8C0A9ADC5907150EC4803DADDFDCAF156F1B2BA3E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765396696, "uuid": "242f7e5f-5869-4b9b-9cc9-0d06cc9c3736", "value": "3072:ShAfuase+/MeAEsrZAU71dBLJto69vgaUqu+9wiOtpQLJHtSM:ShASe+/sYJkNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765396696, "uuid": "613962f9-f253-4d9b-bc32-cb28831c10a7", "value": 210836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765396696, "uuid": "c648ae92-2239-4d36-ba81-732efb546f5a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765396696, "uuid": "f6e8f92b-428f-492f-9082-ad81ac7cded9", "value": "Office_Dataset_Monthly_5.jpg.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a674325-d5a5-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1765356526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765356526, "uuid": "ac187f32-4cce-4798-abc5-c73a9793e846", "comment": "Malware payload (a310Logger)", "value": "b32347cfe951b2ccbbffff1d2589c79b", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765356526, "uuid": "31a508dd-4d21-4aeb-8997-e8ccee5a834b", "comment": "Malware payload (a310Logger)", "value": "143e93da90a245d161844bc17c5751cee5fbad7fe7968684052187fad54dd75c", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765356526, "uuid": "92acaa45-acb1-4104-8523-fa5c28175b4b", "comment": "Malware payload (a310Logger)", "value": "c3e306918f4049227442cff080af02e8e93f42d7", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765356526, "uuid": "e1e1192f-37b3-4654-9028-a73ea6ca40c0", "comment": "Malware payload (a310Logger)", "value": "51b3af4f66c48e5e4f577faf1ea3482a754be14a848281cb101b330046d11426e396f8bb98d322c686b9773bb192c755", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765356526, "uuid": "f11b51d0-20e6-45b8-a47e-b4f06c5e6df3", "value": "T1F855CF0273D1C062FFAB96334B56F6115BBC79260123A61F13981DBABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765356526, "uuid": "89436ffb-070c-4164-a59c-64df8cffbae1", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765356526, "uuid": "48843ea1-ee2c-4569-9257-6a83bf815cdf", "value": "24576:J5EmXFtKaL4/oFe5T9yyXYfP1ijXdaCPXR+CAW4cHmXNhwokGX6:JPVt/LZeJbInQRaCPUmW/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765356526, "uuid": "bffa2c09-495c-4d41-a7b5-4155c1f3dd68", "value": 1342464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765356526, "uuid": "51a58a7f-c1f3-4817-842f-083e387e338a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765356526, "uuid": "03bcbd38-b8bb-45de-939c-9ca0c383500c", "value": "Purchase_Order_DG25-1208.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88adba25-d5c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765370482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765370482, "uuid": "bc383573-1b71-439d-9ae6-3b7aa3ade6e6", "comment": "Malware payload (Mirai)", "value": "114679904fab01ae4d0c103e73ce75b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765370482, "uuid": "c3ba6067-4cf0-44e9-98fe-6e2ffda11310", "comment": "Malware payload (Mirai)", "value": "1479bc8561c6b4249887c8fb3b0583a6926b489b527e3b5ed587e218db633db7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765370482, "uuid": "8c0f4e70-1ff5-42cf-b4d6-6b4977910433", "comment": "Malware payload (Mirai)", "value": "11cd9481e47d54916b0cdb46690ad912bec01b57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765370482, "uuid": "975bb915-10a9-4c9e-bec7-029e3e7c1198", "comment": "Malware payload (Mirai)", "value": "468f715076e64ca7262598bbf1b486995e813a029b1d75b972cf5e20dc960248b7b0bf6c61cb35bdd737f3eaf2c12aa4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765370482, "uuid": "5ed70b02-eda8-4cb6-bad7-fd35c620a4d8", "value": "T14A442946F8819F21D5C016BAFA2E114E332717F8E1DA72028E245F757BCB85B0E7BA45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765370482, "uuid": "af7e68ed-53c5-4664-a490-7468b774fca9", "value": "6144:4Uh6A5GKaby3hr0ZS341GszqJIHWdkrSxA/+LlR1aF9kBXPtla0HlguN//WZcy:4UhX5GKOy3hr0ZS341GszqJIHWdkrSx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765370482, "uuid": "50dc0c34-9238-4b42-a138-2481babd7897", "value": 274716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765370482, "uuid": "f45c29c1-55f6-42ba-a7ae-ca10e6787440", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765370482, "uuid": "25fe9430-19be-4849-921e-b02bc2a74467", "value": "ecco.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74251d7c-d60f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765402230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765402230, "uuid": "d7bdc9b3-1e80-4246-a302-7816806cc196", "comment": "Malware payload", "value": "7161fee0ccd8836e4502e0ae112d769a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765402230, "uuid": "0ef58010-e37c-44d6-8e94-318666ee8be2", "comment": "Malware payload", "value": "15c6cae1e39e87915ec208a115b4191327057028546e2727351edad63ba41f59", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765402230, "uuid": "beb9a812-a02f-475f-98f9-ccb4b7e4904a", "comment": "Malware payload", "value": "ac859c0b24e45a66446da2e505310b3a03b7bf71", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765402230, "uuid": "b018569e-87d2-4e41-b12e-a82733eff405", "comment": "Malware payload", "value": "df9235bd6cf878688b3046c532ac70b5772b751cbd964d4282416900ecdaad6e9663cd39051fc0c6a8d61615d328a79f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765402230, "uuid": "c4e81acd-6afe-4b0b-9941-8672c9280d9d", "value": "T1945506796550D259FE3880B940F6965EB130723286712BFB0160E263EE1B5F1DFC62EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765402230, "uuid": "f758dddb-786b-4829-b172-0f3e957c9b82", "value": "dbfe5404d795f14f30cad00e83dfa47e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765402230, "uuid": "2ea6bbc9-d791-4973-b274-5e5854ceab82", "value": "24576:Xu91Doyv6Vzku2zQMGk0RAQMJiqMx3kmP40+6XjPF1IadcelPTJ3jvrNhp2Uok:ZxxyQM10ud2LA01X51dcelLJ3/p5ok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765402230, "uuid": "3234164f-31e3-41c6-b4f9-3a2920dda61b", "value": 1353216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765402230, "uuid": "fcc9d8ef-4417-4d83-839b-56b078bd0cf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765402230, "uuid": "176a1560-64ba-4752-b787-07c4cb4cc556", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46e0760-d598-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765351255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351255, "uuid": "5504d75a-5777-4aa1-a76f-60b426637e29", "comment": "Malware payload (AgentTesla)", "value": "ed592fcfd80d447002c6a85e0cf5d2bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351255, "uuid": "058158cf-a7d3-451e-9e4c-654da8870e53", "comment": "Malware payload (AgentTesla)", "value": "16246bc6456c174b57caa496f69f354c84b28e231b821cc1cf30e2bcda2cc761", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351255, "uuid": "eeee13dc-4bc4-4f91-ae88-56ed87499d9c", "comment": "Malware payload (AgentTesla)", "value": "f35522fcec3c513e19f5f573d12893a693afece5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351255, "uuid": "13068a23-8e52-4a60-a6dc-f25ba1624be7", "comment": "Malware payload (AgentTesla)", "value": "9aec9e486d16576fc6b7e56c78235b5fbbb08bb498d1d5e95533e6675ccc4823ea4f43e6d4ccdba4f46d7b623d381c68", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351255, "uuid": "0cb6373b-78e9-4b35-8467-7e63d9ccdaf9", "value": "T10145BF0273D1D062FF9B92334B5AF6115BBC79260123AA2F13981D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351255, "uuid": "b442514d-e88f-41fa-9b53-f80380512627", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351255, "uuid": "91d9f41a-8daf-4d5a-95ba-74a70439d9cb", "value": "24576:75EmXFtKaL4/oFe5T9yyXYfP1ijXda7MXsiArakVRlM1R:7PVt/LZeJbInQRa7OvaRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765351255, "uuid": "e213fbd2-e014-439f-87f6-c058d21ef303", "value": 1249280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765351255, "uuid": "8cf1fbc9-e51c-466a-b2d1-1651e1ad1cbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351255, "uuid": "8d02077d-4a1a-471f-bc58-6e6168ab3f78", "value": "7410538200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573452eb-d622-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765410342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765410342, "uuid": "d641709d-0653-452c-95dd-da3d77635719", "comment": "Malware payload", "value": "8948d6202d826a33fe360e00c7700c26", "object_relation": "md5", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765410342, "uuid": "5a522cd4-2e4c-43ea-b4b3-18af0ee9d4c1", "comment": "Malware payload", "value": "19322de6b761f40423acd23ebe76d72690003f742e2cbbac7773363e785c6821", "object_relation": "sha256", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765410342, "uuid": "aae3cd8b-9a57-4598-a419-df6a2d886a90", "comment": "Malware payload", "value": "fcb06dbf0285171e1b314a37cbc07cd3fa8ea5bf", "object_relation": "sha1", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765410342, "uuid": "a9d275d1-67b9-49ac-93e3-dd5e0bb40b0b", "comment": "Malware payload", "value": "03402dedc300bef62369347beb50f4d1cac84679a50d63a40393f28c37cb0551535e69afd41223d6b92083241251990a", "object_relation": "sha3-384", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765410342, "uuid": "428f850f-5746-457e-a085-e35d8380f752", "value": "T1BCF533645BE74559CE138AA532EDAB20F3D537CC03EB2379DECBC82A550634868D16CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765410342, "uuid": "1061a2ba-522c-4fdc-be34-70fa004e010a", "value": "98304:dnGcu2B88EXb5IWxc/cJnUP3O4+ab6Q+fb:BGxXLucJnn7bfb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765410342, "uuid": "50c3865b-6524-4f9d-9c0f-4e729b71256c", "value": 3433510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765410342, "uuid": "b31eeb68-2ba5-40a1-b3a2-a3494ea3363f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765410342, "uuid": "d0ce6159-4520-4582-aa01-111c67821e5e", "value": "8948d6202d826a33fe360e00c7700c26.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af648b4-d605-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765397920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397920, "uuid": "ba982fe9-386f-4283-9bf6-2385bfa32f1b", "comment": "Malware payload (Mirai)", "value": "73f0f44f4189aa9e74d1ceee3d92f6f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397920, "uuid": "9bbd7e92-ec99-4245-bb20-5ead4103a30b", "comment": "Malware payload (Mirai)", "value": "1a6d76a78bfaf4d04fab8fb25c42a0ff9999bf908fc28f03dc6623b5c47e007c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397920, "uuid": "435afc5a-e90b-40ec-bb56-bf2c7752aae0", "comment": "Malware payload (Mirai)", "value": "c4e5365e4d04ff39b6e9a176391f6c10c156f00f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397920, "uuid": "ddac6fe9-e00e-4e8d-a98c-e1fbf3249f3a", "comment": "Malware payload (Mirai)", "value": "488d98ccf56999f96e712dcd5a1461e3f91acfe10d6ac648213bcf93e550e436e7f6ff261ff335e3229328238fd26a8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397920, "uuid": "b600ba17-2034-4a3c-8986-5b7f3cfc52fa", "value": "T1C403E1A3D37D29A6E11517F028B93D4B498CE62D19C6E1232FC4151E3696BB8233D3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397920, "uuid": "35e9475a-3acb-4431-ab52-8994da037d01", "value": "768:aZuGsWdbrrfQf0Q3kZld+lrAscDYwHgnbcuyD7UtQRjg:a81kbrr4sWmldarpcDrAnouy8ty8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397920, "uuid": "cbb521f7-31a2-4d46-96a2-4bc256a5a9dc", "value": 39372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397920, "uuid": "3a3b172a-6c1c-4c81-a475-8b0d443ff5fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397920, "uuid": "1f5f4988-e08d-4f75-bff9-9c59b98bc4ae", "value": "Labelloperc80.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311fce17-d5cf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765374630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374630, "uuid": "3d3dbe16-036a-452a-b725-7b0cadabcad0", "comment": "Malware payload", "value": "75245a9be77dc6014e079cf249a98ab3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374630, "uuid": "381f0a82-6a9f-4226-890c-49e19a0146ff", "comment": "Malware payload", "value": "1acc44199d82bc58fb788c4db6f1edd18744060b1e5666023c683c074fd1ebab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374630, "uuid": "6d1cd47a-3d07-4b9d-af60-49c43845311a", "comment": "Malware payload", "value": "c0d129b836490e51307cd6e911e559f805dc91ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374630, "uuid": "5908dfad-6543-44f7-b401-0e4fd05ac1e7", "comment": "Malware payload", "value": "bef3299c96b2e2d5ee5f4a509ef0257bd9cb66951fa386fcb34298123aabffec7e490f36d948a10439f4e2a801a1b4b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374630, "uuid": "12b07296-b3fc-40e9-9b48-8aea057be85a", "value": "T188668C00FDCB40FADA431E3005BBA26F57315D054B25EBC7EA547F2AE97B69A193224C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374630, "uuid": "c6ede625-fcda-4c05-b437-c722ad51881b", "value": "98304:Q4JMI+NggNJncXux2cFmWYwmyTlWOmHy2vnFNb2s5PUJ0c4:7FnDqWyaMsc14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765374630, "uuid": "0229e439-7195-4e9e-9b23-a1e7c6e5df51", "value": 6930628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765374630, "uuid": "74b3cf5f-526c-4b91-9082-ddeede0b571a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374630, "uuid": "4c11355b-f30b-4eac-ae4f-4ddcc9c50b03", "value": "813b69e1ffeb70cdd5a63a8103a896d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8118e61-d61b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765407498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407498, "uuid": "9a5d3b5a-7491-497e-96a5-9246e65b0d86", "comment": "Malware payload", "value": "64ff7bfcea29963681fa0017f3811983", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407498, "uuid": "4b6ad9c3-3d10-49a4-9a34-7b61a1363315", "comment": "Malware payload", "value": "1ba43b5fc228be721cb57394e2d0999ddbbf34d0cb4c00998bce241eb41c546a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407498, "uuid": "dadf8c0e-e902-4ea8-9a46-ed7b6fed841d", "comment": "Malware payload", "value": "2f138f18d57a8f5633b952ea5abd6074459bdae0", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407498, "uuid": "f095e9ba-bf47-450c-b49d-8580ac144e7f", "comment": "Malware payload", "value": "8ac8aa0a05f39be690d8ce3837e35ceb0dd1ad5a0661b527deaa9806a3b17415c41c752340c875c464fb125aaae77391", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407498, "uuid": "e38afac4-5903-4836-acc8-f4a85b9f38c4", "value": "T1DD53F11609A1836ED571CC71B9C526094A73F8AAEB31EB29484E66434FC3C3E351D73D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407498, "uuid": "65f2787a-a3fe-4134-a9c6-1a35f05ba980", "value": "1536:jafW6pTEZ43eXLsOqbDmm/JG/W0IstFBWIor:jeW6pTE+OZyDb/JG/iSFBWIor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765407498, "uuid": "7da952ae-819d-4fbc-89da-6458e7ed97ef", "value": 61613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765407498, "uuid": "ae98fdbe-b949-499e-b887-5579115eb536", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407498, "uuid": "2b7c1d5e-a99d-40f9-8fda-c6a2054742fb", "value": "Mandatory_Compliance_Notice.txt.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e73e6e-d600-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765395623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395623, "uuid": "169267fc-3948-4e6f-99c8-50e4187de702", "comment": "Malware payload", "value": "bf2e34556bd026025d7f02b0bfb8e18f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395623, "uuid": "3f3480c3-c2e5-483a-828c-7b0a00294580", "comment": "Malware payload", "value": "1bcdc03a0711b797eff150f7397190301b97c90224128cce41c01023eccc6533", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395623, "uuid": "eb429831-603a-4f35-9059-a8fad17ea878", "comment": "Malware payload", "value": "4d42ed1adfdfcee6f0ae95007038817cb15037c8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395623, "uuid": "55f1e446-0909-4f3d-89aa-b9652326ab82", "comment": "Malware payload", "value": "c09510225202116e9009352b3123592e8482d86c99a0aed57771dded137626097edb472e58113695c33e57516ef55e8b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395623, "uuid": "a5920653-9791-47c8-93d7-f50ece422661", "value": "T123E63386A29008D7E9F6967AC592A325E5A2793B0F81C0CBD77CC7651F233E45D3BB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395623, "uuid": "33125587-fbff-42ea-8fd9-0771e3c23740", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395623, "uuid": "2ea757f3-cbeb-4c7f-a9cb-3b26c5ed2bf9", "value": "393216:d5xUaj85vzasFl7dCR1C99OXlDfDgvc6wGZQmUzCFxbH2:d5xg5vzJFlUR1OOXlb0EnClPxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765395623, "uuid": "3fccb354-5ff8-4540-b677-3c736244ad4e", "value": 14932230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765395623, "uuid": "98047626-63b9-4447-b824-33881a40c042", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395623, "uuid": "89f0d559-d4cc-4e41-b408-ddf6a23a0c72", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8473a6-d605-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765397980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397980, "uuid": "b06361fb-48ac-4607-bde1-851fdaf46fe6", "comment": "Malware payload (Mirai)", "value": "4f4b293bf8650d51b0daaac8f6bd9d54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397980, "uuid": "b710a8b3-4ff2-4432-bfb7-36a50453c7b1", "comment": "Malware payload (Mirai)", "value": "1bf27e0f49730b9719b9eec75f34021b24ba97e4433cb611e2b63dacb3eb6f37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397980, "uuid": "dd672fc8-5f2c-4549-87a5-092e5c4cb94e", "comment": "Malware payload (Mirai)", "value": "87ab649efb343f01f4d95800d015d09397014d65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397980, "uuid": "21b2e7df-5183-4a1b-b0c6-7542284b99d1", "comment": "Malware payload (Mirai)", "value": "31d0a00c58c93e6df69bb22e48d6d5641aaa43df952496d8265c6b72700186d995ce4decd14ba4928232b72f24941cc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397980, "uuid": "ff8ef04e-2f89-4add-a2da-62368609917d", "value": "T1D7042B46EB418A13C4D227B5BA9F424533239B64D3EB730699287FB43F86B9E0E67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397980, "uuid": "bc0f181f-e2b4-4e2f-acb8-5c2935c00f51", "value": "3072:bVLzMPFafW1L4Ra1QJLPJ1m+5rmIQYpTda3IWSFbyM/9WqHOU:ZLzMPv8RamJLPJ1J5rPpBa4WSFOM/9FJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397980, "uuid": "9aa62111-4cdc-4be0-ab95-fa0e82a5e77c", "value": 177827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397980, "uuid": "031c1e14-735d-4a48-9ef4-2a1f6ff17eb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397980, "uuid": "2524bf14-effb-4023-8945-9511ba989ff5", "value": "Labelloperc80.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbef4669-d5ef-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765388661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388661, "uuid": "26f9d9be-a8ce-4489-af8a-64836b7da957", "comment": "Malware payload (MaksRAT)", "value": "2a9adaadeaddae6113086fdbe8f58338", "object_relation": "md5", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388661, "uuid": "b9f4c4a6-8e7f-470c-93c5-222894b6d55c", "comment": "Malware payload (MaksRAT)", "value": "1c2a5ac37d71f32da4baa9054dd92837a6079044b0d5eab50480c754285b4f63", "object_relation": "sha256", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388661, "uuid": "0da42d30-821c-4862-b246-5ab261d9bfb4", "comment": "Malware payload (MaksRAT)", "value": "40b4832287d1ce47705b84403f954e72cade6a93", "object_relation": "sha1", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388661, "uuid": "1adac870-1e80-4138-bcb9-d7517eac7e38", "comment": "Malware payload (MaksRAT)", "value": "dc81b83e0053621331eaa83f37c83b948babbd93d157fdb211ec95c0843f2499dfcb0bd30ef2aaa54f1cc1b673cc1a5b", "object_relation": "sha3-384", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388661, "uuid": "fc8d4548-5273-4487-bb0b-4e877422bdeb", "value": "T18792C11C0D97FCBCC296163791363063A464C65DCF3ABDDA097680191B983514767ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388661, "uuid": "5b1cbc5d-da8e-4283-b437-1d292b8f1a52", "value": "384:xZ/kT1nZgFG9zdtHeFVdnvM68c2GVUqhI9/ALzxWlK6vcUb2XOdQHJ:Pm8EzdFeDxMxc2T6kf/yXJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765388661, "uuid": "2339423f-bb86-453f-9ea2-0759af59e397", "value": 19659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765388661, "uuid": "17c4bcd8-da48-4ed2-abb3-69965ab063a6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388661, "uuid": "a903d370-5d2f-45e2-abec-8f925bc75701", "value": "1c2a5ac37d71f32da4baa9054dd92837a6079044b0d5eab50480c754285b4f63.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f61214f-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350146, "uuid": "ba3ef228-b797-4362-8a32-ac55f5a7ccc9", "comment": "Malware payload (MaksRAT)", "value": "9f326cde9bfc7e7c91df0cd3c678fc51", "object_relation": "md5", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350146, "uuid": "2ed989b9-8703-4d53-a47b-dd6b71e51d5e", "comment": "Malware payload (MaksRAT)", "value": "1c4a2a90b4e10f7fcb0cc513716e2a6f68dc26986a999b14c81191e2854cd713", "object_relation": "sha256", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350146, "uuid": "b3b10df3-04be-4ca5-a500-214f5def7af9", "comment": "Malware payload (MaksRAT)", "value": "e2b5c5cee69258bac5180ac9b1541bab0546d199", "object_relation": "sha1", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350146, "uuid": "05af450a-f629-4297-af0e-cb1268d3285c", "comment": "Malware payload (MaksRAT)", "value": "62b9f79055b53950bfb7ac2efa509e5ceda0bd41ecba6c0938a10d1fab79d493e16485d576be8ca256586de07aa4e700", "object_relation": "sha3-384", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350146, "uuid": "88cb10d0-562a-48fb-acb8-1c3822558e4d", "value": "T107E2F1167E655A60E3E7EAB046CED54BF36232C9D8BCE09732E0157693081166F03BCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350146, "uuid": "28c514d6-9b0d-45ce-ba17-4dd4957a05db", "value": "768:w0xlOXtVHZR6oVfOLv5TmVeRRE1OfI9z3BiICSBJGGE:w0LgL5R6oROkVeaOfoBiICz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350146, "uuid": "82d91953-b878-477a-9f4a-303305c6911d", "value": 32207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350146, "uuid": "1bdb8187-8d4c-4cb4-9fef-991fa79b80dd", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350146, "uuid": "ab7f577d-71eb-489c-bc34-03fe3d42725d", "value": "1c4a2a90b4e10f7fcb0cc513716e2a6f68dc26986a999b14c81191e2854cd713.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a0b2c0-d5f6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765391333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391333, "uuid": "ca64c5a1-b83b-435b-affb-75bb4592ba39", "comment": "Malware payload", "value": "58194c4730c79d9dc629201ecb54f350", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391333, "uuid": "07df7537-ac25-41cf-a374-724bc068287c", "comment": "Malware payload", "value": "1ca1116a6f285f91959c4c7f46620be1086bec0a8da5444839b300eae8391120", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391333, "uuid": "5b903906-4e02-4396-988f-66ec49bea3a7", "comment": "Malware payload", "value": "33e1054121a3f9465ae886f86119b8685a1483a8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391333, "uuid": "192117ff-5506-4f53-ae67-54297622da5e", "comment": "Malware payload", "value": "22dcb14ece04426b32fd397ced7c4de46ce0e907bf032ae1b25d9813b2376e7f099d6c54cf28ff6c0fcd0d9a6670b58d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765391333, "uuid": "2ba8f154-4462-4a1a-85f0-09633388e49e", "value": "T1D2D16CE11FC407C9C86F2346681BBA310EF5C248C9692E1D3269B6687F6EBF621C119D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765391333, "uuid": "06044dfb-737e-40a2-ac7f-8db679da9c2e", "value": "192:9vi9Z5I0SFV28FajamNvdlYvPgn4fMBLqc:ZQByV2UajnFEYiM9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765391333, "uuid": "70970dc4-7699-4e95-8459-5e5e9dc36b3b", "value": 6220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765391333, "uuid": "9fecdb50-40d5-4a7a-a894-a49301ce838d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765391333, "uuid": "aa44e61b-c26c-49fd-99bd-600fcd7973b1", "value": "DOCS_3311455193797305500178421_239465.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead8a7d7-d5ea-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765386538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765386538, "uuid": "87fd6b98-4621-4b76-a2b3-94d0da93b8f9", "comment": "Malware payload", "value": "d559f01ca16000e4abb74067aaea80cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nsfw", "colour": "#549345", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765386538, "uuid": "a138b24c-18c0-4e7b-b30a-58a1bb82af9d", "comment": "Malware payload", "value": "1d1b08a2f0b09dd0f0a85439d62800bb8c3a3b8dfa0afa9ba7f9c477b8dbd6b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nsfw", "colour": "#549345", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765386538, "uuid": "ab4aa130-1173-4b84-8035-2b8b0dd583e7", "comment": "Malware payload", "value": "18f85228a37500ad2679fd9a21606b0b0ed86a58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nsfw", "colour": "#549345", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765386538, "uuid": "9a15dbb4-9694-40f0-b103-d0412f462fab", "comment": "Malware payload", "value": "cce51ef67b387cb884de3cd545b153e8e94cb09f2ac0284fad3c0d241e3cd1390f99db8ac018e9ad7923ef100c9e4ba4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nsfw", "colour": "#549345", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765386538, "uuid": "e2c11f34-e813-4325-9645-7d8966fd9951", "value": "T172037C04A758C62BD2EF4F7DB8A31A2502369F552703EBC61DCCB4AE68B77400A257D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765386538, "uuid": "2632f64c-eec6-4570-90d1-00a1deaa8557", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765386538, "uuid": "9d7978dc-c62e-42db-9b0a-233de4410b2a", "value": "768:8CIFqb4NqVHdOgnRam7JXbOfq1/knEfPrHoAn:8C4qb4y9OUamZbOTnEfP7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765386538, "uuid": "40b3c13f-6e71-4a66-bc63-271f7dfde8e7", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765386538, "uuid": "c0e3ea92-7201-4f0a-b8b2-8698f7cc4033", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765386538, "uuid": "3affdc79-fdc0-4bdd-ac43-fd0c73810cc1", "value": "3ocng6x.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87688827-d5b4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765363179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363179, "uuid": "637736cd-888d-46bc-bc73-ceed9718bc5c", "comment": "Malware payload", "value": "d407b9db83e227ab4fe7a03286b2c0b4", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363179, "uuid": "0ffc059b-40a7-4d38-bbc8-3e0c5ef73e4b", "comment": "Malware payload", "value": "1d4c120eb9cbac004a605245df580fd4a9ea7a1ed7569bd2d1abbdff6c18f537", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363179, "uuid": "054a2866-2ba2-47fe-816e-b22441dc3da7", "comment": "Malware payload", "value": "9544ae59595f03197b1b3120ccc158d341f359ac", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363179, "uuid": "22db5551-6661-4f74-b799-bc9cdcb1aeda", "comment": "Malware payload", "value": "d7a47da1b46b84c6a402aebab049843ea3a4d1638931ec58fb0357cf4cef13ece271b122914e07e7c3d7558201caebc1", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363179, "uuid": "88a91b7d-9bf6-4413-9136-d48a31281b9f", "value": "T16B24534A49BB84D54B6B7235421F7F8ABD5D2407050D94883ABDAE48FF259FBB03B1E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363179, "uuid": "11386d16-a8e6-4cec-afe1-89b62a4c4dbc", "value": "3072:SrurC9u4dpwsE0ZWYEdkdbfUiFz4F0v+Mh6JaUXuRzalE+CQSSR6S4NndQsbukJ1:iEdhXuRzalEpRJhAZzdCsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765363179, "uuid": "68890986-46a4-41d4-ace8-30a6a1bb0a4c", "value": 215521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765363179, "uuid": "acc1d77a-b8df-4408-b9fb-20f9c5081063", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363179, "uuid": "7e544ffc-02bd-410b-a6a3-71f028d10849", "value": "Z_Summary_Tokyo_9227.json", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3962bc61-d56e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765332983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332983, "uuid": "eba283bd-46fd-4783-8982-be32a0d5cec0", "comment": "Malware payload (Mirai)", "value": "70ec9e4c9bcb6bd1454d50f8eb4957c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332983, "uuid": "8d458cb7-e2d6-4018-bc4d-7b556cf4614f", "comment": "Malware payload (Mirai)", "value": "1d60ba0f1c81543138c64f22497f9eadcd61010dea522925c59df423ad81af29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332983, "uuid": "1f4ba90e-7bb9-4b78-af83-5af75463420f", "comment": "Malware payload (Mirai)", "value": "6c7a6927b80d8207ba9d25f83a3ffdfae0042118", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332983, "uuid": "044cd9bc-c980-46ea-b579-5e62ea968662", "comment": "Malware payload (Mirai)", "value": "dfc41ffb755ca8f1350488ebe41285cf18f9db8a2cd0ae08e1952e57c85c3d48518b6c2479b36176feed2f583c4fc308", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765332983, "uuid": "4c1d7040-5360-4163-8f24-ab46efc8c524", "value": "T1E5D34A07B5C190FDC8DAC2B88BAFE216D972F4291138B21F27D4AE265F5DE206F5D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765332983, "uuid": "22a34fca-c740-4cab-bfd3-404a4ed3b538", "value": "3072:184UUbQTWsKwSvCL7b01cEmMYCYBi+8bSq75+yZRAT/:6pCvCXmdmzs+BT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765332983, "uuid": "9ca36486-c081-4149-97c1-f6a2fac01485", "value": 139696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765332983, "uuid": "9c0ba070-531b-426a-bd3d-732da498c765", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765332983, "uuid": "76a6f4b3-6eb2-4eb2-bd83-e212a9d47f1f", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1332e520-d5f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765392619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765392619, "uuid": "beb4fbe6-eb05-476e-a150-269b8d72dbd5", "comment": "Malware payload", "value": "759ebd0cec23701ed36887f96118055f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765392619, "uuid": "f5f19c52-da3a-4034-b1fb-e44cbe099c2e", "comment": "Malware payload", "value": "1f0c71c78948367226b2548a2e11f95df30c44e24c9bcfe38479e913dda8b4a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765392619, "uuid": "1a257fbe-bed4-4b48-83b7-e7eb26200d4d", "comment": "Malware payload", "value": "9537f7826f654aaabe30730038d45d14774606f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765392619, "uuid": "f04aafec-39dc-4ec8-9d68-3a32b53f1ee8", "comment": "Malware payload", "value": "3ab1521c48ed497210e57684fa457503c8212cd64d66113228b4a96c6afda0368eaa94b49fdf3d4e0aea86206b6c48bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765392619, "uuid": "76a47494-8f6d-4d47-a54b-88c7be906f31", "value": "T18334A196F0847A99FF791C3880E9339933E2212ED8918763A93B758B49DE30CDF05765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765392619, "uuid": "3b4c7899-8287-41b5-8975-3380ef64cdbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765392619, "uuid": "9133820a-e1e9-4b6f-a5eb-210d9c35ad95", "value": "3072:W0lY9XTVI1QfU058zLgHrW8CVzUEGUhhPyj+6/kgwPr+ftzc0:qm1QOgHrW8CVIE9hKj+6rir+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765392619, "uuid": "7ffa1ceb-76d0-45e9-a0bc-63b8e455c0f6", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765392619, "uuid": "009d4ff0-227e-4fe9-933d-4e7954b572a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765392619, "uuid": "c0fbb5f0-bdba-4c59-87d8-da80c6f81530", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c66c16-d61e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765408830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408830, "uuid": "1ec44958-3586-4135-b651-507ac6b50802", "comment": "Malware payload (Mirai)", "value": "bc8ab76a9b5825755263154f3ca59fbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408830, "uuid": "f59b86e6-8130-4526-9fb3-5300c07310c7", "comment": "Malware payload (Mirai)", "value": "1f93e2a3211e6bcfad1e93dd0f50507af0a1fa74720214601303c49cded9b218", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408830, "uuid": "8b3eec5d-2802-4c0c-89b5-0972a36cd5e5", "comment": "Malware payload (Mirai)", "value": "32d230b9bf76b0ee4bb129aa425fe21b98b82732", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408830, "uuid": "bd028c73-4737-4f32-9d75-0238a5912a29", "comment": "Malware payload (Mirai)", "value": "de65803c9e9d4bf1202522e7ec591c3270b4153ca0854f91494b82b7c5b55fbd97bf57cf7b6a7520fb3ef6bc0539800c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408830, "uuid": "a6cf5653-11d1-491b-b73d-f1a9f9952890", "value": "T1BC73F886B881CA65C5D952BAFE2E51CD331317B8E3DF72139D106F247B4A82B0E7B911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408830, "uuid": "e5bbc57c-82ae-4df1-bf23-3f27623e7a17", "value": "1536:o9n5K3m1Teqi572OoeupM91Ct0CUOA9CV0eYdDvqP3pMfi9rhu/0CT3bsR1:kgLqrfrpCO105dMrhu/0CT3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765408830, "uuid": "887f8302-7fd6-439a-8b89-7e0c7d838400", "value": 76356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765408830, "uuid": "04378aa4-918e-416e-822e-d9d20084ca07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408830, "uuid": "d2b2f8c9-0073-4ba4-bd0f-eae86649cd8b", "value": "jklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af279695-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (Loda)", "timestamp": 1765350360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350360, "uuid": "64985a07-88ce-4067-9fce-5563441a3366", "comment": "Malware payload (Loda)", "value": "a40297ccacb3f8ed67574c098bd355f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350360, "uuid": "e4152579-30c3-4640-a01c-cedb770357a4", "comment": "Malware payload (Loda)", "value": "1ff6ba42def4817b9bdb79b7f4c24e3ba6099c57f3215ae83e5a42f989449d7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350360, "uuid": "b6b68b8c-6e1e-424b-b2a3-97ea9a648008", "comment": "Malware payload (Loda)", "value": "9403eace9be0f45c590e1e302e7adb6eaa58f449", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350360, "uuid": "3c465dbe-06cf-4bed-9eaf-a152084cf829", "comment": "Malware payload (Loda)", "value": "55c6c3ce8907dd9732901aefd38a4b472de66ada6475d01a0b5ed025d9e5d42b2c4115a1a647c13ec2b48a1bca12cefc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350360, "uuid": "e6d224ed-5030-4043-a395-1919f3e55adc", "value": "T11165DF1373DEC3A1C3729233BA66B741AE7B7C2906A1F59B2FD4193DA930161421E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350360, "uuid": "403e7816-c4a0-4915-ac95-f7cbdd30b534", "value": "f2da2e4c1b5a39d16c40d60cec2608d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350360, "uuid": "965dc835-b269-43c0-8a83-d531aceaf891", "value": "24576:c4lavt0LkLL9IMixoEFNY6tQeQTpVWuF76ubZL6Ra1q9MmCS:rkwkn9IMSNYglQTDWY76AzaPCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350360, "uuid": "d6c02f1c-5d02-4ebb-9f6a-bcb29f212369", "value": 1548288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350360, "uuid": "a7053117-4d55-427c-96cd-e3eb4dafcf53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350360, "uuid": "24afafdd-0d73-4dbd-9ead-ebbd7c41a7ad", "value": "Bootstrapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19980c08-d604-11f0-a129-42010a9c0007", "comment": "Malware payload (EternalRocks)", "timestamp": 1765397354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397354, "uuid": "dd4a768c-60c5-44d8-a9df-c176da36ce26", "comment": "Malware payload (EternalRocks)", "value": "66e42acad2793b8a6de88f8ee4d5f9bd", "object_relation": "md5", "Tag": [ { "name": "78-40-193-126", "colour": "#23F4EA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397354, "uuid": "dc9ed0d1-724c-42c2-b984-cecb9c18ea6f", "comment": "Malware payload (EternalRocks)", "value": "205422f6a830d3d4d7f42335fc04e89667d90aab95b665d57096ae154e79a268", "object_relation": "sha256", "Tag": [ { "name": "78-40-193-126", "colour": "#23F4EA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397354, "uuid": "6eb75fcb-6ca5-4ddd-b8eb-f238f5d244ca", "comment": "Malware payload (EternalRocks)", "value": "1daf64b08f4c6c0b3eb19c05a5d2f03a91c8ca02", "object_relation": "sha1", "Tag": [ { "name": "78-40-193-126", "colour": "#23F4EA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397354, "uuid": "5c174ec6-4360-4554-9fab-7c127204b649", "comment": "Malware payload (EternalRocks)", "value": "558dae285248d2dd06e2f210d293bddd17beb34cf1a3be6528e4b54405d904a7527712e0a6f2f1ec21401dc1f46f6070", "object_relation": "sha3-384", "Tag": [ { "name": "78-40-193-126", "colour": "#23F4EA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397354, "uuid": "d0cd329a-2670-407b-94fe-b1d619ec04de", "value": "T13E87233A9A3CD4D0FB0F99B1EAB7814C44E3651921F298E67B24A6164C5F1C0DB3B74B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397354, "uuid": "36f05400-8baf-49fe-81b4-d5880323c204", "value": "786432:QCmPLBlaXxsntMwSqbs1mJCVGXPbQXhQOsYseq7ko5879jDH9slv/:Q1jH5tMebsgYzQ7Y6B58h3+v/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397354, "uuid": "1a0e5d99-a928-4185-b1c7-ffb1b78ebb45", "value": 36081304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397354, "uuid": "7794239f-37c7-42cb-a930-ee9d92cb7ed9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397354, "uuid": "ad2456fb-2d34-47fe-8230-16c63a55add1", "value": "Free Download Files.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df38451-d5cc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765373390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765373390, "uuid": "46dcfc99-da57-43ae-abe1-50263f97cbe9", "comment": "Malware payload", "value": "06ffb1b0a9683b82e99fdf3536a2ceb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765373390, "uuid": "d511f171-eac5-41aa-94f6-9a6a5cf20c23", "comment": "Malware payload", "value": "205f94ff00084777267d7aec5da96a87c7cd9bb7635df9d5b56992946c870746", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765373390, "uuid": "73fbaa97-c468-4289-ae69-03c298b9d24f", "comment": "Malware payload", "value": "3030dc59f5866de91f43b64b75f9dc429d861e48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765373390, "uuid": "d785d79d-7078-4bc3-a164-9885e6b06e39", "comment": "Malware payload", "value": "9d46ceca8367b5ddfe37ea848bd01dddb4fd6602bcc606018cf5cac58e894c406230bb0ed841411bff2750b52d03a1b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765373390, "uuid": "66a8a6c1-bf46-455d-9062-9e855cb47c22", "value": "T18C82F849D60365F9ED3A047158EBF7FF9A717A248431CC26E760EE46FB63C166408B09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765373390, "uuid": "12301c74-8164-4d7d-b789-0297aeb57ebf", "value": "384:he7+h8mNCK1NIBhbDhwcwhcY2/rsw+66SYr0Orn:M7+h8moK1a0ZhZ2zswT6SYYKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765373390, "uuid": "34bb7d38-5b1b-436f-97b1-00c97482babf", "value": 17742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765373390, "uuid": "fe993668-ab72-4680-b922-f5ace1a91c87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765373390, "uuid": "4be8b0ab-390e-4030-9c23-b6670df4ae36", "value": "SecuriteInfo.com.Trojan.DownLoad3.40744.6377.30011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5dc8860-d611-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765403173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765403173, "uuid": "286ea970-0054-4176-b7b1-9441f0ecb7d4", "comment": "Malware payload", "value": "0cfdc0a0851744c47cf8e7e1c11ec6a0", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765403173, "uuid": "4a9f3f1c-8b38-4711-a1e4-b882f0aa96c0", "comment": "Malware payload", "value": "2077ffbe110bcc4deebcac7210c6268015ae9682b12d859535108df8d1cb12da", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765403173, "uuid": "53803951-9813-4c4f-941b-e011453d5444", "comment": "Malware payload", "value": "a8af3692f1c72d8543e04ea72f273df8b9188829", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765403173, "uuid": "23badce5-e395-48ab-8ffc-a36440bac060", "comment": "Malware payload", "value": "673d105eff1f7ea7c7d0122bbe3b14cc8dde8b3ff6e38f54719e1531bdbbeec91b03559fd4b459dc34be43e7e1d30aa4", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765403173, "uuid": "efdae862-bb84-43b9-8ccc-bd6d11581913", "value": "T162469C03A29844E9D059C074CF469132EB62BC590BF666EF3690B6D62F77BD07B3A710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765403173, "uuid": "6e7c8761-1601-4b23-85b3-0f13a45fe80f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765403173, "uuid": "d31ba16b-8591-4845-a912-ba90494df809", "value": "98304:Qq9HPD8PjbpmaPWgOt2na45zk2xBTbDg:nspmbtyaGzLxRbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765403173, "uuid": "52dd7c59-5b6a-4fb3-8864-a4c6202c8a2b", "value": 5694976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765403173, "uuid": "a21041fa-f62a-4ca4-a091-6ca761b2cab6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765403173, "uuid": "d09a1546-9bdb-4e7b-87fa-d7e12053fc86", "value": "2077ffbe110bcc4deebcac7210c6268015ae9682b12d859535108df8d1cb12da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a44d98f-d568-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765330434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765330434, "uuid": "331b737c-4b56-4e36-8dd0-0ba5a965bcf4", "comment": "Malware payload (Mirai)", "value": "72491f3633b909cbb94b5bdee0f7ad8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765330434, "uuid": "9b411671-59ef-4327-a420-f4e47d748f7f", "comment": "Malware payload (Mirai)", "value": "207ca7b4d95732a92aa9fd34185084b127bc5e3fcfcd2061874d452f76290dc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765330434, "uuid": "10ba9db9-9656-4be6-94a9-0fd22325ad2b", "comment": "Malware payload (Mirai)", "value": "27ded078732aaecbff8ab8e599ea66406392c496", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765330434, "uuid": "e17f51c1-8d54-47e5-960f-3d066ae836bb", "comment": "Malware payload (Mirai)", "value": "b58e2b94c54513ed7c3845400ab7feb145cb05f76e9276dd44677069adf8dbfb8308c6a857ae6765523fa9cb865d2e2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765330434, "uuid": "e5480343-b583-4d67-a61a-2409d5e2421a", "value": "T1121454192E22DFAFF56C863047B78964979922D636E19648F29CC31C1E3025F641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765330434, "uuid": "adbeddd4-55e8-45f0-882f-0ff993d4e321", "value": "1536:zOU7Ep7VG5IW2qGjFU52rlpegde0+6uXJj0Ljro3nNe6BMEbE0iEO1GTN4qeWcau:QkIW2qJ2hBdyXUryXbE79qeWca+vMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765330434, "uuid": "70278bfc-2edd-477a-97ba-55c3e3865622", "value": 198704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765330434, "uuid": "c829da6b-059a-490e-aa7c-592c878e696f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765330434, "uuid": "8828afa3-889a-451b-b854-a319ac48d893", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a2d72f1-d5ef-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765388497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388497, "uuid": "91353b06-7a81-4baf-9498-9d30cb8dcc21", "comment": "Malware payload (MaksRAT)", "value": "43f0cf35bfa9dbd85e16dda3131db8f4", "object_relation": "md5", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388497, "uuid": "702accf5-2235-4e75-b83c-03ce97e2edd1", "comment": "Malware payload (MaksRAT)", "value": "20de90c05466ef1292fe7097a4ccd8c1fb10088fe0efc9bf963495914b5866f7", "object_relation": "sha256", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388497, "uuid": "cadd58c8-a532-4cb4-9659-92a623e6f01b", "comment": "Malware payload (MaksRAT)", "value": "bd4e5e450e5129570c6b8202a2dd82dbaf8b5128", "object_relation": "sha1", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388497, "uuid": "fc7b0290-2fb9-4d9c-a609-ba30323324d6", "comment": "Malware payload (MaksRAT)", "value": "533e1d96fc4bf91705a5257c57b54fb791964cd21e57d82d22fbdc2ac341285590ab56d55db1f3cb581240602335d354", "object_relation": "sha3-384", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388497, "uuid": "08f83023-c013-4c8f-b80e-b9160f4409a6", "value": "T156E2F12CFAEFFD80E9D3E93A4D2B9781913612388D4035D5447FC6AF601F6C61E86862", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388497, "uuid": "fcabb9e0-443e-4331-8804-976209843c88", "value": "768:tspFiQlz31gb6mDUH6XsC06NY1n18TwOUSfXdCKhKfk2c:YF531LcUaXsC06W1nmkOrAKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765388497, "uuid": "bf54fb1b-c8ca-4a80-ab35-6441ed957d9a", "value": 32392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765388497, "uuid": "80e5cf91-c8be-401f-bf6c-2417ee00aa1e", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388497, "uuid": "509e7c46-506e-45de-a857-bcf4583e93ff", "value": "20de90c05466ef1292fe7097a4ccd8c1fb10088fe0efc9bf963495914b5866f7.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf1b21e-d5d4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765377066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765377066, "uuid": "d35ddd21-d54f-4c24-8bde-4715ea18f638", "comment": "Malware payload", "value": "3c4452371559aaa46f32dc5a6e8d99d8", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765377066, "uuid": "c8f8dbac-c81c-4249-bf8d-0e3762abce42", "comment": "Malware payload", "value": "218f18a82b89aa6a8859b9cf8ac4b5c1f76c89db07e77f070be28326b4ce8d08", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765377066, "uuid": "33687e16-8e85-451b-a483-b68257703ba7", "comment": "Malware payload", "value": "7b64fefaa4f40154c72dc2b802abd447fc14efc8", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765377066, "uuid": "1e644f1c-bfc0-4f6a-b694-44af63006d12", "comment": "Malware payload", "value": "fcd2a5d56bcab6a64971da4343b332835f7d09d7735200a5dd55e8723804bf828bc7a2b544770c6051278db068150de7", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765377066, "uuid": "e6591fe3-08b9-4f2f-80af-40f9da498a79", "value": "T136C7BE1663A116AAD977C1388AAB6503EA73B8071330C7DF329C43752F63AE45D7B760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765377066, "uuid": "98566943-20fd-4dce-bc73-858cdba4b727", "value": "957d237db44af201299a1e8ffc6df035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765377066, "uuid": "a7d130c8-01e8-46db-8974-f4890083c39a", "value": "393216:a/jdQ/wilbpfLWPIv1eiHg9aVLB5EVsnHxyataUTKgkggx20+t/VxVDF/xgca9BS:a5EosxTUU8XOkBKgPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765377066, "uuid": "4938987d-6172-46b7-b133-23a6e98b320e", "value": 54475776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765377066, "uuid": "31e5daf8-4ed3-40d3-9c85-c782b9af849c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765377066, "uuid": "9925b1de-be99-4619-9225-d71074cc12e6", "value": "KotilaV37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0a3f74-d611-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765403207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765403207, "uuid": "7bf3c7de-d067-4b27-a5e4-5fdd71319a89", "comment": "Malware payload", "value": "d18183a192df35bbe9be84463330d831", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765403207, "uuid": "ae4b1790-b5ce-406e-bc4d-5031d19c75f5", "comment": "Malware payload", "value": "21b02917b796ad0aaac9d6fcb4f7f82a24f6f192c95d360e0873d43abc2adc9b", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765403207, "uuid": "1420455f-ffe1-46f7-8f00-413a8008ff4d", "comment": "Malware payload", "value": "bdc886d6009cc2e948a24a7adcc934fddac6e876", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765403207, "uuid": "44a38c20-7284-4c77-b630-8f2224ea4fd3", "comment": "Malware payload", "value": "0e9999f4e14fa15fed3cddbea74fe1eb405176e9f30cae72a475fc1ea9433a99b46db2760a8fb841915a5f97abf9f7b0", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765403207, "uuid": "37998d44-a9a1-404f-ac69-4bd46ac218eb", "value": "T17095230F3129587CE43FC17898E462719331F1128676AA3DBB9497223C779681EEFE85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765403207, "uuid": "21cc6334-0f51-4d44-a70c-df8f17b4e9b4", "value": "5d713d79cfc869a548f7f3f47803c09e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765403207, "uuid": "c8c05aaa-0869-45c3-9741-fc2a515582c4", "value": "24576:gIZA1x7Q2cmVB50oD4Zs1My2UTVbMU6iR:gI125VBeMcs1hfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765403207, "uuid": "935a5f98-1740-4285-b82d-d01fa852d328", "value": 2025472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765403207, "uuid": "e434dea1-d502-4e76-a843-8b42eb5c76bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765403207, "uuid": "432cf03a-cb73-4cd8-b2d8-a358c9a30ef9", "value": "patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df65c5e9-d5aa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765359031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765359031, "uuid": "bd07ad2a-a8cf-4f4e-bbb5-465ea8e641a8", "comment": "Malware payload", "value": "fc111b1dfca464b40f79969e82a23766", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765359031, "uuid": "950233ee-79d6-4743-8a7f-016829d92567", "comment": "Malware payload", "value": "230081198d15ae14d9eaae5339298a1879555b232732bbfd48418a38b8b65685", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765359031, "uuid": "edf548a8-66ad-47ef-a6a3-baca2ca1c954", "comment": "Malware payload", "value": "579760424f30c7a8c31a65a624c17fce1516f6f1", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765359031, "uuid": "dcdaeecb-e67a-4bfc-acaf-49cd21eb4830", "comment": "Malware payload", "value": "50748937df811ce3c05995e673c967fb413df1b5936617d04f88ccf6ea42c8c37deb791cf792a6690b9af465dfee7e40", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765359031, "uuid": "5b0ec6fb-8906-414e-8cc1-e46a120e3d0f", "value": "T1763633BB8286396DBD920C1E719954C5CF0F249767A09C2B66933139D3C2BB07E3DD86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765359031, "uuid": "d8eb4572-88e6-4da0-ae83-386c5d562a4c", "value": "98304:k36m50E6akM84s6VRNvYCDIRT3Ja7JOBDWnBdzW7BtwF/TvRNXGXxRlF+D5eSb:k36cB59s67NwCuZILnjzQ8rGh8leS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765359031, "uuid": "6f0a3933-db8b-47a8-9ec9-6ed44697c581", "value": 5015675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765359031, "uuid": "91b27e13-6aea-464a-853e-0b057007d23c", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765359031, "uuid": "e4455d14-8daa-42f5-81f1-88fff080e4c2", "value": "MeetLab.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c41cb7-d605-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765397913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397913, "uuid": "ed4a6fe2-8706-43f5-ae55-03728a6196c8", "comment": "Malware payload (Mirai)", "value": "70219a2d0db6da553c5f3f57772dd023", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397913, "uuid": "a8c3edd3-03ff-49d5-9018-2ad737325d95", "comment": "Malware payload (Mirai)", "value": "23b2e1766934aa79bd8980e7bab4b7b5b3951a3384e06231dd70534d9c64bf07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397913, "uuid": "d1112765-f58d-4bf1-be21-508ee8fb11aa", "comment": "Malware payload (Mirai)", "value": "9508c5af55e5e9a9081f3b0cb98f8af94ac10b35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397913, "uuid": "37a657ee-3b12-40e2-8817-97dc108e4f3e", "comment": "Malware payload (Mirai)", "value": "218495fb2ea28ac6f8e93c85b16e54cf4d1b2afee0bac3652d1e36f4441a33ac4c9234a721785e572d10babbaabc5b04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397913, "uuid": "f258490a-a33a-4d7e-bc5c-78c8cc5ad419", "value": "T19E13029161480A66AF748EF3A1BF41C33928CF16A0D135F2351BA97C85E1B461D3B7D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397913, "uuid": "84834600-b967-4bf6-905f-f6d9d5079d3a", "value": "768:tT9Hs/jJ7vixfaoIgS9bP4PI1f5JC8EbJV87m3BLf6/L9KHFJ7Gx99q3UELfNx:tT6/F7kafgSV11hJCRE7YBD6j94FJ6x0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397913, "uuid": "670d69bb-008f-4fa4-aa2b-7dfd0d0da82d", "value": 43768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397913, "uuid": "1224f197-7292-466f-8851-30f69e9a8b71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397913, "uuid": "1964fd8e-436b-4105-bd1d-c73bb38f26e7", "value": "Labelloperc80.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24b72f5-d595-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765349963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765349963, "uuid": "66bb6c7f-44e9-4a97-8f46-7945d31ed8d2", "comment": "Malware payload", "value": "bbc3c5f09b2de9a6342f731a7f9fe8fa", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765349963, "uuid": "0c869608-e43e-49e0-9ca3-d95d97c479c0", "comment": "Malware payload", "value": "23d6e9098ef592b075b542d684f2d6634edbc0363ec3a2071e74e18678ce3714", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765349963, "uuid": "4c4b66d1-4154-4c85-8303-3a7a29a705b7", "comment": "Malware payload", "value": "d02565152bd157cdad898d05abe326d5e60ada90", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765349963, "uuid": "f57d55c3-6a27-4f2a-a739-4f1a707aafa0", "comment": "Malware payload", "value": "1f9cf795b407a7c186a5d76a6fbfa169da699a66aac033ff599bcd6efcfbdef705fa8992fd17be5f4f14de9ee42fda8f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765349963, "uuid": "46ab9732-342e-4c3e-a72e-1a8b4adb7d24", "value": "T1C1012B9990A05C1020805C6E668764977923C2C7265B0FB9FFAE193D7F9851DB078B48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765349963, "uuid": "b3479b12-3972-4661-98fe-91b41e9bc1d5", "value": "12:dOXOsYxPC7JlqZ1ZUJZI4WAd9AIziBBvAIz9xBsSAIzSkRBaAIzexXR:kXCZG+1ZuZI4Wu9AIm3vAIxHrAINnaAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765349963, "uuid": "2a4eac9d-f80c-48b1-81d2-821208ec7cb9", "value": 689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765349963, "uuid": "7d4e1122-d8bc-4acc-a0f8-0cd8b004d586", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765349963, "uuid": "71bf5d5d-951c-4b2d-85a2-3accb4ac57a3", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d18ea87-d5e7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765385092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765385092, "uuid": "2b49e4f6-da13-486f-b53b-fe65c83df702", "comment": "Malware payload", "value": "58f4931e4615929ccfff71c3e4c4f4ed", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765385092, "uuid": "9cd4c7b7-bc69-4ea6-a20e-b2e57527179f", "comment": "Malware payload", "value": "247893b6d5cf7ec29b0d56546ae66efc93c586a79ff372338c74ae082d3ec9a5", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765385092, "uuid": "9d958e8e-ee59-44cd-b061-6d4c3bc1a232", "comment": "Malware payload", "value": "351c0d8848d873cc5de0566b30fa88e5e9b10c32", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765385092, "uuid": "6bed9ca1-29fc-4026-9b55-3ff3f0be5459", "comment": "Malware payload", "value": "5cd14f408d3c62a0d8744475e13d706b35dcb7664e933e72fdb26bc824f8e22d4b7bd09b3e4198b461634dbf2a7a774f", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765385092, "uuid": "a6dc921f-3df3-4849-a815-c58e918fd1d3", "value": "T1C833F16E55F7416ADC423864E4CB8A3E131055030FA482E69DCFCFCF637592A91B3A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765385092, "uuid": "2146e47a-5398-4834-8edb-0f34ef96cfb0", "value": "1536:zsWjSdxnJzWNauVw6f1c+Dp+Ybu7Qc6nimWMid5tDl3HSAc:gWkJaEudfS6u7QcjNyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765385092, "uuid": "c04f33fa-70de-42dd-91a8-67f58b9eb1d2", "value": 53274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765385092, "uuid": "efd9487d-1648-48db-916e-180c9c68e6af", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765385092, "uuid": "a4399687-7896-4d0d-ab60-2773aa35860f", "value": "XtuService.exe.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3495aebb-d5fc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765393963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765393963, "uuid": "d16cd584-2496-40f4-a3e7-cb2634b92193", "comment": "Malware payload (Mirai)", "value": "b09952e387a389bc3caa7c94dd29794a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765393963, "uuid": "22f25174-9afc-485a-9d30-4ef87985c6c8", "comment": "Malware payload (Mirai)", "value": "258a424c4ecd010eb0057cd1f63203d2196e48ad9fcfb50b17c232c34915bd32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765393963, "uuid": "4fe0f657-6f64-4532-a31d-ef8d324cc049", "comment": "Malware payload (Mirai)", "value": "3f1b567edfc22cf1a323a1305ff6a1c64f6824ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765393963, "uuid": "9bcf750e-9613-42ce-96ad-744bcc819c70", "comment": "Malware payload (Mirai)", "value": "00dfcc6fa345cb6af06346dc2ba39c407add9b677a5351134af5a916bfab8d78c6dc7530f771eae72b33d0882414781c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765393963, "uuid": "efbdf17b-7320-4493-9481-4d081520d84a", "value": "T1DB13E1ACB64028CBC4C91C7EC19D5ACC1E15B1E5A99D8796A3C10CCCB7E207FFA558B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765393963, "uuid": "dea471cf-f567-45a0-919a-0875509e394e", "value": "768:6DgoqBoYlUKCnNWLrTNhuUYgHRObgggFF2cVVZUIe4ZrZ3HVq4k+NWJ:p1B+XNWLPNUUY+RObfOF2cVED4ZrZ3HQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765393963, "uuid": "81b8db5d-f1f0-4d9f-a932-669a6c086a23", "value": 44160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765393963, "uuid": "762615ad-e6d3-44be-bc29-01e6c91385b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765393963, "uuid": "2ae56baa-7010-4df4-9c50-4c32733162ff", "value": "Labelloperc80.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a221c49c-d600-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765395865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395865, "uuid": "9fcf02f3-6f25-45a9-a56a-1263031372b0", "comment": "Malware payload", "value": "983b9bcad7a2e9d597061217ec6acddb", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "LegionLoader", "colour": "#426886", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395865, "uuid": "1bbd3e1a-ba77-48b9-8fea-8dd55ab13ccc", "comment": "Malware payload", "value": "27e2441ecc756fe8e91a3cbf26ee4e1283f97c8f4b6c36349102775b30f9ff7d", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "LegionLoader", "colour": "#426886", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395865, "uuid": "7e632f6b-912f-4bc0-9e82-e652b5e8af07", "comment": "Malware payload", "value": "878e2292f38d20bd32207932fb6d88b9315723f2", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "LegionLoader", "colour": "#426886", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395865, "uuid": "97c61cfb-d53e-41e7-bdf7-1cdd13f448c9", "comment": "Malware payload", "value": "cb7da742225ae9a104fb9526223ae9bcf6f88a7f1cdd9034c6c25e1e268f78f9bd12b04d232982f05d68bd185e371f06", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "LegionLoader", "colour": "#426886", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395865, "uuid": "dd573046-755d-4eb7-ad93-357c9511e8e4", "value": "T1BA8733F8EA1319188227E8F5AE905E0577FDCD8754F5FF0B0A91C8E349921BD8E28E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395865, "uuid": "b539377a-30dd-4da9-a11d-8a6b4e85ed4e", "value": "786432:WRVka6ObFsCEempZXmm0vuKBm9dAxwNaNx6dxpYl13Ss4Yg:Wn0aFsrpZWTvxm3AxgaNxBV4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765395865, "uuid": "fdf27230-c45a-4443-b815-199ab341edc9", "value": 38492725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765395865, "uuid": "a4fbfbda-fce2-48f1-aee1-836ed849e76d", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395865, "uuid": "a8643938-b56d-4e00-851e-cfa8fab556cb", "value": "File_Open v.5.2.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cdc9782-d58c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765345820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345820, "uuid": "ab3b6fb3-773f-40ab-9b82-e8990729026f", "comment": "Malware payload (Mirai)", "value": "532b538dda0814a34980dce5e1fbb779", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345820, "uuid": "94dfc48f-6b7e-49de-ae33-235f1fedaaaa", "comment": "Malware payload (Mirai)", "value": "2817fb6ed3afe73c968d62d601368f1a9ddbe693eabbf4d73aa89514d9a072e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345820, "uuid": "f534c65c-3003-4c9d-a004-558ec5d75248", "comment": "Malware payload (Mirai)", "value": "dea33df914577d0fdfc19b50aadee858b2975ca9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345820, "uuid": "0ab8fb4d-596e-4d3b-b860-aa850352e32c", "comment": "Malware payload (Mirai)", "value": "5fe0c3174128a674a33ecb7618d08e227667ffff0c402f3b0c750ffafdeda77c85279c6e5e6ddfa8a2593924c9f09e53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345820, "uuid": "abc72e02-258f-4c90-a8cb-e627d15ede73", "value": "T128A34B07B2C084FCC88AC1744A5FB17B9971F96D1138B2AF67C0FB223D9EE216A2D555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345820, "uuid": "be7bddbe-22ec-4c84-9e4a-dd48f4134694", "value": "3072:q9DzK67/jZ8PtmkVa8/Fpy/qQj1Uqgra5kC54buPKqc9a:q9DzK67/jWmkVfFZ+jgokzhqc9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345820, "uuid": "55daa1ed-51c8-42a4-be9c-da42ad2e011e", "value": 105552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345820, "uuid": "45fe650d-fef9-4b44-8d0c-68b44f2909d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345820, "uuid": "bf3dd676-9e8b-41f5-9324-141ec4a3f98c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a5e310-d575-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765336094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765336094, "uuid": "5a9c7958-91ca-4abd-822b-cb81e05e2f75", "comment": "Malware payload (Mirai)", "value": "817b32f1466b0fb037ed35af66b49b11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765336094, "uuid": "565d984b-09a7-466d-b450-5cc901c1b863", "comment": "Malware payload (Mirai)", "value": "290d4ed63719a0ed2362bf726abe742e0bdc5bf0d75d4644996e063928b471bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765336094, "uuid": "2fa6d556-9547-4b01-ae40-14907a1ef88f", "comment": "Malware payload (Mirai)", "value": "793be1e1f39eb74688def428865288f58ae04a06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765336094, "uuid": "247cbc45-c520-426c-86f8-f793fe8a95cc", "comment": "Malware payload (Mirai)", "value": "101ff609cbaa9d7a9269ebeae319fdd071c3453fb9b828c24174c12704759028d7826ce4416000e496fb45a22d0656d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765336094, "uuid": "8794d8b3-7618-4f05-bff7-a13c7abef753", "value": "T1DDB339C0EA47D4F5DD1642302277F73B9A32F57A1139DA83E3A89F327C52A41D90A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765336094, "uuid": "b4671b50-7ea1-4e6e-923d-cde4b23d4737", "value": "3072:XFmzGpEWmXBLFkpzjYS3Z/5+JcDEhUohHw0pJbLG:XFmzY5mXBypzjYYZ/5+JRlHLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765336094, "uuid": "3c00c469-feda-483c-8054-8bd7b5552b0e", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765336094, "uuid": "9d44d670-48d2-4420-8045-18346324bfd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765336094, "uuid": "2dba116a-913a-41c6-9146-695c072aec94", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29087c9-d5a6-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765357211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357211, "uuid": "d5862fb3-ab9b-46ed-96f0-8c6798e01f57", "comment": "Malware payload (AgentTesla)", "value": "272ee08574313b3488f1687002a2a292", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357211, "uuid": "f4cc7239-b13c-4b17-8d9a-e570e3a6d17d", "comment": "Malware payload (AgentTesla)", "value": "29329bf04d6724173564b6e20b7f12b8a6b4382d8f99911e68808a55fc3c2ecb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357211, "uuid": "1538a882-0c70-4224-8211-a91aaa7762e4", "comment": "Malware payload (AgentTesla)", "value": "9d3b922098d09edf8a5d7f855bd898d07f2a6596", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357211, "uuid": "974b585f-dbbf-4041-ba65-c7861505e7d9", "comment": "Malware payload (AgentTesla)", "value": "c757fc2eb679bc76c2135dd2eb43c8bf33964b4eed673b9657c03d14da253c846d12450ce2d453c93f30aebc521b902a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357211, "uuid": "16b91ced-dc67-4ed6-befc-f626b3be8d36", "value": "T1E14502254DC42FF9CFA85A1890FE161DD3E04A8F5026688AFB3BBD466FF7644420B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357211, "uuid": "c2485dda-1272-439a-8d03-0f8be3395271", "value": "24576:+8BJV0PHMCnQx9rmoqbSmv4erfgC41QSHjqTKLP:PQsvOxPqFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765357211, "uuid": "22154af6-a429-40c2-87cd-4a9907951137", "value": 1273647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765357211, "uuid": "a42ae220-35ee-43dc-bfc1-581618e01781", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357211, "uuid": "9daa5476-fd00-432e-b13b-26f978c6ca3c", "value": "rpaymentswift.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f223f1-d5b4-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765362987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765362987, "uuid": "287aa781-544b-4c6c-981f-e160eea25663", "comment": "Malware payload (RemcosRAT)", "value": "6ee87f01d194f31accb9d09ebb6a541b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765362987, "uuid": "eae4e3ef-c52b-4ed5-97e6-307a216f5677", "comment": "Malware payload (RemcosRAT)", "value": "29ef990e1995feb5e295d3d701fcbb372fdec1a03b04bf84d061b9fb64b904cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765362987, "uuid": "defa2f0e-f2e6-4a71-8113-39a7ea0be60f", "comment": "Malware payload (RemcosRAT)", "value": "679e56551e23dcb2163e39d64aff05367ee49f41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765362987, "uuid": "ff48947b-aa0b-44ab-a323-65cbd3f9d0f0", "comment": "Malware payload (RemcosRAT)", "value": "0d5e7b468c5f05cef8ddeb052ecfe9b12fad6b75c75d26851720a598c3288d535cfbf2b7fe61befed78ff466f742ab01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765362987, "uuid": "d4064e1d-531e-4ecc-955d-48b82ec979d6", "value": "T13B94C08DAE046CC5DC054031503791FA99F9E9EDD1AB09EA73FBB036D8321463A1DE2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765362987, "uuid": "349a1d49-39d0-484f-b98a-c71ae7c36f63", "value": "3f91aceea750f765ef2ba5d9988e6a00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765362987, "uuid": "ccec68e3-0ced-4641-93e3-7edec1d2a7a5", "value": "6144:cEh9vQptxgF8gWVRmJll5qZQf/PnhMcKL4/L/lLb0cnQKTdd1eIMMhckf:cRfu8gWXmJ3EQ/nyP4/REcdeIM25f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765362987, "uuid": "8e7753c8-974a-4e57-90a6-6828b3aa4c82", "value": 429064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765362987, "uuid": "47e8735e-434b-4653-9231-b02a97fde71c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765362987, "uuid": "6ae72219-d281-4847-adbe-78434b728b2d", "value": "H12092025_QCA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f53aca4-d603-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765397042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397042, "uuid": "c5ed0e9e-cd5c-4915-9f76-6674eb2f9b24", "comment": "Malware payload", "value": "ad42e0c8c49a336561509fb86b01def9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397042, "uuid": "da92f978-23f4-4fbe-9e2c-9a384e994445", "comment": "Malware payload", "value": "2a104fa0e3035d49066413967e5c8cbed450435da6ca693b4ba73345bd60173f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397042, "uuid": "3c489b96-d50c-4ed4-b7c2-e6c95ec6645c", "comment": "Malware payload", "value": "231ba13db48089a8ea85d84901309616790fc921", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397042, "uuid": "21713774-b633-497c-9094-092a9ce23cc1", "comment": "Malware payload", "value": "49830119f8182eb88b58c818721667ce864642a433417d371af5a1343fa14195fcc6433d06063dd709dfaadbbc3a81f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397042, "uuid": "ee30cb0a-af8e-48b4-976f-c6949d91e4d7", "value": "T14D631A91B881DA17C6D462BAFA5E81CD332223F8D2DF3207DD15AF157B8682B0D7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397042, "uuid": "97c7b972-94f9-4545-b29d-9b7de5294e8c", "value": "1536:jz99GcBGzyaFGCPDv4J5MxPG4wVxT3bsR:jz99wbv4JexerVxT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397042, "uuid": "e6a86210-adb8-4814-a9e8-573f188d5b5e", "value": 67684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397042, "uuid": "5b9f9b60-3d5a-4e5c-880d-41cb5a95c39f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397042, "uuid": "ed401e10-e514-4f06-9aa1-44bea9156d8d", "value": "jklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca94663-d5e7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765385199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765385199, "uuid": "7386a3f3-550a-4b7a-9775-da6048425c5f", "comment": "Malware payload (Mirai)", "value": "0564d4cec0ca7b520f000e38f5462ce5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765385199, "uuid": "8f231fb2-f507-417c-af9e-a45964fb23bc", "comment": "Malware payload (Mirai)", "value": "2a9d3e6492e212f7d6d294229d08ae36f0ce9891a1e1eb76e7b5629d9b57b30d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765385199, "uuid": "5aa5e2b8-2576-4f99-a9c9-cd8efe288255", "comment": "Malware payload (Mirai)", "value": "58f7b2bc4357f01692940c22884ef83b41c4321a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765385199, "uuid": "075bff91-0ced-4773-a66d-bb473d982000", "comment": "Malware payload (Mirai)", "value": "c3942f34d4c03d0e4af5083237ec81e3779ab79e5ee1528b45e70f3de3adde92a28f68dc0bdeaf90a653aa01f0639659", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765385199, "uuid": "f5681c3f-0753-4a27-a769-2a2909e492e3", "value": "T18571A6CE30602A346F1BC97A33749CD176D609A42987DEC8BCD4BCE2589AD80B5C6A75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765385199, "uuid": "c677636e-a9ec-413f-8c8f-a5b63d874551", "value": "24:vyFTZ7v7bJ7TeyIfwZ7ue7uO7OyqmIqxZ7Ku70oia7iyH1Z7KE7toY7ayhYsZ7Kc:vBXNlAqF17t1FpJh5WgJ1lpI79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765385199, "uuid": "f557a6c7-1d5a-4f04-9cbf-d71b7440942d", "value": 3547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765385199, "uuid": "fa436475-2efd-4083-815e-173a9261bf93", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765385199, "uuid": "2ff03a7e-c127-4ae9-81a7-e89642b25332", "value": "goth.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb85efe-d598-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765351026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351026, "uuid": "ce055e6d-7638-4533-ab37-50f323480898", "comment": "Malware payload (MaksRAT)", "value": "1add75774922a2311e18a82cde3615da", "object_relation": "md5", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351026, "uuid": "27ae0f05-9c2b-4853-b196-245a65279885", "comment": "Malware payload (MaksRAT)", "value": "2aaee6d5b95d552f76f367a670c029abaac47df80e0862d8d452c70fbe9eb693", "object_relation": "sha256", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351026, "uuid": "2f972e8f-80d5-4b4f-a0ab-573da7a2ade3", "comment": "Malware payload (MaksRAT)", "value": "74969acd0b460be0c2b56368cda45a3ae3ed9193", "object_relation": "sha1", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351026, "uuid": "3a7699ff-8fe5-4617-add4-d86bf4ced4b3", "comment": "Malware payload (MaksRAT)", "value": "136826d22470aed785d5c0ed63068da091f5b62afe19fb83b3c0238f66a01b9cf46a3e2b6a57f5e77975fdf5d0b4d27e", "object_relation": "sha3-384", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351026, "uuid": "863ffda2-de87-4bf3-b6f1-4eeb22e940fb", "value": "T19AE2F21A4B39EDC6C69426F8A113AC75FE82126E119552EF8DC31830E5F41EC6F89FC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351026, "uuid": "fb17d983-70cf-4d15-b0bd-52c6edaa8ba6", "value": "768:C6YgdlMHmeFNLYYSb+Pt8u27UnEAM+RjjJo1s4YaRHH:5hLre3YgPt8uXnBRjji1syn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765351026, "uuid": "9953aec4-8b9c-43fd-9f79-a7034f3f4d86", "value": 33603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765351026, "uuid": "d812e2c8-fcda-45f9-adb9-4e264d8c4e28", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351026, "uuid": "066e94b7-4be4-481d-80e0-2dfcdf5598f0", "value": "2aaee6d5b95d552f76f367a670c029abaac47df80e0862d8d452c70fbe9eb693.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca843f0-d5ec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765387024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387024, "uuid": "216b4841-a0f8-43c3-bf43-a8798153bac1", "comment": "Malware payload (Mirai)", "value": "c904ff871e4d4d982c4576fe184ff2ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387024, "uuid": "d2481a0a-a6cc-4538-b978-03de6767921a", "comment": "Malware payload (Mirai)", "value": "2ab741a76d21bf01542e22bfa650e4aef178aa0c60ea101e6c71e8b72224afb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387024, "uuid": "da8b49a7-91be-4b89-b7b6-b9dcf70fd23e", "comment": "Malware payload (Mirai)", "value": "995227f3c4181d3a01d12294a06bb9e47c95397e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387024, "uuid": "6df2266a-c98b-42a4-b231-bc6f9ab65631", "comment": "Malware payload (Mirai)", "value": "87461972d12d8f55a0ae5f6f18af87de502eca9cf85e93d51781e6ba1056c24a751f4ce898dc4f91a06af770f9711259", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387024, "uuid": "28b81f85-4e0a-4134-92da-c33487647618", "value": "T1F9E34A55B8828A22C9D513BEF92E018E331367A8E2DF7213DD205F2477C796B0D77A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387024, "uuid": "08935d54-aefd-4489-a878-5d94ba4eda6a", "value": "3072:CotWnBLigk1Tc34CC0DvZe1k6aU6zL6EiueCo2kB:VWnligqTcICCqeS6axIueckB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765387024, "uuid": "86ec5c6c-8e6a-477a-b7c1-043561054513", "value": 146256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765387024, "uuid": "1b9c2e91-35ff-4e45-add4-fe1a318ead96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387024, "uuid": "5c901281-9507-470f-82d1-97d076ff54c1", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c4d9c8-d605-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765397916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397916, "uuid": "d031664a-9786-46d7-99f9-dd647a4fcc0b", "comment": "Malware payload (Mirai)", "value": "b3352c29bfdf976daa89c7d1e747330d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397916, "uuid": "ed8c47a6-bcee-4165-b9a7-7470685317af", "comment": "Malware payload (Mirai)", "value": "2b6a81fee8092f828d219737cc8c8c2c343bad0a3c57bded03b8b0747c7e965f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397916, "uuid": "797f8a42-070d-48a6-87e3-51c9bd11a07b", "comment": "Malware payload (Mirai)", "value": "2ed9d57f275b43e0af583ea4dd3a3d66f686649c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397916, "uuid": "ba7f01a6-b2f0-4f1d-b0c5-43fed3ed0047", "comment": "Malware payload (Mirai)", "value": "c12cb8c38d3a51a41fceccb55cea66a16cc2b02496b3ecc2b2daddc3a6ceaf984ad68d83a7b37ab2a4b82f81215bd022", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397916, "uuid": "879a16d1-51d0-4737-8314-d82a5a09647a", "value": "T16303F1E0E11D0E88EE6ED8708886C0C2F7BB4AED94E19D52F7426A501EBFD6FA5414D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397916, "uuid": "0fb72608-4ab4-488f-9265-7283f687cd46", "value": "768:X3yOL/m0Pr6sedNiv3JF5cg9KqUU/XLbO4uVcqgw0ID:HyOLTzqsvJbth/HO4u+qgw0ID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397916, "uuid": "d3373f69-c206-47dc-adf5-cd70f14ee8f5", "value": 39984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397916, "uuid": "7e35499a-b92d-4008-9a24-80b92121d766", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397916, "uuid": "2645f78b-be41-43ca-ad36-6db30042e037", "value": "Labelloperc80.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f30f162-d621-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765409792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409792, "uuid": "24fb44e5-3c45-4043-9b2f-e46b47d14b86", "comment": "Malware payload (Mirai)", "value": "597293109d595079f92d3668009d62c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409792, "uuid": "579c09a9-56fd-4683-8b26-d20d9d648645", "comment": "Malware payload (Mirai)", "value": "2d1b7c3008431018e67ad58a922d22259e1aabe26874432cc3d16b833265c56f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409792, "uuid": "d38025d3-6e92-4e2c-ba2e-810eab923d71", "comment": "Malware payload (Mirai)", "value": "d0d53d472235540a8519d56328c17503fdeb5118", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409792, "uuid": "570e43de-a97b-47cd-beda-8147a8bf65e8", "comment": "Malware payload (Mirai)", "value": "0ae7bb1e6d632aa94da974b9d9863d190b6ce50cb1662969604a0caabf81c3ba191437afced14cf08bd0e38aa93ebdd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765409792, "uuid": "a78aedab-be67-44f6-9dd2-5f070d8a7441", "value": "T12743C7193E319FADFB3EC23187B78E20A758239536E0D6C4D26CE8015E7024DA55FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765409792, "uuid": "52af69e4-a0b4-4582-a188-0e6f0499ce99", "value": "1536:SlZVMp0SsXPNA9VydkDQaFs07nILnaVLnnhLHnTG/qmT3bsRnd:xp0RXPNA9jQaFsGzGimT3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765409792, "uuid": "c3f5e9ff-6d0c-468b-8caf-26459ed1af9f", "value": 59956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765409792, "uuid": "87944b1b-df42-43b8-8c1c-0bf2154fc823", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765409792, "uuid": "7748206a-7822-478a-b33b-13f5301144f4", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885c7a49-d5b3-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765362751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765362751, "uuid": "7839a7ec-8907-48b4-a982-9a020b2a637a", "comment": "Malware payload (XWorm)", "value": "fe0f2b12915cafc1ffcc5ee1ee22582e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765362751, "uuid": "73e81187-55a2-49d0-a5cf-67b81e44cba6", "comment": "Malware payload (XWorm)", "value": "2d346132d1fae300afb6be4fbc72544bf15254132744a8cb259ecb65ed4eb990", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765362751, "uuid": "239c22fe-138f-498d-9a20-95faa2da0b4a", "comment": "Malware payload (XWorm)", "value": "07ebf0b438058fc6c68f6ee2514a487d0b320daf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765362751, "uuid": "fab25026-272d-4430-bb51-736c08df22b8", "comment": "Malware payload (XWorm)", "value": "b5094cd97ccd325cea4668468086870f62e4cc5c1ecdfeb1d195f114c2770a88804411010065c7537f0494036244eaee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765362751, "uuid": "7bd097fb-a942-47e8-8c31-95d0b8cdbad1", "value": "T17707BE19A3E505B5E53BDB38C652C333DAB0BCA25635C60F095CF6851F33AA18B2F625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765362751, "uuid": "f8c1d925-191c-45b5-9712-b6c42546fe43", "value": "7bf33a38940fdd542c4042c5148f16ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765362751, "uuid": "340201f7-1381-4545-83b2-bb711753e18a", "value": "196608:T7lstLR1eO713vjyD3aObVjyFUHHJx0MF3v:Xlst7eYtryryCJSM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765362751, "uuid": "d626c9ef-262d-4a25-8e17-0791fd66f863", "value": 18163200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765362751, "uuid": "1f1ce5e4-9423-44e4-99ef-cf94db9db9f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765362751, "uuid": "51497310-0cb0-4a77-b0fb-e973755d9004", "value": "SecuriteInfo.com.Win64.MalwareX-gen.63812825", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210af5f4-d600-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765395649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395649, "uuid": "9909da87-737f-44f7-9bd3-b3ae0331b46f", "comment": "Malware payload", "value": "ffe2b86f87a2324c51fd901830340ba0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395649, "uuid": "1fc7b749-b59f-4116-93bc-e73d3beb6ea3", "comment": "Malware payload", "value": "2d7a335c537345eca422f36ec34ab4a604748966dce388e522d0427d24cc0e8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395649, "uuid": "4d0fed63-c20a-4e4e-9f5d-f4bfea4d9491", "comment": "Malware payload", "value": "0e3e9deafd99e4a9359b791e13e0196aa76fbadd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395649, "uuid": "217fe9b3-eede-4bae-9981-7039df7f7475", "comment": "Malware payload", "value": "7f852b5cb5dae7354e6c930010167c29912e4a223f54bace0f77c39ed99b6b1160c3fd2d7abca49b9083a80b1675ab5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395649, "uuid": "b28318c3-a60d-446e-aee4-89c727e37c8a", "value": "T17E45F163F47892F6C3B86136F14BE63F290BDE6466418541B3E13F9E3AB5A691310B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395649, "uuid": "c693b62c-e923-4d8b-8a16-31ff7449b772", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395649, "uuid": "4cfed6db-d988-4f72-944b-164a6b16b006", "value": "24576:+y+u3VrO+/+0iiExeXkiMZ5NO+vlAHXoE+:+O3CxBOOAHh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765395649, "uuid": "fb6f7702-8e18-4f95-a3b9-4ac4939cc9a2", "value": 1169088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765395649, "uuid": "4d643209-7ddd-4028-bd05-df5f25f30e1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395649, "uuid": "5099996b-c3ac-49f5-be12-cd10a274e632", "value": "PO5506.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34c2ac7-d563-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765328517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328517, "uuid": "ebd7c668-0833-4a9f-9009-6edc226cd2c5", "comment": "Malware payload (Mirai)", "value": "e91969300e6814e43eb3e8897f3c6478", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328517, "uuid": "dec08e05-15f0-4732-acdd-f0a49a27c2e5", "comment": "Malware payload (Mirai)", "value": "2d9c9428cd4b5330c814e9390b2fb23e476d085dfe1c8280ad19d122f6374237", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328517, "uuid": "2899fffe-d0bb-44cb-9e91-7b70d1cc9ab9", "comment": "Malware payload (Mirai)", "value": "8eee1689562a2ea24af6ad823c84ab1fa0f56bbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328517, "uuid": "2e0f9830-800e-423c-a9f8-f13693579fab", "comment": "Malware payload (Mirai)", "value": "58f94d87f2d419652a116b7bc9350bcc012d0f4024341e90102fa0614c2f9dfcf5a1643a85d0c1c1a91a629cdea7621c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328517, "uuid": "1912464a-d965-4f47-b88b-c0824a5bb213", "value": "T1A493E551BC82562BC5E023BAA67E668D336477E4C2CF722BC8214B257BC561F0C63F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328517, "uuid": "09198abf-8908-4d17-8d8d-35bd5e5ac75b", "value": "1536:Cd+t0rbCuNhS7CVha4m2WiLMBZO+WC27nVDuw8GSr8en:8+tsCurVDN+ouw8LDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765328517, "uuid": "32294f72-2e92-4c6a-b276-80b30f495afc", "value": 95720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765328517, "uuid": "df66b3b5-0e60-4b6f-83ff-7f1ab12028a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328517, "uuid": "5f50b3a7-ca34-48e9-8cc5-fb0001fa8522", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20382c57-d5f2-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1765389634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765389634, "uuid": "3857484d-498a-4513-87a5-dea9188a41ce", "comment": "Malware payload (Vidar)", "value": "458e4c64738e8f46e997eea7cb32a296", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765389634, "uuid": "df76d099-7145-43a8-88c9-3debb46b5209", "comment": "Malware payload (Vidar)", "value": "2f416aac027f19f563cc45e3b4b72e992aaafb63da27f968b9a76a391134dc7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765389634, "uuid": "5c59c300-aa7b-4ba3-ad3a-31eac5b673ad", "comment": "Malware payload (Vidar)", "value": "1a9bbae96ab7a852312b802fd3694211f3bbc43f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765389634, "uuid": "0cad0c86-4a37-471a-9410-95b54e5fae28", "comment": "Malware payload (Vidar)", "value": "26eb62a498b923f2b0644c99f4e37fd6b01c54aaaf03767e58ba43173d9519369e0a854cae3b7d91308fb7bb4a9b4801", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765389634, "uuid": "d38609b9-1a5b-4867-b274-3b744a58baca", "value": "T1D3F25C48BB98C12FDA5F0E7D64A20661127196620103DB8A7DCC65EFFFA77408A25FC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765389634, "uuid": "733817a2-a4c0-452f-a69c-1833c4b97e7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765389634, "uuid": "97573340-9f25-44be-8bfa-efd0ef346f94", "value": "768:lmQZqx1lYcJnqnaFFzv1Iw2K3omDe0XbOfC11kq0m:l0lYov1Iw13omCMbO/q0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765389634, "uuid": "02773cac-86d8-4442-9634-020be9905e1b", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765389634, "uuid": "bf635973-a781-41a0-b22b-9e0113ce3e8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765389634, "uuid": "ce8db0b5-65d1-4cf5-8134-020a18ea6f83", "value": "TempSpoofer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2afc894a-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350139, "uuid": "9cca64b5-b8e1-439b-9392-1686c786e0dd", "comment": "Malware payload (MaksRAT)", "value": "e8bd9acbd2dcc1b71a5802ee27c46e73", "object_relation": "md5", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350139, "uuid": "e19a7215-cdb5-4d51-a394-1b75c14d6c7f", "comment": "Malware payload (MaksRAT)", "value": "2fb314f40bf6849638541d8828588e6b5f10a227bca388d72ddc34e47ee058aa", "object_relation": "sha256", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350139, "uuid": "32fc437d-22a9-4d17-a42f-7ad39779b645", "comment": "Malware payload (MaksRAT)", "value": "4390e59c09a69fb6780bde5e3808b6cbbf8121d3", "object_relation": "sha1", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350139, "uuid": "b685d379-0552-4f59-b59e-5994e9260aa4", "comment": "Malware payload (MaksRAT)", "value": "debc9f416bbd4b710ee871b5d79fc5b21303bffde33feebb03a9b0ae09e402a1da9b80a6eb502350791923d238caa1cf", "object_relation": "sha3-384", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350139, "uuid": "afe5375f-7959-407b-ae9f-a1f56db09302", "value": "T105E2E11CDC2876DAE105E8FC019F9741B0AC21CC7EAC65B3627B588916AA4D1DD0DFBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350139, "uuid": "a3242238-c9a6-43a8-90e9-00a7582ac12e", "value": "768:d4MJKL2ATYI/rBbv5CAcdN5JC3wW7FloIJYSqnXHGpq5Nw/WtkD1:d4MJKLnTxzvCpN5MLfxxsc/WtkD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350139, "uuid": "3e27bd34-c0db-403a-bece-144f0eb9df41", "value": 32722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350139, "uuid": "3cdf2f73-db4b-4608-95c9-bbc5ad4fba32", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350139, "uuid": "425e0cc2-1855-47e8-ac5d-7ae3089ec7ff", "value": "2fb314f40bf6849638541d8828588e6b5f10a227bca388d72ddc34e47ee058aa.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eaf7e1f-d5ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765395376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395376, "uuid": "2b548d0c-2f80-4d3d-92ed-e2e6ae973e80", "comment": "Malware payload", "value": "c1cceca5e5013bad21903aa134e246cc", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395376, "uuid": "6f68f585-119b-4b5b-8efa-2c045d3d53c3", "comment": "Malware payload", "value": "2fc1967d810068ebbd563dc910d80fbdc7b602ac1a9be624bbdb42ac07628f7d", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395376, "uuid": "39f89057-8e2d-40a4-a511-a5e33a71903a", "comment": "Malware payload", "value": "e49662b0ab8e59344266f9b8de5eab73aefb660e", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395376, "uuid": "90e5e1e0-bdc9-41f2-9306-8421303d59ef", "comment": "Malware payload", "value": "8ee90d325145b22819176942e10f161d146aab864d3c745042cfdd6c0ff39d5f0fffbb2b63d77d437ad6fa380a6bc4df", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395376, "uuid": "f5a7df70-075c-4ad9-8653-92d415dc7ef6", "value": "T1B23733A7E6004C26E489ECB17E90733AC7A34EDD8B8BDD98F4567E101EB91B14B3542C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395376, "uuid": "936a9f89-9cc3-4614-868c-b92f6c792a4c", "value": "393216:+xHPywoe/5UF6y8bQwIFTPKKowA2L6ZpraKJ0o:+Fto+e4wTPlsTZpOKJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765395376, "uuid": "38e0b9b0-53d7-4126-95ac-3456d6c5a78b", "value": 22837248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765395376, "uuid": "d57cc40e-2451-4112-bee1-5de7c9012f97", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395376, "uuid": "cbe9d926-2fcd-40dc-a627-ce436ae1f1c4", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27798482-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350133, "uuid": "acba4d0c-f5d1-4d27-a30c-290ee2f89fe2", "comment": "Malware payload (MaksRAT)", "value": "a1972c5bf3392976f02a39e6ca1c326e", "object_relation": "md5", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350133, "uuid": "d96f29c0-6728-4f91-892d-5e0d0d96bc3e", "comment": "Malware payload (MaksRAT)", "value": "30b36cb1cdf13194fc7eacbf1bb48ef007c780e7093876095d5ee33b7165fb1f", "object_relation": "sha256", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350133, "uuid": "c5003c09-4bf9-4523-a181-f223545f3d4a", "comment": "Malware payload (MaksRAT)", "value": "420c82c2b883d583fc7100446685ea5a58310433", "object_relation": "sha1", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350133, "uuid": "1590c300-f9df-467c-95e9-11d1c68e392c", "comment": "Malware payload (MaksRAT)", "value": "dcd267b9ec77751db8ec779b9e4b30e1b2b82daae9fad3e15d8908c04868aadaa8b6b12f1d44e7505f43c181137e7b56", "object_relation": "sha3-384", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350133, "uuid": "7cf59ac7-6ca3-4833-95cd-898dc66ff45a", "value": "T1D0E2F169B8389ADCE74F8EF633928584DCFC45AC6F9D304F6BF61A4640E058105E52E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350133, "uuid": "24508f3f-410e-4818-b5bc-4cce742a64c6", "value": "384:KhFI4NYELuzu6LTIL/2k6l8a047aYeGnqnkSDnAB9WmRWkYCC1IQ4aeQ8ltEoy:KhB5LqOr2VuaL7fPv1mCC2Q4bQ8ltEoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350133, "uuid": "c20e1a86-6a32-491a-8a60-4e0ddc43a183", "value": 31931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350133, "uuid": "ceaaf672-9244-467d-a9fe-1bb9b0e429e1", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350133, "uuid": "6b8b054f-dede-4864-acfd-c800af2ee6e4", "value": "30b36cb1cdf13194fc7eacbf1bb48ef007c780e7093876095d5ee33b7165fb1f.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a3a0c9-d563-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765328519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328519, "uuid": "e03389c5-377f-4ed8-8e8c-9c7c5677c90d", "comment": "Malware payload (Mirai)", "value": "9041dd8fe301eeeabbcaefacdaaa2f34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328519, "uuid": "d66f6667-e2cd-444e-adb2-7704f7ea9cb7", "comment": "Malware payload (Mirai)", "value": "30b69b80e548c6e326fa090c9627ced120324cb4bd3a9c4070d8e2c54a1c6fb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328519, "uuid": "68c049ae-8412-4f1a-a40e-916f58e82c64", "comment": "Malware payload (Mirai)", "value": "d5044e0d1c330e9c272d910740c96c9889523db3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328519, "uuid": "8b59b915-b39b-4eee-8d7b-075a2db85988", "comment": "Malware payload (Mirai)", "value": "fca1419c1036f757eb01b51e75a56cd40510539bdaf84c7f967f9c60c692072e0c686f24628eb1c5925f48356cd20d14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328519, "uuid": "9a3bddf7-ac0e-4c23-a65e-d315c0c28fe9", "value": "T101C3AF73D42A7EC4D1554030B8B5FEB51B61A5C041935EBB26E9C87A00CBEA4FA0AFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328519, "uuid": "f2a89e9e-1017-447a-8cc3-da8419e847bd", "value": "3072:hfpZykqkt436I+9eIHpmNOkSMPXeC4GnHy:hRZ0F3BcgNOkvZhnHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765328519, "uuid": "eab91023-20c4-405f-a5cb-89b518a5f640", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765328519, "uuid": "045b3853-b890-44be-8b37-29ca3d56b5fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328519, "uuid": "7e1134ea-8beb-4b6b-8369-f09d795b4e9a", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af545c7-d568-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765330435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765330435, "uuid": "ea84e07c-e2df-476a-9e37-bc1ec141d43a", "comment": "Malware payload (Mirai)", "value": "ba5d74a3a0a24b664ed5fef110aea48f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765330435, "uuid": "4b52ac03-09a3-4ed7-8176-e36ac7d0ee3f", "comment": "Malware payload (Mirai)", "value": "31d344ad3851fefecf6deb9b041b002a399bf107180df58176f843af47fefe8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765330435, "uuid": "cab2ee48-36d7-466d-8ad8-732a18690408", "comment": "Malware payload (Mirai)", "value": "2076dc6d1c79c2bb3c8cb90167e12f52f4c09d2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765330435, "uuid": "f3b16856-279d-4d15-b108-e348e9bfa1cd", "comment": "Malware payload (Mirai)", "value": "862fe2fdd54f87747a60e5e1bf0043340f97095a8edd6b1a6d69ec4ab97fc61af6d1bad1cc72bbd9b9eb1e69e262d1e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765330435, "uuid": "6c1890e3-2904-4356-bf22-00eefbca7e3a", "value": "T1FE14B606AB519EF7C8AFDD3305B9874124CDB05762A43B3B3674C72DB91A90B49D3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765330435, "uuid": "c35419e9-dfe6-4d51-8bc3-5cb712efc4bb", "value": "3072:ExRfbUjmP7CxU6YF12RLdv/ZKu6KH6oS+Vs:ELojcL1+3l1HA+Vs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765330435, "uuid": "db7e460f-a6f7-481c-8a35-2a225fd74df8", "value": 202448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765330435, "uuid": "c13e4c85-3ad1-4da1-a554-f3b848520f3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765330435, "uuid": "a113a7e9-7355-44f6-8122-5fe28597897a", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b95534-d5c7-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1765371343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371343, "uuid": "fc8e9590-7655-44a3-81e5-937a458c97ea", "comment": "Malware payload (Vidar)", "value": "2f8613e39d7b76406eeeac85987335e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371343, "uuid": "31ff07e4-0965-4b0e-b968-ea1cb1f56909", "comment": "Malware payload (Vidar)", "value": "31d88da8346d6551334e5f69370fa05fe3e25717ebc4114ffcbbb114cc8247a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371343, "uuid": "76f12418-d4f1-4577-bded-9cdd941e9aa2", "comment": "Malware payload (Vidar)", "value": "cab6c6e46d1713a6982a834874c3b099d6265469", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371343, "uuid": "11f0db5e-c82f-433d-a4eb-c558f35fa479", "comment": "Malware payload (Vidar)", "value": "b4e484901754d90c091f11f7a73084d53d3475b4ea6c301e98a79916c61e7b094fb058483813cecf28f7c3f66794bff0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371343, "uuid": "543406ce-dffe-4fd3-b0ea-6e2aecbe9086", "value": "T1795506796550D259FE3880B940F6965EB130723286712BFB0160E263EE1B5F1DFC62EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371343, "uuid": "f301dd92-37d7-4845-aa75-3cfb322e25c5", "value": "dbfe5404d795f14f30cad00e83dfa47e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371343, "uuid": "bf7c2556-d99d-4ba6-bbed-924db527adf3", "value": "24576:Nu91Doyv6Vzku2zQMGk0RAQMJiqMx3kmP40+6XjPF1IadcelPTJ3jvrNhp2Uok:vxxyQM10ud2LA01X51dcelLJ3/p5ok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765371343, "uuid": "87996af3-f6f4-45a9-adf1-29792bc84225", "value": 1353216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765371343, "uuid": "420ec0c9-3b48-4ac8-b01b-1a85b44fdfd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371343, "uuid": "e7a43ed7-7eb0-43ca-bee0-2b61a324a996", "value": "SoftWare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76639c27-d5ef-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765388490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388490, "uuid": "ea032c6e-cfa6-4248-bc63-8436e2cadde0", "comment": "Malware payload (MaksRAT)", "value": "2f95977181b9ee74275aef9ac25ad62d", "object_relation": "md5", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388490, "uuid": "97a3315d-e7e2-490c-bf79-94494abfe9e1", "comment": "Malware payload (MaksRAT)", "value": "31e13e30288949b1aae68b0bbb24b97831c9a2cc32c039d39d51aa4dde96ffcd", "object_relation": "sha256", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388490, "uuid": "d71f49b2-f8dd-43c7-a14f-1482c48349af", "comment": "Malware payload (MaksRAT)", "value": "f78497eca913c8cdcef75ab9a8d3e512c175670a", "object_relation": "sha1", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388490, "uuid": "8d77ec53-11e4-44fb-90c0-04de0036ffbd", "comment": "Malware payload (MaksRAT)", "value": "1aa5c697c7edb25f712bd4eef55ad75f69c8ec1119164faeaeacf05de1cf6c68d2b0683345a0dbcdc5789cad78a47cee", "object_relation": "sha3-384", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388490, "uuid": "adbb7fda-4423-4f95-bad7-56107ee5a0bc", "value": "T164E2F1757BACE22AD10F46F3516FA642934AF03CE84B963A2BD2CCC7B52065C41DA499", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388490, "uuid": "2a3f56eb-1ce5-44e7-913f-71696b6dcafd", "value": "384:Q3IVVymN52mwqrEY0s3Sct9k5+12zc11aDyqq3gWS4oC9ObEVSuWb1W/pFZUizIs:QY5losPnk5vcXS7RWShoOQQYbzICblKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765388490, "uuid": "907f0195-2e07-4e16-8fcc-0f65b68cf2d2", "value": 32006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765388490, "uuid": "cbbb97a2-1053-4879-83b8-2adb7bdfe651", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388490, "uuid": "4607340f-091f-436b-aab9-4b4a42737356", "value": "31e13e30288949b1aae68b0bbb24b97831c9a2cc32c039d39d51aa4dde96ffcd.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f809a9d-d5ef-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765388479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388479, "uuid": "630272df-3cda-4591-b6f1-396f4298bb3d", "comment": "Malware payload (MaksRAT)", "value": "32a0b08b03949bcd887f01d6b836fc75", "object_relation": "md5", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388479, "uuid": "9a0e341f-aba3-4d33-9b74-44d722217d3c", "comment": "Malware payload (MaksRAT)", "value": "325736185bbdc17e6357aaef35789fcb76c6cb13dcd64583bc4c8d930a3f7cef", "object_relation": "sha256", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388479, "uuid": "ced7b216-3d5b-46ef-8383-1bd32a641083", "comment": "Malware payload (MaksRAT)", "value": "96e3674b883353ba49a4877304c7b787f83b9e76", "object_relation": "sha1", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388479, "uuid": "38217d43-334d-481b-9c1e-6423aa6aa6db", "comment": "Malware payload (MaksRAT)", "value": "7e7e588ad12b850f1d1d34f864a3c6275ff05e62d57041d33829e35bbd2c6872195643fe8c368195e4fbfc7247c1d0c5", "object_relation": "sha3-384", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388479, "uuid": "b6fd1dcb-06c7-4731-a4d0-9da097673090", "value": "T1CBE2E118BA7145D4CA87D1B9DB4243D23D6F05465348630E9EAF8D4A4AE2EF143BECE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388479, "uuid": "8b817d2e-dfbe-44f4-baee-077b9c0466ca", "value": "768:OkXodZUYmTZ2ZqDuWOivfdNdXxINy5/cZJRL7e:OkXoBkCqDpzUNu/IRLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765388479, "uuid": "9c0eb9ee-bd10-41b5-8c48-0136988e1636", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765388479, "uuid": "e081bc35-9c61-4a1f-b09f-2bb4cbce0dbf", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388479, "uuid": "302c8bab-36d0-4797-bdbc-03d9f536e151", "value": "325736185bbdc17e6357aaef35789fcb76c6cb13dcd64583bc4c8d930a3f7cef.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8d9dc9-d5c7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765371351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371351, "uuid": "27dc10a1-46e6-4791-9303-c604547aa061", "comment": "Malware payload", "value": "b7555d45ec31adc23ea13ff173926251", "object_relation": "md5", "Tag": [ { "name": "Albiriox", "colour": "#99D399", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371351, "uuid": "2ee6f133-90d8-47fa-a86c-b63fc65877a9", "comment": "Malware payload", "value": "3269a0116ce0915afdd32e8d87b05ae9f5c00fcf0a6729add39a6a87aaf30089", "object_relation": "sha256", "Tag": [ { "name": "Albiriox", "colour": "#99D399", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371351, "uuid": "a6c24e0e-af89-4bde-a032-4c7d8f298938", "comment": "Malware payload", "value": "eb53b2e264c2eb9561b75ece770a259d55319820", "object_relation": "sha1", "Tag": [ { "name": "Albiriox", "colour": "#99D399", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371351, "uuid": "61715636-9c23-4545-a193-9cd81fbcca9b", "comment": "Malware payload", "value": "df637f3c5d2004a587f4931adad975b52798c1df8890f247146d324f0026fb3c3baaea6904a2f455d8515ed92d1dffdf", "object_relation": "sha3-384", "Tag": [ { "name": "Albiriox", "colour": "#99D399", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371351, "uuid": "606e7a4d-423f-43d8-aa62-087a0d571c58", "value": "T11076E08AFFC6989AC0F35B33CD7591B541475C2647838A836D58B26D187B6F08E4EBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371351, "uuid": "b8f373dc-b4d6-409b-b0a1-2cc178a0303f", "value": "196608:ymztyyGUWebdmCr+0B7ed2HoCdKyOG9cw:y0YUWepr+Ac2H0yOG9cw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765371351, "uuid": "61628b0f-2f87-4d78-9dc6-926f2974a8fd", "value": 7258245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765371351, "uuid": "7a7a6a51-2ab1-474d-b319-d1470dabf0d2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371351, "uuid": "c0170927-390c-4c86-ac92-db8a082de3d5", "value": "dexopt.sssgf.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d25e739-d564-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765328748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328748, "uuid": "71578177-820d-4c4c-b873-43b5be32bff0", "comment": "Malware payload (Mirai)", "value": "4828deaae0dedd28081941cbecf74ca1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328748, "uuid": "00825f86-e12d-4ce2-9de0-9d1ed6302b2b", "comment": "Malware payload (Mirai)", "value": "328db67686869dd1c02ba032fcc580ffcf0e37c40633dce534afb5d8fce25e13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328748, "uuid": "18c9add2-5ce1-4caa-adcc-82e37a37783d", "comment": "Malware payload (Mirai)", "value": "5e7e2b797ec57d0f1810badea327a9060bf06026", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328748, "uuid": "d790fe1c-80f4-42b7-a1b0-067cebe7697a", "comment": "Malware payload (Mirai)", "value": "5e58915acadcf152374ce0b0b20f92bb09ca5cf6b4600bd8b23c3e0e6550a30f3c5a7da165f5858491091623bbbee00b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328748, "uuid": "21dd58d4-3246-4f07-99de-02947d61f9a9", "value": "T186E3E709BFA11EF7DCABCC3705A92B0528DC595732A93F397A34D918B50A24B1AD3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328748, "uuid": "a7bccb36-e8e6-44d4-8042-82127538a0c4", "value": "1536:AET6iAN2TbE52R2TbA2z2Tblw1QhG5ZVWcFyhoTL0Qo6Gv+3eSQ01GZC19ZbKqJv:hT6iAmbGNFyRSQ819VY1wia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765328748, "uuid": "528e46e8-2829-4816-ac56-23a7958985cd", "value": 149248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765328748, "uuid": "ad508a52-bc2b-4f3f-ac5d-42dc57d07491", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328748, "uuid": "c1325d44-56b7-4230-affe-c77e0d0573ec", "value": "colonna.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4799c9-d57d-11f0-a129-42010a9c0007", "comment": "Malware payload (AmateraStealer)", "timestamp": 1765339434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765339434, "uuid": "8dcceacc-7ba3-4615-9b2e-d82a4e5ea921", "comment": "Malware payload (AmateraStealer)", "value": "1359883624bf37ed0c4de99adb60551a", "object_relation": "md5", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765339434, "uuid": "94c498e9-5793-408f-9158-f7923c2848d3", "comment": "Malware payload (AmateraStealer)", "value": "32ba5227ac8a3c469d98a01b65345c904300ec140d505f777ecc6c1c7c9ffc1d", "object_relation": "sha256", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765339434, "uuid": "93b31b0b-5257-424b-91d7-1ef28cc16582", "comment": "Malware payload (AmateraStealer)", "value": "8609a63517647585a1f071190672e1b882d0b3f1", "object_relation": "sha1", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765339434, "uuid": "a7af272e-f22f-40b7-ad48-9ea5857bed9b", "comment": "Malware payload (AmateraStealer)", "value": "24289318af408604e28558e35ac0be2085c8d3208de431c4cfaefad5806244954a6a55aee90fe6785ca97192dac43002", "object_relation": "sha3-384", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765339434, "uuid": "d57ed2de-1f56-4d8a-89a4-62cfa53dab56", "value": "T18093411C09FF04E629D225A1DAEF016BAF7818568764C7A47B6CE2606F90FB0D1F93D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765339434, "uuid": "991f1b8e-e9c8-4a0b-8240-f621884d122c", "value": "768:Xkq/cxRvNhrXf7vCtmvm4jJaLvkdjUMBpcdwBR58WcI9OLGbiY0AUK9/WduJso4v:Xkq/cvrXbZCbe8WB+dgJn4LngsqIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765339434, "uuid": "94e7e433-d007-49ea-bacb-ba0ba0bda05d", "value": 94584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765339434, "uuid": "944830c7-ec72-4b39-a1a0-3a659fe184ac", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765339434, "uuid": "5fcfc7d9-40f8-4c7f-912f-a878bf66ed85", "value": "Network_Fusion_Project_687.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2544439d-d617-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765405534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765405534, "uuid": "69f3c278-f284-461a-9708-4f56fbbc2e47", "comment": "Malware payload", "value": "be5d6acb6a45af0fdf9bb872a574c53b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765405534, "uuid": "7c3556f5-d4a1-49fc-ac58-fb780fac8c50", "comment": "Malware payload", "value": "34815509d7ce6155f97ac68c876192572c5f0683338d75fa7045610d001c31c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765405534, "uuid": "52923591-2edd-4e8a-a231-aaa6a8d8cd76", "comment": "Malware payload", "value": "7054db0a0114cc3c2b31a3efe6e96b43334da5d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765405534, "uuid": "deb4a3e9-e47e-49e2-842b-899223cde3ac", "comment": "Malware payload", "value": "f534d0ad777db02ccf7fbc8dda711a27aafde8306036bd3de272f38a734b950d224c5bbceef5249769eaabcd500737c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765405534, "uuid": "9165672e-7ff0-4fb6-95a8-17f5c1e15332", "value": "T173B13309D207A6F2CE461C7215CBE9AFAF307A74D472CD05FB609E526B53C2E5A08F19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765405534, "uuid": "d11dde3c-ba08-48c7-ab7f-ad1870843da9", "value": "96:Cwf6foVqsk3b8Jf5RaL1dRmGgh8wpE9O79r5x6vME8:tbN88Jf/+7+h8oEMjxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765405534, "uuid": "ec09090e-9bcd-43b5-bcd0-b359598a80ad", "value": 5440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765405534, "uuid": "91da9865-a66e-409c-8a88-a3460a1d03d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765405534, "uuid": "0288bdae-56f2-49ff-9b17-e17d03d4cd33", "value": "SecuriteInfo.com.Trojan.DownLoad3.40744.7478.15297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1967c343-d5b6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765363853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363853, "uuid": "b7e1fc9a-0ce7-4884-ae29-0151addb6786", "comment": "Malware payload", "value": "182e9cdcdc5efd6f2518c62ed99608ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363853, "uuid": "b95a79d0-f06d-46fe-8f83-110b017b608c", "comment": "Malware payload", "value": "3518b109468241d258fdbf07f3558ecd079cdbc596c69b1772546a7fa548fbbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363853, "uuid": "d8b6eb54-fa44-4010-ac08-d7183530566f", "comment": "Malware payload", "value": "cdc28651621c6578c28116ae8d59f1961bfedaf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363853, "uuid": "9bb5eda6-b0d1-4d5b-bd7f-88173a5264bd", "comment": "Malware payload", "value": "144e051ca4a819a0ed6ba36800e15a3e9f283f053fd7309f1aaeefaf13e1d638a4e9a02d177abac6d1080c2b9b3c1b97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363853, "uuid": "3c7749fd-e749-4975-b9f2-560e67692be9", "value": "T112B62947EC6145E8C0EED1318A669163BB717C485B3123D72BA0F7242F76BE0AEB9750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363853, "uuid": "e5e7294b-a100-41dc-b868-fa36b418e922", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363853, "uuid": "b6b2fa28-7228-4919-ba6f-567bc444c013", "value": "98304:5xZFJV8XZAK2Pshil9HeqDk4KPs/ZH4JXykSOh0EE:5zFMAKc4if+qDbKPAQXykzNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765363853, "uuid": "2af8762d-42ca-4dc8-b49b-b9e32695c2f2", "value": 10612224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765363853, "uuid": "837182f7-fd44-4b25-a763-0748562d9747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363853, "uuid": "745ca06a-a5d8-4ef4-9ba7-cf4b4175d0af", "value": "chisel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4056138b-d618-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765406009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406009, "uuid": "c99c6319-e5a1-4700-bb23-b8ddbc705b0b", "comment": "Malware payload", "value": "1ae624e661a571f48f54e4afc2cad8d9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406009, "uuid": "2526dbe9-f446-465c-b330-d533cdfeb112", "comment": "Malware payload", "value": "3529c06d0771eb00f68db35c2a65b95c6dbeaa5a3cf4ff3302d8dcfde84663c9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406009, "uuid": "c545df61-8bdc-4521-9742-c10696725d69", "comment": "Malware payload", "value": "4d58a167591e6ea13cef48a0bf4aa867cbec9343", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406009, "uuid": "8c00ac84-4eaa-43e3-b94d-da29d5376d10", "comment": "Malware payload", "value": "e03c442c588635961075fda2f0a9c60b079f020840de795ac6f32a26c850295d30f36e764c7f54db9eb159cf09ce162e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765406009, "uuid": "22071a25-14dd-494b-aadb-cf6ce1001722", "value": "T1DC161452373A5061D8E2C2D1DBFD4D035AAA8E5FD690100C774A5BDD2BF7AACB05822F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765406009, "uuid": "d109f11b-43d3-4eef-8264-bf00a35b201c", "value": "384:173bzeOtTeUZaoiKPoJRR23OXpGdq7qrMrQ74k9hZepfCw5he:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765406009, "uuid": "c836ca32-8564-40b5-8677-38e19d39cae6", "value": 4214872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765406009, "uuid": "1551cda9-e788-4d72-97cb-a2bef129808a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765406009, "uuid": "5064a43d-a791-458a-a66b-282347dd920a", "value": "\u043f\u043e\u0442\u0432\u044a\u0440\u0436\u0434\u0435\u043d\u0438\u0435 \u043d\u0430 \u043f\u043b\u0430\u0442\u0435\u0436\u043d\u043e \u043d\u0430\u0440\u0435\u0436\u0434\u0430\u043d\u0435 2784-571_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361f93ad-d598-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765351016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351016, "uuid": "12d73d9f-a8fd-48cc-80a8-9efb96602eff", "comment": "Malware payload (MaksRAT)", "value": "400d9959ec3abc68ea8d7fc3eeadcb98", "object_relation": "md5", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351016, "uuid": "7996da66-1733-4dbd-bc9d-d4f2706b51af", "comment": "Malware payload (MaksRAT)", "value": "35776905c2a9d206f4eabc1030f0ba4151817a4736e2dde455f58a2587f72ac1", "object_relation": "sha256", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351016, "uuid": "ab7b3660-35fc-44f1-875d-15de24407bb7", "comment": "Malware payload (MaksRAT)", "value": "0e5a1df64c092ff7396f81b0939f0e462cdb2871", "object_relation": "sha1", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351016, "uuid": "c2e58111-4b0a-415e-9ebf-8536b9aad5bd", "comment": "Malware payload (MaksRAT)", "value": "5c3e5879a966f6991d3cccda71436eb9af6e8c22498ca8026718aa14d2e574c0c40788c9e9aaefc5e9f3d17204d5c561", "object_relation": "sha3-384", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351016, "uuid": "a79049d8-aef2-4417-8d6d-fb7a2e34945e", "value": "T1E5F2E1490EC0477BEE4BEA3901D48B60A7DA7678067AC1D2EB34F9B71C4CF9984768D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351016, "uuid": "07e0f38c-7edf-4a52-8a16-33b1a3f5deb8", "value": "768:l55oa4fPbBwWrWr7+U3hqiNPCxpGSaRFKTQ8ztcRp0iJf5mk:l7X4HOWruhqiNPnFkRYp0iJBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765351016, "uuid": "0c17bc7c-9539-4a3a-a2ff-ea8048bd2c62", "value": 34345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765351016, "uuid": "7ed68a4c-f0e4-4dee-8c14-331d39997032", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351016, "uuid": "5711b6a9-17d8-47bb-815b-572ca58f00ef", "value": "35776905c2a9d206f4eabc1030f0ba4151817a4736e2dde455f58a2587f72ac1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb6096e6-d623-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765411020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411020, "uuid": "092227b6-46e0-4e31-b9df-0e72dcf6b3ed", "comment": "Malware payload", "value": "469dbde7232c512bdfe320495ea9105d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411020, "uuid": "9341fde9-7a73-427b-93e7-2cf4ced51ce1", "comment": "Malware payload", "value": "3581d01d8bfe67fbd3b38670adea713d8ea141f9c48c23d3502897490fb5063a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411020, "uuid": "0bfd106c-89a1-411a-953c-e58dc908dfab", "comment": "Malware payload", "value": "6139c407f0757af62bc57ccec0c40f30f5dc3eee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411020, "uuid": "3134617f-ae52-4903-b9b1-8ae0d6fb51ef", "comment": "Malware payload", "value": "6bb8ecd780f08caf90b5d9b6e1fa9003b79a3babc881de1b9c11d57993e4575aa38e8179e3d16874dc17089858e9c4b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411020, "uuid": "7339338f-f1e2-4732-a972-783227687925", "value": "T1B69328A2FD01EF66F00A8A3A05C707256630FF660B931E7173577A669A763C47427F0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411020, "uuid": "16013411-be13-4501-a24a-0dc2a4187f56", "value": "1536:FMYzNAAzqboilQeO8Growh9GXQgGUDeMIrebtw7iXcevzIHUIN:FMYZ1GoemP4Agvxbtw7iMey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765411020, "uuid": "a8b38bc8-b288-47d5-8482-537e08b542eb", "value": 89369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765411020, "uuid": "fa0e44b7-d9ba-4382-a766-d6c653a23547", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411020, "uuid": "c7def7ae-c221-47d9-9d2b-5214bce35eab", "value": "pftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff701dc-d600-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765395620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395620, "uuid": "f462b72f-fcd1-4104-9fe4-df0bcd9dc2ae", "comment": "Malware payload", "value": "7b63ebffa2f8500c8bd6ec1dcc078656", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395620, "uuid": "cd5d9af7-0bb5-4156-a3da-b22f7ee02d66", "comment": "Malware payload", "value": "35d622793e0db201e894fe8abd3f0cc78f1074d6328b1ba23ae6a99bddcb520c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395620, "uuid": "33209f1f-2a12-45ac-89fc-6e107bc6ca7a", "comment": "Malware payload", "value": "23872683e5cdcdbf8fd044f5a47fe2f6ad6471fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395620, "uuid": "babcb3b8-9267-444e-9cdd-48b9a84a15c6", "comment": "Malware payload", "value": "8f41fd2bc6e8e788e89efbbf61d9608545c59c497c5a9aa94c2a90a0ea21152c1c00a57f072e09e1702280d8276af598", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395620, "uuid": "d741a2eb-631f-471b-8e9b-cbc5e9d6f1e8", "value": "T17AD41963F46892F6C7B86132F147E63F2A0BDE6166018541B3F13F9E3AB6A651710B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395620, "uuid": "23547fd3-45a6-49e2-807d-6911fb78fdfe", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395620, "uuid": "961d1004-8758-4b96-bfb6-5c07c5b2dace", "value": "3072:LEre7GjyCaFvc2a/GFGtmDggggquWbPvZmggg7gfg8Zyac+VvE9hVPqB:LPXBMdGABhVCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765395620, "uuid": "09006bdf-b85c-4ffd-a9da-283ca0c0c923", "value": 607752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765395620, "uuid": "f1321b9c-ccb4-40fb-b8bc-622b073d736b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395620, "uuid": "052d6a49-6883-4680-9c04-1c3ec7d0080d", "value": "4qy30dsd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef13cfac-d608-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1765399430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765399430, "uuid": "8f65e67d-5cfe-4aa6-a490-e8f5534900b9", "comment": "Malware payload (QuasarRAT)", "value": "b2fea61ba10c2bee3923bcbb2265222f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765399430, "uuid": "e742577d-918b-4c32-b97c-3cfee83d850e", "comment": "Malware payload (QuasarRAT)", "value": "3677cb257e0a44363a98879ab3570f48114f35cc10e340a861aae098dac34df3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765399430, "uuid": "087a4a88-3005-4c4c-b664-bf44a25ef3e2", "comment": "Malware payload (QuasarRAT)", "value": "cbe42c04db96298b0a8754b90bfcd00550cd87e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765399430, "uuid": "b6f0d5d3-0255-4cc5-84d5-c75b4f1ded88", "comment": "Malware payload (QuasarRAT)", "value": "3d52082edf7e6ee34ac97f0f9e8f2b764dcee841ba94e0aef213346159bbc4a608e8c8e6d9c9794773bc94b607c25c17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765399430, "uuid": "1663c8d3-c4e2-410a-bb33-70561f2d21ee", "value": "T12F15F111BBF8C603F1BE5FB5E4B646444BB2F8439A67D74F0988A0A81CA6341CE91777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765399430, "uuid": "e59a4dc1-4bd7-4bdf-8916-a452a8ec4b2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765399430, "uuid": "f23530c5-5608-47be-b5e8-9852ba3ee2f6", "value": "24576:YdDl5UISWHIPbcNK0KKfaOwI55l2SR8j:eDlKKEgKKHwCBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765399430, "uuid": "6f73b351-e1fc-4117-aeb3-c6e20cc142c0", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765399430, "uuid": "a3bd5a49-746b-419d-be31-3cb5397c0fdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765399430, "uuid": "ebbe0262-a6c2-47ca-9621-31cc26b07368", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d429da1-d605-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765397978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397978, "uuid": "d98fceec-5af2-4267-831b-999511888800", "comment": "Malware payload (Mirai)", "value": "2e9f5173ceac42fef499f5c2f3ebd565", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397978, "uuid": "163b7fae-8b24-4772-96f0-fd6e4005e90c", "comment": "Malware payload (Mirai)", "value": "36c0e2b89c825fe89f5d8e0c914f9e0252cd11a71a31c6ff2571af6bc63686d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397978, "uuid": "fe80cd94-2222-4b4d-9dee-1227f2f91d4d", "comment": "Malware payload (Mirai)", "value": "5836ba0d2fd2a3e4f18d955b571c55df01da4101", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397978, "uuid": "bea4050f-8382-4f5e-b3c0-1742b55ee91c", "comment": "Malware payload (Mirai)", "value": "088a2824949956494e0e7b47580f33d0a2da859d33e2d40efca96d0af66359601d4e4dcca989e825aa1120b707ceb720", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397978, "uuid": "6e42b274-36e3-4e98-b4b0-866038d7cec9", "value": "T180934C02B70C0A47E1275DF03A3F27D1D3EE9EA120F4F684651EAB8591B5E361686ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397978, "uuid": "63c86d70-9a0c-4684-9766-585d8339c7e5", "value": "1536:kW12yh+TrTrLhi6CbWW0jgGCZaWW+U+1d3w1LZY2K86FwGwvBJ7/Hph:DTATPM5rUKcZt6krv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397978, "uuid": "60c8fa87-2071-4815-b6be-3e7307b11d69", "value": 89496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397978, "uuid": "c798da11-f651-4ecf-9339-d06db148c09d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397978, "uuid": "b5c453f4-87fb-41e3-ad53-c1537ee02fa0", "value": "Labelloperc80.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27405f46-d579-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1765337677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765337677, "uuid": "723685c8-0e2c-4c61-a290-34f2aa4b2c4c", "comment": "Malware payload (Joker)", "value": "6b8710260e337b7e01803dd83c859305", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765337677, "uuid": "5fce6dfd-438e-4b76-ab5c-ce93a391f667", "comment": "Malware payload (Joker)", "value": "37281f1e125790d109a466a1d5fac64af27cc1e9cb978965ea7b3bf6b38a6a8c", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765337677, "uuid": "b91b3521-c5f0-4fc5-826f-50f06778b652", "comment": "Malware payload (Joker)", "value": "50d004ac3bb7eeee100664793e257a25cf8a8727", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765337677, "uuid": "bfc2a4f2-fd79-4e3a-9bc0-309d13d3e3e9", "comment": "Malware payload (Joker)", "value": "8987ec7665f7e0e7abc2d2ba48cb9756e7170c88c8e3639b0e9d609f7426608087685f71fe3c01b8e8c6dce876c4a553", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765337677, "uuid": "6fc5140e-aa22-41df-a3da-386f82adb73d", "value": "T164271206F70CDD2FC8E7B434AAAB035161126C9D965183979A15F128BFF76C88F1ABC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765337677, "uuid": "e5ec5271-d6f3-4790-ae3f-9d7bcb284850", "value": "393216:B6ss0u9beR/O0+ZVdkPN5vQ3LY+B99b+APgBH/B+/:B5svKw0ljv5+B99+A2fC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765337677, "uuid": "4ceb7ea2-f6e8-4a9b-b71d-7290d426645c", "value": 21569042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765337677, "uuid": "ffeb46c4-8a70-4b9d-a7c4-3be6ce817169", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765337677, "uuid": "efceb576-71a1-4f6a-88d7-8542cd30b654", "value": "Go+Space+Cleaner_1.0.11.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a469313d-d60c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765401023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765401023, "uuid": "5328d83c-26fa-413b-a488-c141fe8a19dc", "comment": "Malware payload (Mirai)", "value": "573b90618c693816cfdacfeb6a283cf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765401023, "uuid": "a99f173f-2ca4-4826-b298-99966b49a5c8", "comment": "Malware payload (Mirai)", "value": "3762016bd796d753b238e19e8f25e224fb2e85255ececc2941114f62dcb38b77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765401023, "uuid": "034e271b-6549-494b-99ed-4464bff342e9", "comment": "Malware payload (Mirai)", "value": "259d393c17b6a2662c23a08233fb8550a7236d49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765401023, "uuid": "fe18554b-001a-4926-9a79-f21aba93a448", "comment": "Malware payload (Mirai)", "value": "bbba1f525d5ccea82b8d8ff31e525922cc3e05731cd0b4315b323a9ed8705f7bb8157492b338eef307c8fd54bd4320a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765401023, "uuid": "414c50cc-4ec6-4d4c-8cc5-6db9d2bfc7bf", "value": "T1B673E786B881CA25C5D952BAFE2E51CD331317B8D3DF72139D106F647B8A82B0E7B911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765401023, "uuid": "a170cc98-686f-4c6a-8597-3e34c7b5b83e", "value": "1536:o9nLxGGtSidx6Z1OGnM7pKx6zU808602Nwtpy13zMOin1kW2/55T3bsR:irSMKIGw40MwTmW2/55T3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765401023, "uuid": "f94dd73c-f106-4314-9beb-625c38120815", "value": 76324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765401023, "uuid": "3fda9940-b8a5-48d5-8928-b39c79efc080", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765401023, "uuid": "199096a1-6c3f-4cda-b33f-6eff449e88e1", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc642d8-d5a7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765357549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357549, "uuid": "1824d3a6-cf63-459e-ad4b-1202ae866240", "comment": "Malware payload", "value": "9745ac2f0e1dfe42e7f3e1f262c72148", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357549, "uuid": "f93df317-0481-462b-ade1-63f51fe58e9a", "comment": "Malware payload", "value": "37c72ba7697589aac2275e9f44de1e821aa4ef8ad7b54f6db91339681457aec1", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357549, "uuid": "c2a0d982-4fc0-40b0-b4f5-6acf7191bd4a", "comment": "Malware payload", "value": "13f0dd6f4f4e6d6b58735e0b7fc430207f178a0b", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357549, "uuid": "66a05cf5-bc37-42f7-95ca-c9395d7df387", "comment": "Malware payload", "value": "bdd6c364306ca96c613a9b21ab36278fcc4dab8a7202107d5f5356263270b36f3f4b99de53097a95d91b2bad1451a0e2", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357549, "uuid": "1f87a124-5274-4244-a10d-baf85f1d5ccf", "value": "T189520038A546313842F3573B9E529015FDDB027B464E2958B86C82446FB932FC7A0FBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357549, "uuid": "e8fb1364-22a3-426c-9705-0f6ca2d30aa1", "value": "192:eFFhayc0T4cXXlkJC64EHNNoHNAkzWpA7KGZpOh+yhPkgKxexFVsXc:ePftlWowpjcXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765357549, "uuid": "5bff7bdf-6cc9-491d-9d0b-bc8d6ab0cdf1", "value": 13720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765357549, "uuid": "040110ad-5509-4b79-8ff2-ca07f5cbb777", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357549, "uuid": "c808b014-12ce-41f0-b2de-d26176770e09", "value": "t1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2fa2ce-d5cc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765373392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765373392, "uuid": "70895c93-2f54-4014-9e7a-5a8515ae69e6", "comment": "Malware payload", "value": "c68bd16fa5201afbf612ed612fe36586", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765373392, "uuid": "d72be15e-5e70-4133-943b-dbb79e824e57", "comment": "Malware payload", "value": "38346fbdc7b234d17e12d2608bf87806de05561e5e6dcdfd6a81f76dbc5c8a09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765373392, "uuid": "ebdd8c2b-4d4b-4e74-a8bd-8a3474424d94", "comment": "Malware payload", "value": "f8f3208a70ec6de27002aa585192178cd7af4eb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765373392, "uuid": "a84707ae-ac63-470f-a61d-8e41413b03d4", "comment": "Malware payload", "value": "0355d33366ce1d7e7b1a43ac25589c0502d9185bcc637927468d16133b7bbc9cb02f98069b749c33393207c3ea276130", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765373392, "uuid": "7e9f3981-1db8-4022-ae80-fd928d1d0248", "value": "T143F61295D66601B6E9B72635C9B3B613D4B53CDE0230C27F42E4761E3B727212B2E368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765373392, "uuid": "e1f15c7e-d128-44aa-9def-4f3884857a43", "value": "393216:W+GtiaVVjTNYTKbKzOx5MShA9mNr4YTpTM0DzdhfL8l7A:W1FNYxyJA9UkYTpTMoq9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765373392, "uuid": "1b3270b9-1079-4693-bf62-b356272ca0e0", "value": 15575568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765373392, "uuid": "8fc90068-fa41-4420-b0e3-b05a3a2c8ee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765373392, "uuid": "d24d2039-e9d2-4e58-b45a-81eacee41571", "value": "SecuriteInfo.com.Win32.MalwareX-gen.98846583", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c6e606-d60b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765400535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765400535, "uuid": "ff18d4fe-4b45-4452-9d7b-b4f09893783a", "comment": "Malware payload", "value": "a0023254d52f0f0ae306eaa788f4d628", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "getintopc-com", "colour": "#024E48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765400535, "uuid": "3e9875ee-6312-43e3-877b-579716aefcef", "comment": "Malware payload", "value": "383ed6c9cdf8590845730198dfde66cd799ec047ca8850cb5ecdfed293fa287c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "getintopc-com", "colour": "#024E48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765400535, "uuid": "f9262c06-b10b-47f5-b171-3467e3b7b833", "comment": "Malware payload", "value": "43c3058f6c9f64bcc7da8f2d8e0a5da0076b4948", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "getintopc-com", "colour": "#024E48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765400535, "uuid": "a66cf8de-eb63-4a75-bb8f-bec56117c068", "comment": "Malware payload", "value": "ed7d81879608257bac6bb4d860d0830e26497ea0f2c825156f4ab25cc5adbe0b021f449c32eac304393ea29e9651a0a8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "getintopc-com", "colour": "#024E48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765400535, "uuid": "3df786ef-d258-470e-b75e-69a9b9b31bb7", "value": "T120367C31724AC42BD96245B0192C8E9B512CBE750BB264CBB3CC3E7E5BB55C21736E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765400535, "uuid": "c463376d-be26-4888-9c76-6ec86e44c452", "value": "d79dd35f147f0bd91cc18a6615fcfa5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765400535, "uuid": "5d41c6f3-a97d-4e6f-b5e0-b42fcd9a5948", "value": "98304:kAs++BUHecpbpx+sborjZGS/mBRjUOarcqQPV76M:kAKBx4px+sNxnaAqQt76M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765400535, "uuid": "07951019-a538-4b1c-8e55-f1e02624db54", "value": 4903953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765400535, "uuid": "e7f8595a-c650-4575-bb17-cd48123e2dba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765400535, "uuid": "25717b25-38dc-4cbd-8d71-d910e589601b", "value": "Setup_Install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7775db5-d563-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765328524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328524, "uuid": "6296e546-233e-4bea-b32c-b79ad3ceecae", "comment": "Malware payload (Mirai)", "value": "318f4a257625f3fbe3c60e5808ba962f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328524, "uuid": "9f2f4736-734d-4f74-b9f7-204d1802635b", "comment": "Malware payload (Mirai)", "value": "38deb748d2fa5ef68ffebfdc13122062f6d02d75d23ccc5ef52f4b2a9addd4bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328524, "uuid": "b1ae99c8-e7a9-4fce-b61e-6f335863e98d", "comment": "Malware payload (Mirai)", "value": "20c519daa9d87a967b341263105b975a5d248f24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328524, "uuid": "3f94f51a-2260-4853-ada1-b161fb1a4acd", "comment": "Malware payload (Mirai)", "value": "72f2fd19be014a3fab25aea35d6a66cea0e167c0225f58dfabf517116402f9c42b0edd7666e00a54ced27df02be6d3ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328524, "uuid": "097808af-ae3d-4bce-b7f7-ea218e018a37", "value": "T117344B45FA418A13C4D117BAF9AF418A3332A795D3DB730699286FB43B837AF0D67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328524, "uuid": "b59b4be6-8a32-41af-9f8b-d774bacc0f27", "value": "6144:W8tTPA1OBzabKacEK1dAnJd73LfdfM/9hWfAU:W8RA0BzabKacE62Jxp0/yJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765328524, "uuid": "fe200233-7a0d-4243-b899-207449f949f4", "value": 231680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765328524, "uuid": "ab4dc259-e30f-480a-9d01-48b539c59b82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328524, "uuid": "e1da30fe-2f64-49e1-af52-435eb1a4be5e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f2c0d3-d61a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765406877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406877, "uuid": "669af922-4131-42f6-b0d5-5b0a610d4542", "comment": "Malware payload", "value": "c597166d5d4f6410c4fcf664c5863edc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406877, "uuid": "a0c057c8-d618-4123-9941-717846d4dfac", "comment": "Malware payload", "value": "3977af4952de68fa25a4ff61537f8913bb8f36ece977d11fee36b6b5ec6ee89e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406877, "uuid": "32869f6c-6d9f-4114-9d68-3b824f26c45e", "comment": "Malware payload", "value": "53581048851a90440c878ce75ef7b0503c2abc74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406877, "uuid": "50bc741b-7f3d-4626-bf8d-b0ad9a320c29", "comment": "Malware payload", "value": "f891073f1d8b03fb5b2166c86e8f95105666a7282eab072f510fd8b7ccf8e2f80a2aeab805517c7b800b03c9e973c798", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765406877, "uuid": "284f87c7-1268-4639-b28d-2c486aa1ef8b", "value": "T116137BB2C8695D58E94C227474349BB6CB23D110A7C76FFB1519C1F49083A8DB68E7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765406877, "uuid": "c979d925-6215-4862-b3aa-fab44042e02c", "value": "768:5GCC9k8VJiCddI6qkHJAnIl7bMBVLWW7DjUICXH5279RoGju6CduT3bsR:5GCck8biCddFHJAnIlvcAW7fUIu5279m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765406877, "uuid": "9ae4822d-04c8-4891-929a-b520b37cbdd1", "value": 41832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765406877, "uuid": "1c7bac35-fbce-4465-8c74-8806da31e8ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765406877, "uuid": "163768ed-9fcd-4443-ad9c-dcd29dc1e7d3", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a3c1d5-d603-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765397264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397264, "uuid": "7deccc90-8cae-43bd-af77-88945d222172", "comment": "Malware payload", "value": "591972e5b3fed432385698e19cc0c054", "object_relation": "md5", "Tag": [ { "name": "188-137-248-240", "colour": "#F967D0", "exportable": true, "hide_tag": false }, { "name": "AlliAI", "colour": "#D0D488", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397264, "uuid": "3e13094c-7325-4b73-9f29-ebba9a8b44ff", "comment": "Malware payload", "value": "39f9674b361e83875a551bd09a49d0cc152c7fcb70f3a62970cf13a4871b97b6", "object_relation": "sha256", "Tag": [ { "name": "188-137-248-240", "colour": "#F967D0", "exportable": true, "hide_tag": false }, { "name": "AlliAI", "colour": "#D0D488", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397264, "uuid": "0c75e238-5f72-44f9-ba6d-0ad27558cc56", "comment": "Malware payload", "value": "e7e71829adbaf6e59260d4f43d7ab3e88b849bfd", "object_relation": "sha1", "Tag": [ { "name": "188-137-248-240", "colour": "#F967D0", "exportable": true, "hide_tag": false }, { "name": "AlliAI", "colour": "#D0D488", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397264, "uuid": "280d9fb1-1bd3-4c5d-80fc-97bc36127a0a", "comment": "Malware payload", "value": "b7a988b586faee4c2d616643f3f3facc6c98e7a585c5b2c0c90d407cfbe2a7856371e6f8f4626babd408473e79d14736", "object_relation": "sha3-384", "Tag": [ { "name": "188-137-248-240", "colour": "#F967D0", "exportable": true, "hide_tag": false }, { "name": "AlliAI", "colour": "#D0D488", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397264, "uuid": "04ca78d1-58e8-47cd-a599-6600683be80d", "value": "T160D73313B6CE233EF40E8A3D0D97A554287BB975522E8C5796B04E5CCE290912CBEF17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397264, "uuid": "612533cc-7686-492d-805f-a73821f2fa9b", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397264, "uuid": "6783e914-ff29-4a1a-9fd1-81a1a53ab522", "value": "1572864:rMxgawnBvLDvOrx7LViLynK5dWcIPr8dRuE/1RBxc:rMxFwNvwiL8+ds8u01RBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397264, "uuid": "655b51cd-079c-4749-911d-b91f9d7de0d6", "value": 63727808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397264, "uuid": "1095939b-09c0-42a2-a5c2-3836c7f99c79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397264, "uuid": "0af963a0-0b9e-4cf2-8026-308a756a91c1", "value": "AlliAi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75c3581-d5dd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765380868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380868, "uuid": "a67045cb-5f09-42f9-8e17-e23b2b01a8bf", "comment": "Malware payload", "value": "8649cb7e845fcbf497557a104a109018", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380868, "uuid": "ec956c13-0a28-4c2f-9805-605fe439fdfb", "comment": "Malware payload", "value": "3a38dfc3c158a6d924d99f7e340a20967b91803d3603da7591ae32c24fe44e19", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380868, "uuid": "e059f00e-4360-4136-9d4c-3c1c7466e37f", "comment": "Malware payload", "value": "11eeae89173ab37c4204c3ba48dcd837370f9583", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380868, "uuid": "b6549e6e-656e-4ac9-ad24-a4fe74d829d8", "comment": "Malware payload", "value": "a24ce95e36012ee59a0f6355d7a2e90367a97b4a88229850e1b318363599fdcc440a23cde84bfa38f656189c78bf3fe1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380868, "uuid": "10b8c3c9-dc65-4f9e-9e6a-22df19098df9", "value": "T198B173113D24B8780586EDB69D4BAE08F50900FB981E9DB6763C4EEF7FD2690932D44E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380868, "uuid": "ecea4e45-5460-49bb-b3fa-95d31d3231cb", "value": "96:baaIw1D4WgMbujHbqMJmr/dljnLJJT3NeiZysojk7CGrmUqxnMoMLUe:ba/w1PgMbuj7pJmr/dlTVpgiSsXbqxMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765380868, "uuid": "00579068-8737-4442-8523-b60a24c3b101", "value": 5393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765380868, "uuid": "f88df1c8-35f4-48f4-b371-b4d49497ff72", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380868, "uuid": "fd2bae60-c149-4db2-895c-7814676c0bc3", "value": "expod.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f80d4d-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765345080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345080, "uuid": "047d5274-d86d-4c66-9ed8-ebaf98603f09", "comment": "Malware payload", "value": "255cf02d5827362abae6b3b448809d50", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345080, "uuid": "ec312bfa-e7ef-4983-95c6-4718be548d84", "comment": "Malware payload", "value": "3a5d7202d81617932cdbdb4887b281c6c6a6ca85c249652504f74244d94035aa", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345080, "uuid": "c33f053a-c9ca-4a09-87aa-e4482810c4ba", "comment": "Malware payload", "value": "35a39bbf1aa753630d706fa99f00477f7981c34e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345080, "uuid": "7a185a5f-cc15-4a7c-ac26-d0e44664ab62", "comment": "Malware payload", "value": "f1125053f48a6b98c4bf9edd297a6d412e37efcf4a9e1fcd5c0e20f157cf8e59e55fa6f0d95efa5dc5fae5f4086cb6b3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345080, "uuid": "64ead236-a149-4ae4-9a46-51eee2003159", "value": "T1C1D502BB88B264936F504667EA0F2C1E335B19D53B14D346EA41949C6F3B1D38EA2733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345080, "uuid": "765b6ada-dd40-4d53-b68c-eaa2d7d855f2", "value": "49152:cOc2yD4lTPMQrzQqli43y3pIjVD0R3cDNwIGBJ0XIZSkFSiMtJYS/OGtjbWDW:coyEFP9zt3y5KVD09CwdWbi05/OGth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345080, "uuid": "8b8b548d-64d8-41cd-b940-0203575e46db", "value": 2958224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345080, "uuid": "74fbed3b-9db5-4e7d-98db-291626e091d8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345080, "uuid": "9b78cfa4-d23a-442f-83bb-67407a4f8349", "value": "NMC 150325-26.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689557b2-d5ef-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765388467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388467, "uuid": "1f3077ee-b213-4606-a93d-5cdf815c8f6f", "comment": "Malware payload (MaksRAT)", "value": "c91eb93640cccea40732265b26ad3b54", "object_relation": "md5", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388467, "uuid": "291d8966-bcc9-422d-87db-5dba04655cff", "comment": "Malware payload (MaksRAT)", "value": "3a65f866fab69021260cc720d324d9b63bae5c83c72b733d55c7e36fb7b746f7", "object_relation": "sha256", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388467, "uuid": "7138e982-b47e-4a03-985e-99c17a51e4e2", "comment": "Malware payload (MaksRAT)", "value": "4b81803af510cecc5648f12c828af88a00453ee3", "object_relation": "sha1", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388467, "uuid": "3a81596a-8325-454d-8a57-edcb70f156a1", "comment": "Malware payload (MaksRAT)", "value": "e954d52c219f1f3fb56dee2313e4891fe01628caf95967fff30564ac61594088058a81912b0dcbbedad9e26a6516453d", "object_relation": "sha3-384", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388467, "uuid": "04b45529-7de3-4249-b35e-fe9d0f44359a", "value": "T132F2E150BACCCF0AFBF16EF2D700DAD46394C9BB1203A04A9D4E848E68559FD593ED81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388467, "uuid": "5eee83db-e6c4-4146-bd77-8226480304db", "value": "768:utYyGgtNrBtPUI9ZjEASh+yjCLn+gSmM4jsbKfJ/1jOJrG:utYyffrBmmZg55jUB/obuJ/1jOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765388467, "uuid": "f9dd3035-cf63-4773-81b5-b0c6616209d3", "value": 35177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765388467, "uuid": "999131c2-23d8-4067-affd-345e94a9547f", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388467, "uuid": "ac16b27a-f3ff-4204-80a6-f293d91996c2", "value": "3a65f866fab69021260cc720d324d9b63bae5c83c72b733d55c7e36fb7b746f7.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8c39fe-d5a0-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765354572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354572, "uuid": "857fabc3-8fa9-40b5-bac4-a4745f14cfb4", "comment": "Malware payload (AgentTesla)", "value": "c43b62c316cb4d5ec14c3752279d3def", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354572, "uuid": "3dd40fc7-bb1c-4da0-9f53-296b6903a581", "comment": "Malware payload (AgentTesla)", "value": "3a957865951c7b1f03533017f69f030fd54bddc116ddb90799cdced217a35d11", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354572, "uuid": "c9f271de-ed97-4e3a-97e0-1c3d75f0a31d", "comment": "Malware payload (AgentTesla)", "value": "5fc34f8a41b110b298ffbdaa9861bc8dbd9765da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354572, "uuid": "949cef86-7786-4c04-956a-d4c6753d076a", "comment": "Malware payload (AgentTesla)", "value": "28ab3a251474f24c8fe4bcb735a9cd1bfb4f32ee5b2b4daf316f16da787d14a2fddf04bb767838b89876a8531ce67251", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354572, "uuid": "72d9099d-0ef9-4223-b5c9-61818f017507", "value": "T138E4239592CA4714ECF538375B72E6687E9D0D17B8794BB32201540F3B6DD0CB6ACB06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354572, "uuid": "6e419f20-06ab-4c07-94b4-1af979742943", "value": "12288:TXitmDV69AsPgyeN4ymsy7cJs6Ku334hZ4ngOq2lZcHGzJEngbB7hiiBTYug:LWmRrzmqJsa34cnhlZLJEnmBVLkug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765354572, "uuid": "1eaf6aaa-0e92-433b-93e4-495146e9e77d", "value": 713894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765354572, "uuid": "66b95442-384a-4776-8386-929077bbd491", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354572, "uuid": "62867e3b-5a44-44c5-93a0-12d5dd0e8adc", "value": "Sunprint order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfde18f-d5ef-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765388473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388473, "uuid": "dbb909f1-19b2-4d54-9ce0-9bb44b341a12", "comment": "Malware payload (MaksRAT)", "value": "f6fa2c684e90264626b874125050e4d1", "object_relation": "md5", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388473, "uuid": "5717b04a-ac64-4739-ab15-db6b7792c4fd", "comment": "Malware payload (MaksRAT)", "value": "3b51c3f497959541b8f78dc77ff0b06419aa4b7c89e9bf43e95a0bdf11b770e5", "object_relation": "sha256", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388473, "uuid": "672cf1fc-e2f9-482a-9a7d-df953169a809", "comment": "Malware payload (MaksRAT)", "value": "798d86127184eddb433bb5d9db3f284013ef8dac", "object_relation": "sha1", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388473, "uuid": "219ee81d-eadd-4ed7-84c0-12e18a68c092", "comment": "Malware payload (MaksRAT)", "value": "982989ba96139fd3904c1a9fc7467c5868df71fa7fed515f42d9a599219091f1833e502cf0fe96ed7f4d3aa17faf37b2", "object_relation": "sha3-384", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388473, "uuid": "30e4ed31-844f-407f-b2a1-04c4a4c5faa2", "value": "T14FF2F1BF6F22A645F6B9F5F3A19BA410A99E10E7C106C45209F4248C6E61C58AF2353E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388473, "uuid": "c853b861-f63b-4db2-b201-54162e2e7160", "value": "768:8yiZ3yqF3lCeqba0OjwLF5KSDuIFkUkBNcT9+6GC41X:8yi1vlse0+I/KYFdqcpoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765388473, "uuid": "3947c6ae-fd8f-49b2-bb4e-9a5a414f88f6", "value": 34375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765388473, "uuid": "c8b6917e-fbeb-4bfd-904f-503494c001b3", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388473, "uuid": "dd8bd686-66ad-4089-a3e5-7d565a2d3eac", "value": "3b51c3f497959541b8f78dc77ff0b06419aa4b7c89e9bf43e95a0bdf11b770e5.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a76551c-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765345118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345118, "uuid": "08abfcff-6b93-4bf0-84b9-d2d1ad447b29", "comment": "Malware payload (Mirai)", "value": "d77aaa865abfd3a05acdc8f11f965a43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345118, "uuid": "73b15d82-fdce-4ca5-b1a7-cf25c8dc9260", "comment": "Malware payload (Mirai)", "value": "3bd7dcbafa3470bfe71bcebe9cc1c57b9c03a556c9ee53d73bed5e2dbc7f03ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345118, "uuid": "a8efa580-3873-46cc-a7f8-96bf0d63b337", "comment": "Malware payload (Mirai)", "value": "6eea88914f195a2039c02182f8d79f904de8d164", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345118, "uuid": "c5ea2844-6530-4a7f-949b-8e4bc50090cf", "comment": "Malware payload (Mirai)", "value": "574a532d76b957a6f44df334cd3e6d7b7f203de70a19dfb30f52f938b64df86f41f7e13e35fee637657ed9a5919f69f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345118, "uuid": "4dbf1ef8-5495-490e-985c-eaed5847d236", "value": "T169B33A44F58BC1F6D84B483050AAB33FDF31DAA59271966DDF695F32CA27602821379C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345118, "uuid": "d3688323-56fc-490b-9de8-fefb799103cc", "value": "3072:QGi9owphpfRqit49qegk0RNFFm8UBsl5MF1o:QGi9owphpfIitRegjcOl5MF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345118, "uuid": "bbd98ca9-0837-4f83-94ad-1889b23dfaac", "value": 107632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345118, "uuid": "8477eb76-8d18-4cd2-baeb-f43732d27f36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345118, "uuid": "eff85032-c5c3-4566-9618-8bcc60157ed8", "value": "colonna.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf63e0a-d5dd-11f0-a129-42010a9c0007", "comment": "Malware payload (PumaBot)", "timestamp": 1765380878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380878, "uuid": "a8f232a5-17cc-4812-8824-46a9ceb96abd", "comment": "Malware payload (PumaBot)", "value": "586f27526f81efdb34c071d15e159ddf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "PumaBot", "colour": "#7526A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380878, "uuid": "46c0c516-83de-4578-a324-875c59723947", "comment": "Malware payload (PumaBot)", "value": "3c60a39b3b69ca2466cab0908bc644b8f0c0e166802f19386829b250c78a6537", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "PumaBot", "colour": "#7526A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380878, "uuid": "f32fb5ef-c2f0-4741-9f8d-5d22d3763e10", "comment": "Malware payload (PumaBot)", "value": "182786ce934a4c813cf6f16fd4df8587b19929fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "PumaBot", "colour": "#7526A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380878, "uuid": "99644cf5-bcbd-4ee8-9f65-c65823f05485", "comment": "Malware payload (PumaBot)", "value": "e03050ede4320e8b50158e168aa0389e6787c9f43bb04bf98c07694a600cced00e9a5e928c93d994fff4d32a965c3a83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "PumaBot", "colour": "#7526A6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380878, "uuid": "25605f31-52b2-426f-8e2b-ef2d39efe9e5", "value": "T19DA533F7EA7C03D74428B049A7A3B484C9F1949912858D282AC95A47DD3EEF7CDF9132", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380878, "uuid": "daa726df-787b-4607-ad96-f1007e406207", "value": "49152:v04huqzyAZmyiv89GgRZlezwSZCDlt8h97bAUv4QV:397s7zwWoQFvLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765380878, "uuid": "b44f1d4f-379f-4e84-bc8b-4024286faed6", "value": 2249480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765380878, "uuid": "7e304282-08e0-4f81-9a05-2754eeb7a9ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380878, "uuid": "94ebc14d-64d4-4679-bdb3-e700b27cf11c", "value": "1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631925db-d585-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765342931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765342931, "uuid": "abad6e82-ba69-4bc8-95b9-cb9809e41853", "comment": "Malware payload (Mirai)", "value": "ac3659f65e136d1488b500454319a97b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765342931, "uuid": "211ef14d-ae1a-4b63-83c5-af9c2056a049", "comment": "Malware payload (Mirai)", "value": "3c9b5bb5e983ba7148b158b8ab1a5b8ddc0fe2bd58e6c02b7f5bd1b3bca7cbc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765342931, "uuid": "4ef7d9c1-5c00-4a2a-8e83-198001805a6c", "comment": "Malware payload (Mirai)", "value": "9e6e71e322688e6739f7de2020a6ef67779370fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765342931, "uuid": "cacc599f-96d3-4a49-a586-491699f3b8f5", "comment": "Malware payload (Mirai)", "value": "94205b8556e84d77d7e6e9031020cad3288f9c75bcae573a9dbe045ccff66b1ea4fd59262e7c34b2d88482d8ce2bf4b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765342931, "uuid": "009699d1-99e5-4d08-8b79-e6a31bac4a44", "value": "T168C32A55FC819B62C5D5127AFA2D128E331327E8E3EE72129E205F20378A61F0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765342931, "uuid": "66716ca2-21d9-4aae-b346-e88c84b62e53", "value": "3072:Lbong21aVetPBtlqd/zb69AcaFJk/2rSXAczN2yMoKRtt:Lbog21aVetPBtlK//6xa/G2r8zIaKRtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765342931, "uuid": "f043cdc3-7ae6-469a-a6d0-142ed0dab1ad", "value": 125156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765342931, "uuid": "4775db03-8fbe-433a-9b67-0d8156c0862f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765342931, "uuid": "39a61a9f-b62c-49e7-bee2-9e9c296775a2", "value": "colonna.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8744ce55-d59b-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765352441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765352441, "uuid": "5420b65c-1002-4d92-b0d7-15406c604706", "comment": "Malware payload (AgentTesla)", "value": "391aefe4879489054b481f05a50d3995", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765352441, "uuid": "5f4e62a3-ae68-4cc6-8f20-deafd17a5d3d", "comment": "Malware payload (AgentTesla)", "value": "3cdfa35b0d8c690d5a5acbc47c15688d6113484f256ef4dae44b19f6596392d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765352441, "uuid": "25b48f1e-4421-4d76-a596-2849c6f721d3", "comment": "Malware payload (AgentTesla)", "value": "401b2794746d7fd1724fa2e6d4450e3fed7dcadf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765352441, "uuid": "08b3ce1a-1a90-445b-8b2c-e5c1318360e1", "comment": "Malware payload (AgentTesla)", "value": "6356b48ac418c52631bb71467bce06b5caef04bf590be00e0d83021a90aa11f2c9e8621060cf5368b2d659fb1b2c599d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765352441, "uuid": "05981a86-8e63-481b-b93b-cb5e9d861933", "value": "T1BCE4239FDD6030311D8A7265792F54D4EBA4EF486A31434AAF14E48E8F339F1A199ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765352441, "uuid": "56bf994d-df80-45a5-8a54-a811d34820da", "value": "12288:XSH5LTj69+zSAgn1ILl4/bR8Tjs9KJm2hhvaujfkbhzI3DekE0H:CH5XjHSw42nsX2hNjfuhzKjE0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765352441, "uuid": "cadca206-e9ef-4945-b76d-62c8619a8aee", "value": 720537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765352441, "uuid": "5a98b79e-6422-4908-9702-e6b3d2157a7e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765352441, "uuid": "166689cc-52ef-4f66-8eaf-c25fffdcc61d", "value": "P25SAL0977.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be5b4373-d5ff-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1765395483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395483, "uuid": "cf7b0a69-1b96-49c7-8089-87e8230afc2c", "comment": "Malware payload (LummaStealer)", "value": "aba404dff6d0cb0dcfa6da513f81cf09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395483, "uuid": "dff44b48-1565-4d6b-88e0-596538bb8d89", "comment": "Malware payload (LummaStealer)", "value": "3ce350faa20a3988e79bf9e469b8daa899d4c8f14d3f39efc29ac3b4163b00f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395483, "uuid": "6d32969d-24f2-4617-9ba2-8bdc51f16bbc", "comment": "Malware payload (LummaStealer)", "value": "6a28d13e6c33c26074b6adfd66203e928ca5b8a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395483, "uuid": "7ee8bb79-3140-4521-81f4-33eb1c5077b4", "comment": "Malware payload (LummaStealer)", "value": "949b8133a597a7d0ac3570b0846c5d4f4c3c31c3b70e6b002cb8a813115b2facdd12d74eb276e82bd221f5849741374a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395483, "uuid": "ecaa1ec1-9001-44e5-9f67-d45165c82156", "value": "T19F561291AB758112E5A72A375977CB939CE47C1F12F0734F1976B83B212093F3A1E229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395483, "uuid": "c0ab3827-6e47-4214-bc91-4deb4b3f9b56", "value": "98304:5072aKyTDTkoQd9hq13syUSoVUoAFXQQzZ2/e3BG6EIlfTZuO9yuBPXJ1uZd:50lLkpC13sRSoVXiAQdNs6vJ939Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765395483, "uuid": "d41e71de-5e3e-48d9-9cc5-e22167444da9", "value": 6047232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765395483, "uuid": "d1078ae0-ed00-4341-8504-b46926d0210a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395483, "uuid": "6e74b3b9-e504-46b3-bd47-68882806352f", "value": "Setup_Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65367e8b-d5b5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765363551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363551, "uuid": "8d0e9faf-9a03-4430-84bf-1964a4b9ce71", "comment": "Malware payload", "value": "b3e7e1eedd8e502fb9a5a512944b30cb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363551, "uuid": "d764c7a0-cdd6-49d0-bc96-1d03cc3a6df4", "comment": "Malware payload", "value": "3dfa22389fe1a2e4628c2951f1756005a0b9effdab8de3b0f6bb36b764e2b84a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363551, "uuid": "aa0c4b06-b2d4-4735-8211-4440670a512c", "comment": "Malware payload", "value": "8a6f67eebc74c8233f7c3af89f194f021cff2805", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363551, "uuid": "84cfebf7-a07c-4896-8426-34122397758b", "comment": "Malware payload", "value": "2e5254cc0f2d2d8f070f93eea77592db1b0bedce5879cd2a6997c1859aacac9d49ad550630ab2618b0b07b34575f821e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363551, "uuid": "d31dc5e7-3919-41ec-b3e7-8369a923506d", "value": "T1E935A967FA539BF1D2441733E2D72D2013E1D2876727E65F76EA236918427EA4E02233", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363551, "uuid": "675e278a-246b-4589-aeca-be51d2766ffe", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363551, "uuid": "eb1b3567-63a8-4d91-9b95-70e19e81340b", "value": "12288:uTmxpQA+e2XCeo3lpy2UZa1DFbyehminB2Wef8:u8phICLs2j1RbPhmiB2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765363551, "uuid": "87fcdf48-5e6b-4023-a99b-618ba5444111", "value": 1078272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765363551, "uuid": "f648c314-ba0d-4a2e-9597-bfd328f40b84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363551, "uuid": "8cd1f818-e89c-45fe-a173-7b50473e24b5", "value": "filerino.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fc2501-d61c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765407659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407659, "uuid": "5a269b11-73a3-4f1d-8438-dc5b5f7fc3c8", "comment": "Malware payload (Mirai)", "value": "b24437bd1d5d9af1528b88ed6be7f3bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407659, "uuid": "1b824dcf-9069-4214-98b4-659c3a76a9dc", "comment": "Malware payload (Mirai)", "value": "3e1f0508be1a095e3f2b9864b0afba8bd158bd8030b646882def15f3d2667a89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407659, "uuid": "4532180e-da66-4f19-a742-69426f7726b8", "comment": "Malware payload (Mirai)", "value": "be675003fedfd0e8df3ede11fdb0f4f33b5766c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407659, "uuid": "b4c7743b-58a4-4601-ba2d-a1cc438c0682", "comment": "Malware payload (Mirai)", "value": "063ad04619379b766e178f652bbd94ab8bbd8957305ea210d088b8af7484b3e414439305a71bb3a844cc090d9deade27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407659, "uuid": "aedd2b6d-7b4f-4040-b510-c5078ac7568f", "value": "T104631991B8829A17C6D462BAFA5E41DD332213F8D2DF3207DD11AF257B8682F0D7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407659, "uuid": "f01485ce-6f6a-4064-8bde-3e9c079513de", "value": "1536:nDXdCKCX/DVkfB8yxPXQj80CdDmiTw7nNT3bsR:nDtCedX9Nd60w7nNT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765407659, "uuid": "23797ac4-5d72-426a-8301-cf7cfac9a035", "value": 67620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765407659, "uuid": "c29323cd-62c0-4c1b-a596-fe217e6e0591", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407659, "uuid": "b4203592-8fd9-48bf-8ef6-a73757ac6df8", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c79855-d598-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765351011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351011, "uuid": "ef4e213c-0359-4231-9d45-5444536bf982", "comment": "Malware payload (MaksRAT)", "value": "051102185348201a073adfad16f8014e", "object_relation": "md5", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351011, "uuid": "7faf3a23-8b89-4b82-ba03-665483949bed", "comment": "Malware payload (MaksRAT)", "value": "3f06b859dc5e87a643659866edfeeb7bbf4ec24297967f9b130265fbd99d2df0", "object_relation": "sha256", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351011, "uuid": "35febaca-7192-495a-871e-edaaed7f3f81", "comment": "Malware payload (MaksRAT)", "value": "e1399ff4dae3fb95fac3ce829b48fadc8407f80b", "object_relation": "sha1", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351011, "uuid": "cc4b7552-68c8-410f-85dd-320d3e71228c", "comment": "Malware payload (MaksRAT)", "value": "6817157f765a166b44db456a6690b776287004fa1101132a2afde1d326f0861521947c6855a297112c0187c37d303a17", "object_relation": "sha3-384", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351011, "uuid": "af80ce68-bf95-44e6-af2e-f3e97440d746", "value": "T166F2F27A3F18DC84FB60727623A0BD48365F1654C6C28CA72AD71A023D5B325CFBD984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351011, "uuid": "88657860-d758-4aab-8049-14067a837873", "value": "768:q34ePV4n/p+gS2OKwpTYpxEQ0Lmh+wyU/xxeaa+/lp4PjRPBuca:q3Mn/7SHpm0SHXx/ktA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765351011, "uuid": "6c95051f-39d1-4148-99bd-baeee51c5634", "value": 34247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765351011, "uuid": "fc980aa8-dfcc-417d-b5c3-736d9431f5af", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351011, "uuid": "593167c8-8635-4e00-ab8f-db41863dd723", "value": "3f06b859dc5e87a643659866edfeeb7bbf4ec24297967f9b130265fbd99d2df0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2586778f-d600-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765395656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395656, "uuid": "bd4e5ccc-78f3-42c8-b9c8-21fc205c740b", "comment": "Malware payload (AgentTesla)", "value": "3d2fd2a9e4711215e1bca9204c58befc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395656, "uuid": "432c6a97-5a6d-4b04-a0df-54001bc6d2c8", "comment": "Malware payload (AgentTesla)", "value": "3fd361b04c435012af66e38eaac7dc279525fe9df3065214d7604845f4087714", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395656, "uuid": "520c81d3-5d5f-4b02-a130-177c08010f17", "comment": "Malware payload (AgentTesla)", "value": "9c1fca7a563504816aed255d820f715ea74b128a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395656, "uuid": "14bf7d39-36ad-41ac-bcaf-fb1e7b32f2e6", "comment": "Malware payload (AgentTesla)", "value": "0fa20dea0ff829673043f95bc8560ffead5306b7e55d13ae1f2e74ad06b6cc2141d474eb2b36a972b40ba6717e30b66e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395656, "uuid": "c85db51f-e463-4318-88d0-40e3765d213f", "value": "T14935F163F46492F6D7B86132F147E63E2E0B9EA156018141B3F23F5E3BB6A691710B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395656, "uuid": "c2934830-89db-4135-8b6b-e2d15b2f6ce4", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395656, "uuid": "29ab02b6-08b7-433f-8a4f-19623e227475", "value": "24576:Cy8ikLEMiD4+zGa0LQimKfffTNRUIAIxWrt:CZikLEdv6a0FmKLNRUIXxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765395656, "uuid": "db2bcf34-ed38-4b9c-9922-883877ec6dcc", "value": 1143448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765395656, "uuid": "e0939e29-10eb-419b-97fc-a221732fc78b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395656, "uuid": "bb21e6be-6690-4cc2-9681-e4bd8c1ed69a", "value": "12102025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904706f4-d55e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765326257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765326257, "uuid": "48d7c383-4364-49ac-a4a9-86d1e0215c3d", "comment": "Malware payload (Mirai)", "value": "1d4b6dd40e29783cc209a24671957364", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765326257, "uuid": "4df86588-4d1c-41b2-8c04-776cda2df55f", "comment": "Malware payload (Mirai)", "value": "4109f2e85f4bfe569be5ed9e825f071bd01685ba103ed5cf6ab53f0f34e52d8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765326257, "uuid": "7ca6ab46-f648-4c11-9abd-4af48f908f66", "comment": "Malware payload (Mirai)", "value": "61adcf613057cb8ff994cf67258d6689ff674be9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765326257, "uuid": "3bea6017-d589-452e-8a5b-dacfa64eb338", "comment": "Malware payload (Mirai)", "value": "e7c7b97751b12917b00171c2342bc7845c278c679ea2a672e66c9aa2aa79db9e329ef29d1f0b49afe11adc23923b3374", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765326257, "uuid": "4328daea-fc13-4e0c-aeb3-d77e709eda79", "value": "T19E64E50AAB610EF7E8ABDD3716E90B4124CD654B31A82F357174D918F64F64B0AE3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765326257, "uuid": "f5410969-3775-4801-872b-f03499b73eeb", "value": "6144:VGugCdm+Js+TLU8MBq0caNBNDX/CpDrZdneSFGrwo:VGugykquNDXcDrZdneB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765326257, "uuid": "927ac92e-fa70-4f40-8119-11f3f89dfa3e", "value": 332780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765326257, "uuid": "ff89fe79-6d8e-4734-812b-75903248d19b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765326257, "uuid": "b9da480f-9eeb-4c7b-804c-0f54ba9980c0", "value": "ecco.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e66740-d5ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765395412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395412, "uuid": "1647f4a8-521a-485c-bd7c-5ee4a8c5ef6d", "comment": "Malware payload", "value": "51795f1fc5217e004506b0951809a5ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395412, "uuid": "4eae9010-b143-47fb-b4c6-f99cd09cec0d", "comment": "Malware payload", "value": "41444279183b21fcae701c4f80fb5051afd34a44bc9ea24782def1fe3e67f0f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395412, "uuid": "34b913e0-bd15-4646-a40a-0b24a14c94d9", "comment": "Malware payload", "value": "e74e0a6121a02340b2372f4b74dd23ba78a51a56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395412, "uuid": "3fd15883-09f5-49c8-a46b-6a03ef48ebdc", "comment": "Malware payload", "value": "ff26a2fea85ec5d8001fe955cdb071e9b83c4b1d4854a3857f769fc8c066ebc533f1f424ecb66f6257275482ac78881e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureMiner", "colour": "#047940", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395412, "uuid": "e0e0693f-6652-4a87-a836-72f14064e05c", "value": "T1323733B7E6004C26E499ECB17E90733AC7A34EDD9B8BDD98E4627E141CB91B14B3542C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395412, "uuid": "e92eb9ba-c650-41f3-a233-704d2baf6358", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395412, "uuid": "f4622657-c5d4-4229-98e4-4438f1038983", "value": "393216:kxHPywoe/5UF6y8bQwIFTPKKowA2L6ZpraKJ0o:kFto+e4wTPlsTZpOKJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765395412, "uuid": "6caa9762-edc6-4923-a04b-494a9057220f", "value": 22785536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765395412, "uuid": "83666895-b033-42f3-bd39-6ebf90d7d024", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395412, "uuid": "7f4375b6-46f5-47bc-a3a4-185973c0ae95", "value": "Installer_v7156_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e47b798-d5a7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765357499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357499, "uuid": "1d19744a-a6e2-4cd2-8c41-c4434e36ea75", "comment": "Malware payload", "value": "51f91a38014a4854039fd315d84c3d4f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357499, "uuid": "dd40fef6-9c9c-4da1-b42f-3d4bc02d5950", "comment": "Malware payload", "value": "41930e6f9187c8be4ea41303dd957d74f65b97944321a24a20028e76d10e0588", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357499, "uuid": "eeee61ae-0396-4c5d-8f9c-b122631efe87", "comment": "Malware payload", "value": "904c4dc0e93b15554c8b4112dd4a792f493d83da", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357499, "uuid": "ae5bc34b-ca68-4d2c-8d95-8628c13c444a", "comment": "Malware payload", "value": "1f3c0215b995eee1673ae188b81200dfd12939af4df3a7757bb735bd07e8c89d581e70c5aaff177f40bfd16c0025861c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357499, "uuid": "2737d176-1855-4f31-9698-bfd03e47241c", "value": "T12A761203F78E492EDDE2B97C099713716619ACEC1910928B4D02F318BEB72D96F25BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357499, "uuid": "76ef4e42-7ddc-4f92-8d71-a298ded5e62b", "value": "98304:VmhNtbeLnAwNS8gtiAu+IQNAs2gZmIx3Eg3CBZ/CY9mozszKVnnVZ6eRK4yw9:whN8nAX8gAmIJzeX0g36ZiozszBex79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765357499, "uuid": "71a7f49f-c3c3-4f3b-8d9e-ba41f361c613", "value": 7369993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765357499, "uuid": "5b079693-7555-4bdb-89f7-b9bf304477b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357499, "uuid": "c469e43b-6d10-4c02-8ef0-1896308cadb1", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1f5a48-d5b0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765361573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765361573, "uuid": "d626b212-b81d-4438-b027-47b8e94fb343", "comment": "Malware payload (Mirai)", "value": "56560e4036e12683fb61463bce1f908b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765361573, "uuid": "f50255a2-dbe5-4e53-b1d5-91f28edf1ac9", "comment": "Malware payload (Mirai)", "value": "42c43660e6c30a812458adb9e9252fc72daa0fed1d0fff255724d65bd85c37e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765361573, "uuid": "96c67d0c-0a57-4213-805d-862cc25a66e3", "comment": "Malware payload (Mirai)", "value": "3d14f6e9269b580df567ee29e7606c6adcbeb59c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765361573, "uuid": "cee11281-3c08-490f-b94c-03cbec6e3f25", "comment": "Malware payload (Mirai)", "value": "427ade22c0ea93310c7945d6b00124b51035ad6e08e72d0a7907c288affdd2cbb9df433d78d88809b89d05e167cbcebc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765361573, "uuid": "7b976d4b-fbed-42a1-ace4-c144ef4a8318", "value": "T1B9446AC7F802C9BDFC4BD67A889F0A09B930B75154531A3362A7BC56ED3A0E25D13D4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765361573, "uuid": "b7d254f7-156d-449b-81ff-80f86fad638a", "value": "3072:yV4MDpsNyIm3CcRZbtfVZlLcfyXq0StKFT75VZ/aFXMsV0jbi3LfvBsPXh/9:ADpsNyImdGyX/StKV7RoXMeLHSPXh/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765361573, "uuid": "ea4dc799-aac3-46d8-b873-c9e2fd73ab1e", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765361573, "uuid": "3ae84f73-c470-434f-b518-68af2e1c7f12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765361573, "uuid": "764e676b-f123-431c-bafc-e38e6c1a69c0", "value": "ecco.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68c2eb9-d5e5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765384276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765384276, "uuid": "89ec6fea-d8ca-495f-9c65-dc7e50f7a6b7", "comment": "Malware payload", "value": "9af9866d8ff304ac0d41d5b2cd50809d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765384276, "uuid": "bbed51bb-4972-4293-998a-898d69150b0c", "comment": "Malware payload", "value": "42f34b4a323c08f80509bececb939e7b09702d7ecadb2256f985d29d2b67eb8b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765384276, "uuid": "9f32fccd-3c8a-4e66-904e-cadf65457a85", "comment": "Malware payload", "value": "c050e6a78378095eaa42212aea9f79029885aa98", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765384276, "uuid": "f1dd8d42-12b3-4ee8-9265-b9f0b7bd6347", "comment": "Malware payload", "value": "bdd93d05fc398944eaab7576b4be88835f6d7ffe402d490416aace1b1ca02fefa455fb4de3f08f4d73ec17085f77d17b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765384276, "uuid": "c0aee9ea-8c49-4ae2-bee8-452c4a8bda26", "value": "T1CD66F682A9814575D76FE13490936B637F317C1847303AD36FE91AAA09E7BC0273EB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765384276, "uuid": "28c53fb4-592b-408f-a34a-bffe659d6b51", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765384276, "uuid": "48df1c5b-f350-4934-8dc4-cb313913685d", "value": "49152:Vj7PW38tNe/Fx8BYirPORL3JL/vNYKLSGRY/WTM4pVFK1hpC:RW3RCORzJLRSqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765384276, "uuid": "edcecfcf-afba-40a4-8928-368530ce2475", "value": 7027840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765384276, "uuid": "50c07cb0-1a96-4249-8596-8c8b82e900aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765384276, "uuid": "3730abd2-32e0-4468-ae31-e8d3a499871d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c21989-d61c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765407661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407661, "uuid": "463c30b0-903f-4673-acad-6a2ba4cd6c05", "comment": "Malware payload (Mirai)", "value": "f12fc2878ccb99099ae5b79a5a453c71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407661, "uuid": "c7c51073-3dd6-40db-a388-a1b24b7d99a3", "comment": "Malware payload (Mirai)", "value": "431163f886521872140e0cbfc72d08b51d851489275f71d90901ba522ac795f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407661, "uuid": "a984150b-0000-4d7b-ab36-bca4869424e2", "comment": "Malware payload (Mirai)", "value": "edafac26590c95c09d284e80f1cad01a8857b1bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407661, "uuid": "8e4d3d1c-5cdc-4240-a8ce-a0a00ea14405", "comment": "Malware payload (Mirai)", "value": "c554497ed5e39868395d0837b0b3d826b589a3aabb3e9fef1ac05187115741d55db6320d8472dda05daca064e76a2c70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407661, "uuid": "168c6507-4d79-46be-94bc-1ff14907ffbf", "value": "T14393F646F9819B15D5D922BAFE1E528D331357B8E3EF7202DD105F14778A82B0E7BA02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407661, "uuid": "ac9076df-f179-4c8c-a5ff-70b83385a347", "value": "1536:yWnxwSa8h+vgr6D4BKWi3oeZFnoGu0iNGb0hpuXphU2jGlf9lCziDC60Y6RT3bsI:p3lkv1eKnG04Gb6uXphU2jtGCTbRT3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765407661, "uuid": "4decd220-306f-4d0d-81d6-4d552e3d0065", "value": 89428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765407661, "uuid": "9183bd94-b1fd-4662-8040-de07ebdaa07d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407661, "uuid": "a598a3db-ca0d-4bdd-800d-2af9cb146890", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f601df-d55c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765325293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765325293, "uuid": "ebf36f10-187b-4022-b8e6-235c91b65801", "comment": "Malware payload", "value": "6b9b2ead1afd0c5e815639045db1cfc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765325293, "uuid": "3c9d38c7-127c-4d9e-a7f5-a65ec1173a05", "comment": "Malware payload", "value": "4352d8f18ccfbb9d842ebf1c9fa6c7d2f4ebae0b9f0c1f99fb75300d27a3b109", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765325293, "uuid": "161e22b2-cbb0-49d5-8a5d-5b08b644e430", "comment": "Malware payload", "value": "507c41c5d55db0a4972bd6a7f9585c60099b8087", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765325293, "uuid": "6155725f-3337-4b7d-8a07-c9a057c68b63", "comment": "Malware payload", "value": "c02c627552dfdb8d15e53768509724020dff87b44408fa1c1c869b0f0ce37d1bc6bbd14511c8f7ec73751c675db6305f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765325293, "uuid": "ee8b782b-484c-4f3e-894d-ce43cd51badf", "value": "T1CDE423D4452B417AFE3652B24E2A493B5EDBD8350FF04634AC64D25026A1F23336DFA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765325293, "uuid": "2fea6194-6431-470d-830d-ef2587b2130e", "value": "12288:GILkz+prrFC87A0WGzNocQtB/KxnWoXR9xCsnuePNLz2NVSUyF7RSvjVI/11W9FR:dLk4PTA0WTtByWS7tCNcU478vK/1E9FR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765325293, "uuid": "41d092b0-30d2-4738-938c-f71b9354b8fe", "value": 696488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765325293, "uuid": "9b1db10a-5ea3-440a-9da1-ade53c8d4c4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765325293, "uuid": "c0fdeef9-a60f-4291-a8fb-d04ab497a032", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a82b9bf-d605-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765397973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397973, "uuid": "735dc0e5-0de1-43fc-b3ac-2a46e608c794", "comment": "Malware payload (Mirai)", "value": "61b78372caf67feae0bed3bfc0896f52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397973, "uuid": "e89cab62-82e0-453e-aa8f-5d2e646c8c16", "comment": "Malware payload (Mirai)", "value": "4394df9b60bff379921ff31446c91b3c5ec8a0c49c1d0e201e301e300fe62649", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397973, "uuid": "a5312e25-2aaf-4413-8eac-bf2dd424f3f7", "comment": "Malware payload (Mirai)", "value": "6d6be5b81f50aa36f707dfc0eb7c97dbd77fc207", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397973, "uuid": "2a7c1064-9efb-44a8-b8ea-b375c01cb6a7", "comment": "Malware payload (Mirai)", "value": "f63a1a4be504d66f129e19e0c241eb2c79cb073c337cee94129efd5ad1c12183a61384d6286117ec7d8f555970ab0198", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397973, "uuid": "4538efe5-5366-4d42-9386-963c227119bf", "value": "T15E933A56F9818B21D6C112BAFA1E118E3313177CE2EE7212ED146F2077CB96B0E7B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397973, "uuid": "3f5fcc5b-ca58-47da-a8e7-724935235ff7", "value": "1536:vMnA2sYD25NzLD7FtPrUO8LRWnMaBGZtVCEDuibxxvwvt671R5NY17HN:n2sYDqnFpwFWnMaB4xxvwvt6JR78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397973, "uuid": "f4d9cda3-6722-4d33-9b60-d90576a1112c", "value": 97504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397973, "uuid": "95139005-afb6-4f41-983f-8646de1635b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397973, "uuid": "ba836ce1-d066-4b37-8382-a7f1e567e8dc", "value": "Labelloperc80.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051b9f71-d5bd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765366825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765366825, "uuid": "537d5a29-1716-4f0b-87ef-1d8fd3d1ad89", "comment": "Malware payload (Mirai)", "value": "5518b318f186af2569763433fa05c526", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765366825, "uuid": "4ef43e34-dd3b-43b7-9957-0626fd7357fa", "comment": "Malware payload (Mirai)", "value": "439dc83241e4e36fa4ea108a2ce0c6cb69620ba68f458151211aa96aa46e2dd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765366825, "uuid": "b1e93282-d3b6-4058-adb0-5dd1e911bcbe", "comment": "Malware payload (Mirai)", "value": "64275ffac5399577f6afc366ee6dc5b9a793e758", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765366825, "uuid": "06a24b25-1bf9-4e3b-a0bf-233086c01928", "comment": "Malware payload (Mirai)", "value": "58ef79d1a6749d9fcdbc85e8577b2c26f5421eee231e06cfc5fa22ed34b05a97c9905f15e9ff64e8dfaee5f777662b53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765366825, "uuid": "21419127-dca3-4896-8349-8aa0afc9018e", "value": "T187447C43B68040FEC8C5C17A1BFEB136ED61F0AD527CB64A23D4AF1AAD48E615F2D644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765366825, "uuid": "47577939-66e1-4f84-b960-36553d239bf8", "value": "6144:of+V8fGnNNbcNYVwAQrDy8x46XlF8Ru6bfCJ4TZaX:oftbYVwAQrG8uQlF8Ru6m8ZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765366825, "uuid": "bb6532e1-c354-4860-bf77-572eeeb95949", "value": 267272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765366825, "uuid": "8449fdcf-ae6a-4d40-9dd0-955cde6587df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765366825, "uuid": "0729cfd1-678b-41b1-ab8a-3528dc1130a9", "value": "ecco.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee05f19-d598-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765351004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351004, "uuid": "cf54844c-428f-4965-ad70-55fde10fb665", "comment": "Malware payload (MaksRAT)", "value": "66bc634789f8bcf01d2ef8f466e7aa4c", "object_relation": "md5", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351004, "uuid": "4c4a9884-4c18-4357-aa34-084c62f7accb", "comment": "Malware payload (MaksRAT)", "value": "449e72f9c61eff861eac199f238df1a00f74137174b33ced31eed7d1e903fd54", "object_relation": "sha256", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351004, "uuid": "a47dffab-0615-47c8-901e-ca3abed94197", "comment": "Malware payload (MaksRAT)", "value": "31b990600324fb5c4758115f0f741cb0028eed5d", "object_relation": "sha1", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351004, "uuid": "c25df7f5-4d7a-48e8-b709-762c89436a1a", "comment": "Malware payload (MaksRAT)", "value": "c4b48d78236f75999b6360bb64e5b264a898381bf0eb6a45f7eb7b0bba5a78c5c666ca3a349f976d904decf860d2bcc5", "object_relation": "sha3-384", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351004, "uuid": "25e3d2ee-b677-4d3c-b68d-c50871ae7023", "value": "T157F2E11A7EB33151D2ACB0F0808C94C37D383D7A6616BF88311A4CA98B69D98A9715DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351004, "uuid": "32fcae15-d3ba-4c66-bfa9-db7794f4b866", "value": "768:4s1GKQZDs2nnwJc2RDBvqOAVgWqi9vx3srtKSFLDwHK1lKvx8Up:wKyeJUOA6I9uuNKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765351004, "uuid": "a59ceb1c-5530-47ed-a5f3-c0dbcc6e5b2d", "value": 34560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765351004, "uuid": "572525a1-87c0-498e-92e5-c89f3a3a3960", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351004, "uuid": "6f7ea161-fd0b-4b0e-9433-642e087fc3b4", "value": "449e72f9c61eff861eac199f238df1a00f74137174b33ced31eed7d1e903fd54.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b713338-d56e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765332986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332986, "uuid": "b49754af-c6b6-4378-a865-3ff286b2aff3", "comment": "Malware payload (Mirai)", "value": "beee4536ce32ae90be25057824537f5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332986, "uuid": "319d3962-a71c-4dd9-a241-48f28f1943fa", "comment": "Malware payload (Mirai)", "value": "44ff33a965f7c9227fd39f440e612607ccf0cfac72d9d90ba36a97928f91012e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332986, "uuid": "750610f6-6be8-445e-8878-a076c560efa8", "comment": "Malware payload (Mirai)", "value": "eec75efaf50240d936e99aad819618679bd1ce31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332986, "uuid": "f8fcf868-f168-42e9-a813-7aaf5c05bb16", "comment": "Malware payload (Mirai)", "value": "e9890413e04e51e06c28ad18a3801221641c39c0b593f62cf4fd8437ee3c1ce864c68c25e0eb71c45e2aeff2334001e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765332986, "uuid": "e5b66f26-5edb-4b1f-b65e-649d9b859d38", "value": "T129F318C7F900EEB6F80AE33748570906B130BBA215925A337257353FED3A1991577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765332986, "uuid": "1b928649-b937-454b-ae5f-18510ec14616", "value": "3072:GC+JbyIfQ9v/Fy63aVlDzBz2FPMibFA+VfjbiFLmpJML:vr9y6qVlDtzpyFAjLkiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765332986, "uuid": "a2cab3fa-e593-4b6b-83b5-e2a7d6499c7d", "value": 157476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765332986, "uuid": "2efda758-ddf3-4f18-bfab-2167f7864d76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765332986, "uuid": "6ab66cbf-2d7b-40b1-ae33-62724ca95dc4", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0caad7c-d604-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765397581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397581, "uuid": "786d032d-af54-4304-8faa-05e168d5cad0", "comment": "Malware payload", "value": "d12ee8164b6fe2bec742238f2149b34d", "object_relation": "md5", "Tag": [ { "name": "78-40-193-126", "colour": "#23F4EA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397581, "uuid": "c94f3830-f29a-4112-9c55-51cdc5bfc066", "comment": "Malware payload", "value": "45531d4bf46478e0ecea14b28b5e7ac386f9646e8d4b73d1896430999c63f072", "object_relation": "sha256", "Tag": [ { "name": "78-40-193-126", "colour": "#23F4EA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397581, "uuid": "b3cd5f2e-3b02-4bc5-854f-2526b7bfccd2", "comment": "Malware payload", "value": "42ae1cb93a23736f0c75cc86d49304cb4e2b629f", "object_relation": "sha1", "Tag": [ { "name": "78-40-193-126", "colour": "#23F4EA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397581, "uuid": "08a702f0-c6df-4ffc-869f-1df6730caa45", "comment": "Malware payload", "value": "5d831a6d2bb4b1d2c151106542929333d16912df24cee1310187e7a85f2d01bb1f357d4195541f1a36f5c291ca582cfc", "object_relation": "sha3-384", "Tag": [ { "name": "78-40-193-126", "colour": "#23F4EA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397581, "uuid": "f7ae356d-ccdc-4026-9231-2422cf3fefd7", "value": "T11887233A9E2C84D0FB07E7F2C9EB855944EB162012D268AA7B2875094D6F6D0D733F47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397581, "uuid": "9458628b-e663-4d28-b6d5-c121a6eb85e4", "value": "786432:IqiF/FEBbUvnI4WvdqCVGXPY9XhQOsYseq79oxtOFCERPM4s:Iq49RI4WvwYdQ7Y66xiCUk4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397581, "uuid": "4eae6dc2-8657-4931-84d6-ca6ad1867aa3", "value": 36084408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397581, "uuid": "7d57cd11-d9d0-42b5-9aaa-702bdd2980b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397581, "uuid": "25477abe-b5ca-4881-a177-13d5e3945271", "value": "(2) Free Download Files.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d614d46b-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350426, "uuid": "80642ae2-0716-4bb8-a732-197469f54264", "comment": "Malware payload (MaksRAT)", "value": "fa86de48202f8b1480ea9b33e9526732", "object_relation": "md5", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350426, "uuid": "a08a3860-daa6-4691-8ace-970e4278ce02", "comment": "Malware payload (MaksRAT)", "value": "45800bc0557c21c6baa504415911932495af3152c7b17ccd1bbc35b2229fd175", "object_relation": "sha256", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350426, "uuid": "b051d6ee-6e8d-40d9-84c1-b1dcb9fc6db1", "comment": "Malware payload (MaksRAT)", "value": "16b5d3a3e4c14e621fe76f77647ca8c7b5a185a5", "object_relation": "sha1", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350426, "uuid": "e6f95199-3971-4105-8c5e-467fcd528dfa", "comment": "Malware payload (MaksRAT)", "value": "1f1a722840862d9077b5d080172b807c5122425b0fe0cd66c830702dc4a80554b7429559581ad32e61b439245684bca4", "object_relation": "sha3-384", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350426, "uuid": "3e9b05d2-b2b7-40ec-b2ed-3d9e66c5e4fe", "value": "T116E2F1AA1BF0F094F67B5AB4421C745C5BDA77BAC71AE6FB6522CC8103444AC5A0BF14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350426, "uuid": "c8fcc9d8-2592-4d62-9115-fc5683c8a67d", "value": "768:CfBMzrO+yv6soGo/Xhwp+IO8k54Y6x/EvRtQOtQDCAA0UOZz5+:CfUJyjmwpO8kKx8vQsAPBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350426, "uuid": "8da53f2f-10c6-46f2-93b5-cce58daa46a3", "value": 32711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350426, "uuid": "7637add8-be32-4330-b89b-8d31ae60c8b9", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350426, "uuid": "658a92f1-b22f-4d83-b8ca-f220292ccf4c", "value": "45800bc0557c21c6baa504415911932495af3152c7b17ccd1bbc35b2229fd175.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b06140-d56e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765332982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332982, "uuid": "a42899d4-b3a8-4a7a-ab6c-6d6a9f98eaea", "comment": "Malware payload (Mirai)", "value": "ae7d8095280cec5ba6d7c8bb77c2577d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332982, "uuid": "90a2f1e5-0d18-44bf-ac6a-2af6d16491c9", "comment": "Malware payload (Mirai)", "value": "47248f678990f49988c3df5a2f8c41a8e41fbc7ce5c5ace26d02ffb0a97d2cda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332982, "uuid": "9f0814fb-22e4-4d4f-b14c-3dab138d17d2", "comment": "Malware payload (Mirai)", "value": "cd9f97955fbb64cd10a40e0d67cef43e27f1ae52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332982, "uuid": "b52b1a0a-0039-4595-8e15-0f9f17152fcd", "comment": "Malware payload (Mirai)", "value": "0287d5d4e3cb9d301d9b89a6c39338c3227ca0975aadcc02a0644f64f4f41b821cc9315331149f715c1708c210680b18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765332982, "uuid": "cd8c7ee8-5014-401d-bec5-99be3222076e", "value": "T10ED3F649FD816B00D9D635FAFE4F028973535B6CE3FA7102AA245B3123CAA5B0F76506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765332982, "uuid": "80fa812e-338b-4528-822f-a318efb486ba", "value": "3072:n3JHQtJPHaObBP9WTX+CdtlTaGgomJj3Pl88Fc+/crMpWy0:3JHQtZ6kJMTXvlTatomJjd82/4MpWy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765332982, "uuid": "0e98822e-ef65-408b-9461-3f8d5fa02eb1", "value": 132956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765332982, "uuid": "875686ee-e234-4102-804e-16e97225c49d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765332982, "uuid": "36ddba53-d28e-4fe1-9823-e0014a4b302e", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0456d7f1-d591-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765347926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765347926, "uuid": "026673fb-4e0a-4c7e-8dde-87a6ecb62a81", "comment": "Malware payload (Mirai)", "value": "a7b78d19a47764ac851ebc4f6871f566", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765347926, "uuid": "45b56525-8839-4f22-a28b-93661ac5c53d", "comment": "Malware payload (Mirai)", "value": "47fa64196a55c4b25237357858806e29e4596810fb7c9eb9f9954f5f4a5cd3b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765347926, "uuid": "94437127-e8c8-493c-a4b4-543eab3af03b", "comment": "Malware payload (Mirai)", "value": "e702b0dba8b182860e05d8f59a958a5cd05fe32b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765347926, "uuid": "0035f5d6-7008-4d87-9219-afd1bc1f0ac4", "comment": "Malware payload (Mirai)", "value": "f39ae1b0d8efe40c8c604be188a467b555e1c7a093ce510e8ec14a425b0b6300583abf302630201c03fc046d93df1800", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765347926, "uuid": "cdc49ecc-bf65-4901-b482-27d90e262f16", "value": "T15DB36D56B30D0A43D29A0DF0173B67D6C3695AD031E5E6492D0AFF8886B2A36904EFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765347926, "uuid": "c2efa3a0-b119-4ba6-9269-0d9f34aa9931", "value": "1536:Lb7ZOdXBGZbxpNOlOKX3WBo+Fm4CqcdZfLKs5eyjiroaJUTQwGQNG9R:4XB0mMo+tajKOir6Xwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765347926, "uuid": "f64578f0-3ae7-4dd4-a2a5-0098e9414a10", "value": 114884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765347926, "uuid": "93bd5b27-e9f1-4e5b-bbbe-49839b2fbda1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765347926, "uuid": "2df57dc7-8895-40d3-8516-c694265616c3", "value": "rondo.powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16fec2e-d573-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1765335439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765335439, "uuid": "5bd7a8ee-b1b7-4ef7-b999-61366c86ce25", "comment": "Malware payload (QuasarRAT)", "value": "fc122ee0eaf2bdb301c5aae38f90b880", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "quas", "colour": "#2C4DFB", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765335439, "uuid": "ce4aebf4-32b8-46a0-b5d9-d91fa8061c7e", "comment": "Malware payload (QuasarRAT)", "value": "4836401b560c601de78fea1467813078d4829863c6b41f0019ea79080f30381c", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "quas", "colour": "#2C4DFB", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765335439, "uuid": "68a3b05e-f6c1-41b1-93bc-d8847f62696b", "comment": "Malware payload (QuasarRAT)", "value": "3336cb19940f62e74e8430a5d1c2afc1eaec41b4", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "quas", "colour": "#2C4DFB", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765335439, "uuid": "97012eb9-3421-4c0b-a82b-a4099af42bab", "comment": "Malware payload (QuasarRAT)", "value": "403adeb6db7885c78455f0118aac45049e199e8fd42e62167029448eaaeb6ec691402cc66f6e37b90e69fd3d0fe3d331", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "quas", "colour": "#2C4DFB", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765335439, "uuid": "f2b84dd7-60a6-4f9e-b561-3d4600f4e652", "value": "T190E54A1437F85E23E1BBE273D5B0041267F1EC2AB3A3FB5B6181677A1C53B505841AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765335439, "uuid": "dc797504-1a39-410b-bbd9-292bf437fd23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765335439, "uuid": "2fc6fb90-7298-4037-a5d7-66b4b3145f3a", "value": "49152:VveG42pda6D+/PjlLOlg6yQipVTCm1JVLoGdoTHHB72eh2NT:Vv542pda6D+/PjlLOlZyQipVTCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765335439, "uuid": "16cbf141-4602-440b-a5b3-6552f59edb21", "value": 3266560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765335439, "uuid": "1e8d65fa-7fc6-497f-a5df-cea63aad0401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765335439, "uuid": "2e8aa2d3-1406-4202-b230-ad8e08eda147", "value": "1.1.1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a1a88b-d5dd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765380867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380867, "uuid": "2e9dcf1a-e651-46bb-ad37-c9c5b525874b", "comment": "Malware payload", "value": "cb83f14b20330d36622382985ae467a6", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380867, "uuid": "2c7806a3-8276-4a33-971b-6640e2ad90fd", "comment": "Malware payload", "value": "497f004c874c13cc7cf49076b10696c2a19508be8c3e4052e885240d7ed63929", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380867, "uuid": "6f6e4fb5-2592-4cde-991e-a6cd53d5a2f4", "comment": "Malware payload", "value": "2bec19ab2a69cb856f741621f707af0d2173bbe1", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380867, "uuid": "76fd693f-3549-433a-ba6d-d932478467e6", "comment": "Malware payload", "value": "ead3e9cd65a0eb184b7e18af4eab9ce4266ce1a6e754eee38df0eb0f050a42ae5d153ce2da6eef96e41dc10e07567914", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380867, "uuid": "792a501f-47bc-4419-9a57-a6e3658f6253", "value": "T15352B8196AD179A28707C47DDD21CE127327B84305866C34FDBC81E96F84735E8F1AE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380867, "uuid": "1ca81017-9e03-4be1-ac6e-441db3488f50", "value": "384:KdFeWHmNIjamVuNZGnVTdwALvc3Q+p07n4C:2gJNKpTLvGQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765380867, "uuid": "876a9034-8db3-4ae1-9ace-2cf33c9d6e01", "value": 14291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765380867, "uuid": "f37ee25e-4099-4622-811d-5d65cccdfbc7", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380867, "uuid": "310b800b-d06f-410a-95bf-ee80f3bf533f", "value": "poc.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86facced-d5b3-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765362748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765362748, "uuid": "5854a240-ec45-4b4e-8cc8-bc987802f864", "comment": "Malware payload (XWorm)", "value": "02547af76e5706169e32529d1374e623", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765362748, "uuid": "5a1283ea-3165-4d56-8bd2-81e98cdd2e2f", "comment": "Malware payload (XWorm)", "value": "49cfbce12333189d130fa3ca2b205a9c9d97223ca5509c11f4f96d9bf824b266", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765362748, "uuid": "83c65e46-d5e3-4d33-acfc-079f60925ea5", "comment": "Malware payload (XWorm)", "value": "62e7b508e5712f71dcc09525bb272eeb907a8325", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765362748, "uuid": "0337fe8c-2f52-4565-a8c0-8ab75ccc96df", "comment": "Malware payload (XWorm)", "value": "063277a20d083da0f1435d06e9de903a787cbc93bd1cc7b46ab74041a7aeccc6586803c5c5265040e8c5d4b6696f2be2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765362748, "uuid": "115b7f7c-2991-4b35-b456-0dcaa59fd3ac", "value": "T18907BE18A3E50575E52BD738C652C333DAB0BCA25639C60F095DF6851F33AA08B6F726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765362748, "uuid": "e0b249aa-9621-4517-b06d-2e1eaf4a197f", "value": "7bf33a38940fdd542c4042c5148f16ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765362748, "uuid": "5fde40a6-c65f-4dfb-834b-650634131f47", "value": "196608:UYzey/Y/m0qW3B7DuDR5sL0qYY3ZVBidb1ZycyZ+nc:UYCy/j0J3tDuDRkc6+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765362748, "uuid": "55e639af-1da9-44e7-915e-ef637b838542", "value": 18162688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765362748, "uuid": "a278f460-f328-4b2b-87a7-3a5a2056787e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765362748, "uuid": "f84aa468-295b-426f-a7fd-a61246a08170", "value": "SecuriteInfo.com.Win64.MalwareX-gen.81621452", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0560fe47-d5e7-11f0-a129-42010a9c0007", "comment": "Malware payload (Meterpreter)", "timestamp": 1765384865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765384865, "uuid": "8e554bf4-02f8-46e9-9602-a04eeea87365", "comment": "Malware payload (Meterpreter)", "value": "ef1a28331563f6e284da86f3159a8c45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765384865, "uuid": "5748032f-62dc-4e2d-b96d-1b201c6989b2", "comment": "Malware payload (Meterpreter)", "value": "49da2afba7c87307eea000e281084e14ed6b0d460686bd193cfde8aab44c1893", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765384865, "uuid": "7129e7a1-9081-408f-8014-8e3a0c44e41c", "comment": "Malware payload (Meterpreter)", "value": "ae733a282a9990ecec11bf3d980d32a2cfee130e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765384865, "uuid": "ea9dac90-9665-432e-ab40-d450e2f0a2c7", "comment": "Malware payload (Meterpreter)", "value": "35d8c033758d08a69badd6ec6a53c0ccc74cbb55324545a5f4c9d5c1b82a60ecfd6f207acf569015e73d50435e1f3788", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765384865, "uuid": "f8cda889-90f1-49ca-994a-2e4f934615db", "value": "T140E100A362365DF7F6392BBD8547978660FC623406D31B0D0A68084651A2A19B8A5F83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765384865, "uuid": "3bfc8818-66b6-416d-a64a-f160f4805022", "value": "c2d02fc98f1d75d7b9457468ec75da0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765384865, "uuid": "2bfd5f5c-4980-405f-9c4e-dd744ad11178", "value": "24:eFGSG9wSYeUIUMy58XZh9h9ClfAhzaETIAJvP4up+:iG+bexdyeXZh9hMluzaAJH4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765384865, "uuid": "36f5c802-ca1e-4635-9802-0fb489d1e6dc", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765384865, "uuid": "62a8806e-0048-4c5e-b43a-93243b52826a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765384865, "uuid": "59c82c73-a2f3-40b4-9cc1-66b6ee6a4802", "value": "SecuriteInfo.com.Trojan.Inject6.5094.4900.32623", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60988aa-d563-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765328521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328521, "uuid": "e1fc393d-0fa8-43ce-a149-2c4d6feee886", "comment": "Malware payload (Mirai)", "value": "2381baeb131c79d1727bab4c607092c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328521, "uuid": "69aa756b-63b1-4315-9944-c0ec61e77e2e", "comment": "Malware payload (Mirai)", "value": "4b3b3c9ef30e121f9d3aba32d89b3a77fc57e4e5a8630f189cc63a8c23818975", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328521, "uuid": "72a1e415-8d76-4d5d-b63a-6e6166076f4b", "comment": "Malware payload (Mirai)", "value": "46a86e68674f9a7c4b9f8919e90a0218de168509", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328521, "uuid": "a77ea0a6-72cf-4d23-8798-e89f35e1b623", "comment": "Malware payload (Mirai)", "value": "a9e6b7db6a025f84290b672e094be650521fed5c8da949ec0bdd7035c0423f70f77c4c0cb61b8f2aff31b2e6fce60c53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328521, "uuid": "1b8779d4-ef37-4512-af31-ea0b215dfe34", "value": "T1EEE34A55B8828A22C9D513BEF92E018E331367A8E2DF7213DD205F2477C796B0D77A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328521, "uuid": "87462eca-84b3-4994-ab9f-b00fa7dd02c4", "value": "3072:CotWnBLigk1Tc3BCC0DvZe1k6aU6zL6EiueCo2kE:VWnligqTcxCCqeS6axIueckE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765328521, "uuid": "9bbb961b-6c10-4808-9d9e-9a8dc1764b63", "value": 146256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765328521, "uuid": "2300d2cf-efc9-4213-9cb9-37e7b32787d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328521, "uuid": "7b631c42-db14-44e1-a3d9-611f7777362d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931ff848-d5b7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765364487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364487, "uuid": "eb15b436-90a1-4562-bea3-5035d18560df", "comment": "Malware payload (Mirai)", "value": "acd022ac5dd96631cb1f3b8d76c356b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364487, "uuid": "f7cb4929-503b-4757-a816-bcd9944c8641", "comment": "Malware payload (Mirai)", "value": "4c35c7cb8b30fd9cf709985811def8ffd4c8e9394bf98865d16e69be88f6ea45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364487, "uuid": "14487859-9373-4d30-a70d-2700bdaf8ef2", "comment": "Malware payload (Mirai)", "value": "f0fa10e14d3655f4430538c961e29823a032502b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364487, "uuid": "ba9f1709-3904-4ef9-a0d2-8a9f9e90e446", "comment": "Malware payload (Mirai)", "value": "dc8abed5362d2a895da709d1d76aef5ace9214f2fd1b4c125f036501fcf987563a121a79b840fc4de0568aa7bb064e73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364487, "uuid": "14676b79-6b93-4c42-ae73-20344eb09e1a", "value": "T1D7743B86E9418E23C4D127B6FAAF4246333397A4E3E7B2068D245FB437C765E0E63641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364487, "uuid": "f70be47b-ba19-4503-81d1-c8c5ca943041", "value": "6144:sF+lYHfO0c8T3hr0ZS341GszqJIHWdkrSxA/+omGUdMAFGHWosaE6lEkLPDglrhJ:sF+eHfO0TT3hr0ZS341GszqJIHWdkrSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765364487, "uuid": "a0834e70-f49f-4f64-aa4f-0ff6cee381c8", "value": 348764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765364487, "uuid": "f1b4f54e-6df5-4e0d-b7b5-074293f36088", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364487, "uuid": "c15bcd16-a61f-4399-92eb-ebae64632afd", "value": "ecco.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e176362c-d588-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765344432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344432, "uuid": "bfceedb9-37bf-4701-86c7-110a35033df8", "comment": "Malware payload", "value": "8f87b6839209789f137bb4d853d21955", "object_relation": "md5", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344432, "uuid": "634f4142-f0fc-47e8-b559-01fef278411e", "comment": "Malware payload", "value": "4d3f735123062f022b6b7b96a3e5ed008814387ddd387af58c977939fc4ecba0", "object_relation": "sha256", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344432, "uuid": "75044e42-1095-41b5-bec4-baad8810ee61", "comment": "Malware payload", "value": "d97cc288392859d8201e1ca5298d7cf30a9eb124", "object_relation": "sha1", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344432, "uuid": "1d6e72c1-a840-4098-931d-56f97a99746a", "comment": "Malware payload", "value": "517f344c7b62c82e1a0f1ff5cfed23b6d7e2a8063735d7c45659d485690dee9d5587fe81787edc86669ab05bb844ce62", "object_relation": "sha3-384", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344432, "uuid": "77e31c75-7c10-47ad-be53-00d37caf514e", "value": "T1B29153B17D12D4D1F4B3CBE6F3AC2584F16A1207F1C5658D25A7D7800FA2E48B958EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344432, "uuid": "23a64b1b-ab11-4363-85a8-c93e520fdc3b", "value": "96:wlUOwMQ+TorzD1iwOeghzVQhqsEyO+AnyOnkyO+42WgOIQAfzU3leYya:kwMtoiwB6zVQ0sU+WnU+4TKvPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765344432, "uuid": "ed7edee5-6ed6-408f-b2df-ac3d282f2cd4", "value": 4206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765344432, "uuid": "209ddfd3-aca5-4cd1-85de-09d7d23d5768", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344432, "uuid": "2ed32c4b-aaeb-4204-b78e-787c6c796802", "value": "yabaq.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb9518d-d5ba-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765365548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765365548, "uuid": "e3f75dc1-cff5-4c22-b060-c80f258f7a98", "comment": "Malware payload (RustyStealer)", "value": "78af729c020d83e940294b06223ab0e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765365548, "uuid": "bd967276-b5f3-4048-ae30-43960070187b", "comment": "Malware payload (RustyStealer)", "value": "4d73d84a3ccf5517dac617f946eb0f7ff8578a7993e1a8044c9bba1f4e887b2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765365548, "uuid": "090c9050-eb42-4340-9df8-20e0d9a4b538", "comment": "Malware payload (RustyStealer)", "value": "1ee642908302dcc4842571e4caf3c39b16fac989", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765365548, "uuid": "ea744b20-d012-4694-9a6d-2fb0cefb661f", "comment": "Malware payload (RustyStealer)", "value": "2f9b47751db1ce9b16d84c191ba3dd58437df1f5570e3ce6cfc55e66a31ac77c8b1a3e8c5eda179de7df74798821e4f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765365548, "uuid": "1d87ac70-1f79-4d42-bbaa-d83ce10f5784", "value": "T11FE7330BF2E7B5ADC86EE178C7221228B6B97C0140773F3F4AD5A9705E34D611B1E629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765365548, "uuid": "e7632ef4-ca7d-4da1-bdbe-99bceed5d2fe", "value": "89f773c6565e634322d1ea0965a9544f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765365548, "uuid": "860b0174-acfc-46bc-82c9-011e9077a8ef", "value": "1572864:G6lLdhZAHu6a0Ifv4ZrTelWYGhVVma1Lk2MTQnISCw:vk3qH4IM3hVWTmrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765365548, "uuid": "8c1045df-8b6e-446d-9cf4-cb8ca918373a", "value": 69570392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765365548, "uuid": "51e049ad-a6b6-4049-b7a5-dd3140d6a1df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765365548, "uuid": "559b374c-47f0-4c0b-a747-0ce83b4ec847", "value": "assinador.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a2e959-d5c0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765368487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765368487, "uuid": "0a499001-5194-4a95-b3e4-d0bce74fe13d", "comment": "Malware payload (Mirai)", "value": "8ed7b525ce12e6c3b11c530fc8979aeb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765368487, "uuid": "53da92df-9343-4a4b-bb9a-6d614a8d9f67", "comment": "Malware payload (Mirai)", "value": "4da6469d827579d5dcfef6b28149d537b49973dab526572a946bb7b0b6b7a969", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765368487, "uuid": "fa45c884-8deb-469c-b98e-784c4597e816", "comment": "Malware payload (Mirai)", "value": "17396b1dd1014de3da20ae50910a91b2e872cb7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765368487, "uuid": "42e9d774-5834-47af-a8d2-affd4227395e", "comment": "Malware payload (Mirai)", "value": "2e7288042657eea82c2cd867f96c9ae371e6118af5d437b7950823a198f0411026be0a95d029b89fdcd8b15188adb640", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765368487, "uuid": "ddaf271f-68b6-4b36-89a6-446c0d1067cd", "value": "T150A312EED0D4B85BC88C2F7D97E3736337EC938922696D9DE6088C152632691F90947C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765368487, "uuid": "c04af0ec-767d-4b3c-9dec-a5bda97d5729", "value": "1536:JvnueYlCR7ITmziy/+IUA8V783fRl8ReQujj1/RI4Y94EvQDOy8N7qJn/:JvZYlMzzawARepj1+F9X4DWNsn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765368487, "uuid": "10324747-a3a7-4ec0-a8b4-656b2c427d0c", "value": 98024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765368487, "uuid": "9645659c-e2ff-4a79-a7cf-3b8b0b15fea1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765368487, "uuid": "f7651ad5-3308-4b39-82f1-2f6c084f6182", "value": "ecco.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2480a2ee-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350128, "uuid": "47ff7d0b-5b8d-403b-b891-f3790dda4ecd", "comment": "Malware payload (MaksRAT)", "value": "1a94f262fd68d80ee4a50de8ac2eb6a1", "object_relation": "md5", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350128, "uuid": "1929398d-f703-494c-85e8-5efcbade49d1", "comment": "Malware payload (MaksRAT)", "value": "4f536911b2d46ececa07175e0e0db5178855029d6155821dbb7ff1b2b5471d70", "object_relation": "sha256", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350128, "uuid": "99a59196-ca6b-478a-9d80-65921c59ddb3", "comment": "Malware payload (MaksRAT)", "value": "2d5131369d25b7c020ec84e57609b9555109e238", "object_relation": "sha1", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350128, "uuid": "177aeeae-9b91-4b87-9365-2ebd9861ace9", "comment": "Malware payload (MaksRAT)", "value": "073bed8dfa3bc3a0fb05f537ca56b6714f1066550bcc9ab5b3ca49beccded81847606cdc59f2d2c2d11ffc4e1c2fc905", "object_relation": "sha3-384", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350128, "uuid": "8b5b8e5a-34b8-49f6-a499-ffc5d262b95c", "value": "T1D3E2E13F00D15D38DF99C63E557478824A9936B0A1264FD63E5983C4CE3C9B9CF2A4EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350128, "uuid": "d89742d1-2f83-4bd2-8206-f85a80156ca4", "value": "768:Q8ar+BvMSVaTEUSuAv2eC3tOX8w2KYUZ7nwp+pE0pbAimPJZu:qSxVaIUFN3YYUZsQpbLmPJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350128, "uuid": "52ef16f2-08ee-4968-8b23-d0f4ec6e086e", "value": 32481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350128, "uuid": "8fb96e17-3e8a-4c38-9ccd-86d80a8cb1c9", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350128, "uuid": "ec9599ae-cb76-4477-8fdb-e542c5891822", "value": "4f536911b2d46ececa07175e0e0db5178855029d6155821dbb7ff1b2b5471d70.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750bc16e-d560-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765327070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765327070, "uuid": "df75f441-2d74-45a4-9c84-991b32cb29f5", "comment": "Malware payload (Mirai)", "value": "6a5ef3e727f3d392408fbc18f4ef3b7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765327070, "uuid": "058cbcc9-348f-4d60-b9d0-c2e3946d1efe", "comment": "Malware payload (Mirai)", "value": "4fc179d09a7819c73a55765a9941352a268f539902a07ff498cab4439890fc42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765327070, "uuid": "ff78d373-3164-4271-a90b-1e3990dfde73", "comment": "Malware payload (Mirai)", "value": "3c72127e34c7db94ff0a2b7feb05918572724ff4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765327070, "uuid": "1033758d-c63c-4bdf-94fe-4a2bfd37f60e", "comment": "Malware payload (Mirai)", "value": "74d93836871eb24dd63454f1fa2f7aed6cc50ca5160a0e48be2bb53250fd301bbc5226da74cff0415bcb2b047a5a2e98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765327070, "uuid": "c997deb2-1243-467c-a5a0-5823612313fe", "value": "T16AB35B03F5D181FDC06AC234477EB23BDD22B2DD5278B2AB2BD4BE121D4DE221A1D959", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765327070, "uuid": "48bf3ab8-5879-47ce-82a4-92c61dd7f758", "value": "3072:aaPi1FT3v8c4k8L8oguxgbB7xU9DqvTMlD41VEl:PPi1FT3v8c4k8e6g7+xqDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765327070, "uuid": "e810ec43-649a-4c28-ab4f-436262054151", "value": 108904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765327070, "uuid": "5765d5de-44d3-42e8-a6ca-bc6e4b3b4776", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765327070, "uuid": "d652d313-fc44-47ce-8018-d2fe6b7d89e2", "value": "colonna.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3807718c-d56e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765332981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332981, "uuid": "0fb63386-d9cf-423f-be1f-531f1e5cf055", "comment": "Malware payload (Mirai)", "value": "4bd90e620f414875cfde67bd492d638a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332981, "uuid": "a5fa9548-d1f8-4699-854b-2021b06bbbc0", "comment": "Malware payload (Mirai)", "value": "505196d4fffb940616b2fdcd82d550984bccd34073898d7b2d363e819acebc30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332981, "uuid": "8a541f94-18c1-4de5-8caf-e8b5882cfffc", "comment": "Malware payload (Mirai)", "value": "45e071447e821551c0ec46d84b844f058e6485e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332981, "uuid": "543553d4-6ddd-4c0d-a036-1bb3d9b81e75", "comment": "Malware payload (Mirai)", "value": "3ea762a1f9a57d34bce01aca4252db3503e8f4d6b1346abf6e43c185d647e4851287e6f6dbb0943898a06c9d9a5bd74a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765332981, "uuid": "64f6c29f-83d7-4477-b357-9e77c994ea6d", "value": "T127E30956F9819B15D5C151BAFE0E128E77131B7CE2DE72129D24AF343B8B8BB0E3A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765332981, "uuid": "8d4ad6da-b56f-4e26-b976-bfad70dfabe4", "value": "3072:182KpkLYVi81Q2vCc6/XqsaaSyCRQymc/dedowj+q:K2RLYVicxw/XDaGCrmckdowj+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765332981, "uuid": "670ceb4b-f8e8-4f80-8586-db0cabd72bd5", "value": 148376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765332981, "uuid": "9a2fddf2-b41d-4ba4-b2a3-d806b8cde300", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765332981, "uuid": "6e77be40-7e39-4328-a1e8-c5c07dd6d13d", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369a2313-d56e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765332978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332978, "uuid": "0874c598-e39f-417a-8904-e5ddd22061c1", "comment": "Malware payload (Mirai)", "value": "6d5c59762616ba3c5665e4b6f757eb8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332978, "uuid": "6f573fda-8414-4d9f-9daa-8a21356bbd98", "comment": "Malware payload (Mirai)", "value": "509ddb3b6d78fb1480cc8bf1d7979a0db088c7da4abe4d8798f9afaa4571ca44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332978, "uuid": "12c9fee0-50dd-4e8c-8b41-3d235f1dfa36", "comment": "Malware payload (Mirai)", "value": "cad52084d0548010b9e1fec43943dd9881a05dd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332978, "uuid": "656116cb-719e-4e06-9868-cb9ffce57549", "comment": "Malware payload (Mirai)", "value": "d6a2ddc5c328f4b0d606ef6ab8cb3a3bb78f92ba991969385d54d8f40383d4307ccfca6ac4a8c6a406438e23ddf7056b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765332978, "uuid": "365427e9-22d2-4f4c-b957-b021476d2fc6", "value": "T103C2E63782BA0D07C0C8677554E39373F1BAAB455098CB5FBE540E8E6E913406A7BBD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765332978, "uuid": "dbd75bbe-ebd0-4983-95a2-e5ab481728a2", "value": "768:BghlMEvufaQoB2Mo1xtv4A/n+0KXwQHmeI:Bg7M8ZQoB2Mo1xtv4iFKXwWmeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765332978, "uuid": "673c29fb-07b3-45db-8ca4-4cc8bda9ab12", "value": 26872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765332978, "uuid": "bed2a955-b63a-4b95-9b8d-f13a3e1a250b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765332978, "uuid": "a7ed8f57-2434-4a93-9809-652a2e0d07ca", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790e8315-d5f2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765389783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765389783, "uuid": "deb1da01-0f67-441f-9f3f-93019beeaa76", "comment": "Malware payload", "value": "9be8a7cfbf9c061ba1bf0f44d11ac5cd", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765389783, "uuid": "fc5c521e-5e72-4996-af09-f22798ad33ae", "comment": "Malware payload", "value": "50ba5d0856668370a63e0dbde0a95d7e82dd32043e2784eaf26a21ddffe74712", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765389783, "uuid": "a0e1c5be-6dc3-4121-b204-5b61622d30b2", "comment": "Malware payload", "value": "859728fec116e5939253472668909a48abba632c", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765389783, "uuid": "f0b9cd8f-3b55-4a32-b97f-9b87d3b98543", "comment": "Malware payload", "value": "c7bc7872a4d1370bdcad56eae042258f9f2b8c5a92ed942d0ba03c4cbc3f05165b10c62e6105a41119a6374bbe75144a", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765389783, "uuid": "ccf8dbbb-9384-4b32-acaa-a95fe8b11643", "value": "T10FF0751D341112E1309F348D402EBF6D9B23633D288FD05E64466F0E062774710D6425", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765389783, "uuid": "c6c37125-c687-48a6-bb1b-290716d98ae4", "value": "12:XdFHjv7sHO3H8IrM31dv2GMiQSLhyGD8u350Jd8LJO:XdOHO3rM3141i5RwFJQJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765389783, "uuid": "6cea690f-6cd9-4857-9d87-0dbb2b64e6b1", "value": 535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765389783, "uuid": "0fefc153-ce37-4f5e-abce-fbcb40fed47b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765389783, "uuid": "f1a7ff72-72d0-4bd5-8662-940ebec05927", "value": "download.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e0fe65-d597-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkCloud)", "timestamp": 1765350560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350560, "uuid": "e1ddf195-d87c-42b2-bdd0-741fd62ec34a", "comment": "Malware payload (DarkCloud)", "value": "9941744e3799d3bb314ca58c72b7447c", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350560, "uuid": "a0908e44-2cbe-43e9-977e-d5163c6f20d4", "comment": "Malware payload (DarkCloud)", "value": "516348c99209a4bcecf45eddcf7c2ee7707750dac98121dffd19039290903263", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350560, "uuid": "92176a9f-928d-4411-8ec7-cc46ce3bf380", "comment": "Malware payload (DarkCloud)", "value": "f89d5b07787311ce744916b0ab62a40fe1b958ee", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350560, "uuid": "81bfdadf-0cfc-4e81-aaa1-fbd61a5ebee8", "comment": "Malware payload (DarkCloud)", "value": "f4b6360b146a28f2125f21a27c0961670d0c4a4c5def5f1d28d9a452fc84d58dc4d81ee2f8f66478cad77d1e79db3c43", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350560, "uuid": "5a4c077e-b521-4e56-a36f-c0c8e2704542", "value": "T17D127EA122DBC454E313C2395F8884357F3826E437061A5E0AF80543852D8BD5E6CEEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350560, "uuid": "b47adbd5-c8aa-4261-9779-72ab8b8c96e5", "value": "96:MMGEkiKiMCD0GLsOAc8ZZ6w2rirZzObmpKWnw6Z4RBdN20snREo:VGil012wEidybKBwzN2rnREo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350560, "uuid": "670ffd45-3afd-42ad-80ad-d2a5492a64e6", "value": 9324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350560, "uuid": "f9806d8d-3725-489c-a552-05cd883d1167", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350560, "uuid": "07a6bfaa-7879-4a1a-abae-f6a44efc69dd", "value": "scan11062020.doc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf8df78-d55c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765325229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765325229, "uuid": "927efd74-fa7f-447b-9e3f-9339ee1a4d44", "comment": "Malware payload", "value": "5e8a266d9e02529aea4378d6ded64bc6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765325229, "uuid": "1c7f5077-ef74-4674-a846-738fbd13f89a", "comment": "Malware payload", "value": "51921ac64c1e6fcf954ceb5096bd1dc319cd1bf5ce71357d5975aa42e30dbcd9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765325229, "uuid": "2daef337-600e-4a4e-894a-e89223868db1", "comment": "Malware payload", "value": "1aee29e8abd7f017211038eb2d1bdbe7c9d97141", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765325229, "uuid": "adee6d50-644a-42d9-9ac5-7cacc207556d", "comment": "Malware payload", "value": "b360a005ecdb957268486dcfdd0625bde0c31b0fb500562c43c9f50b4aad49c03e041984e2f38d04471aac528d23d5a6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765325229, "uuid": "d752906f-84d8-4ad9-a571-82988f9b1ab4", "value": "T18A75235AA7E954B5E0B523B6A1F243836E32F861273846FF13C8D27E1D335D0A634B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765325229, "uuid": "ddfc0750-8a6b-4232-b706-79a97755087f", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765325229, "uuid": "6900cdc5-13b6-4b6c-acb4-a626044b33d2", "value": "49152:fXr8WkDUmozjFolLvzK/eAN9B/zmYaMjdmsk8iEXF6:T8WLmozjilHRkr3a6p1F6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765325229, "uuid": "bdacf965-6539-46da-b2c4-947f10da9b6e", "value": 1609248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765325229, "uuid": "694e27f1-6e69-4074-bec9-1a54027dd791", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765325229, "uuid": "c2821981-001a-4704-a36e-857e371408e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3ed29a-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1765345227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345227, "uuid": "f094480a-e2ef-4126-bfaa-29dccaeaa83c", "comment": "Malware payload (Formbook)", "value": "d7c6d928034e29edc3e9c0c2ee8933b8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345227, "uuid": "4167a9d3-8da0-4a90-a3bd-6279ad202748", "comment": "Malware payload (Formbook)", "value": "51a2ac7034e51c1d3304ffec341ff89b04014d393fd1ffee14a51010e33fa340", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345227, "uuid": "092f0f4f-df94-42de-86ec-2b1430810e59", "comment": "Malware payload (Formbook)", "value": "55dc22f4e1f6e49e023803bb5a7a697bfca4c339", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345227, "uuid": "79e8b3cd-8db3-4742-b572-c45a7504fe1c", "comment": "Malware payload (Formbook)", "value": "8e6a1cfe6683733285cd9060e084029039c43db7f277392ab6263d4434e85735a864e79b4afcbf63347a726b4c2c6211", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345227, "uuid": "440c7efd-ea74-4b2d-8e84-e2922b5b08b4", "value": "T1B895A25D84B1ACD3A054FEB4F685FFD78C9B5385162B07421FE4858A3312C83FAA72A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345227, "uuid": "4e58a674-af5e-4404-afd6-782de819f3c1", "value": "12288:t0ld6398GBCF9CIadzgVQ5KOChBpW3TcaRtFThYbrwBOS2Os4gvuZ/D5P7IoMgRD:sQ39PGmdmEwpScUThFm+Z/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345227, "uuid": "990decf3-9377-498d-8642-556c22ea23e1", "value": 2061264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345227, "uuid": "4aaa01b1-daa4-4300-b026-4e03c2d23d7a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345227, "uuid": "f762d501-1634-4ae4-a70b-13c90c955309", "value": "Absa Proof of Payment.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b780049-d598-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350998, "uuid": "859d3a99-cce6-42bc-a9e6-0326dbabe804", "comment": "Malware payload (MaksRAT)", "value": "34c0367536d1f9a61a5c5fad5b1d2f1d", "object_relation": "md5", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350998, "uuid": "2b42fd36-b5e7-48d9-91a5-2fd79606b796", "comment": "Malware payload (MaksRAT)", "value": "5200e9c097661397f265b94aa622d0b428422f1d4cde70fc7380979aff0f7a81", "object_relation": "sha256", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350998, "uuid": "71ea1c02-6040-4835-a28c-e3e977719276", "comment": "Malware payload (MaksRAT)", "value": "c36e55531789c55a2204f1e21b9008a49b4bb962", "object_relation": "sha1", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350998, "uuid": "994fb9be-f27c-4f86-8000-2da970ff4784", "comment": "Malware payload (MaksRAT)", "value": "b2180cf200214a908af0a1efdbfbdf6257cf7b39f436f1a561103cb9072fc8e23dde12c1e514f87c2d5b98b1c911b440", "object_relation": "sha3-384", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350998, "uuid": "e30e1c7c-040b-4397-83ee-a2f3e7ec96ba", "value": "T130E2E175DC23CD26C7D2D13BA25AD61DE2228A15F729E4DE4FE91C9E802DD212D1B844", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350998, "uuid": "5b006173-99a6-4910-9285-7958cb907f82", "value": "768:t6MtsOqATxLuJnHUx87B9SjhwVnPMPO4gEcwp8yPoAcKqIFGqNJa3:sOqANLuBV7wh2nSGDwjQAcKqEI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350998, "uuid": "31a452be-3b72-4cc6-9f9e-110bed95bd09", "value": 34137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350998, "uuid": "f24d4997-4c54-4bdc-8280-350d1d48df80", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350998, "uuid": "063cc1c8-398e-4701-aaf0-68446f9e5572", "value": "5200e9c097661397f265b94aa622d0b428422f1d4cde70fc7380979aff0f7a81.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ae24ca-d5c7-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1765371225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371225, "uuid": "e87eb4c0-f87a-43b0-8427-2b941bd9102f", "comment": "Malware payload (Vidar)", "value": "e920e37fca6fef23048b776818d7463e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Vi", "colour": "#3C384B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371225, "uuid": "d5b439a0-c6df-495e-9019-d34a63a371e3", "comment": "Malware payload (Vidar)", "value": "53725d975785fc89398eefa4e3d25ab512d98f6fad9e76cdbde6283caf5b1ad7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Vi", "colour": "#3C384B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371225, "uuid": "86aa4f71-cc26-4992-a898-9df256a435f6", "comment": "Malware payload (Vidar)", "value": "419423e3db0515a808e59c3e095f353d95996acf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Vi", "colour": "#3C384B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371225, "uuid": "8b7bdebe-1b9d-41e4-97fc-7299a98102b5", "comment": "Malware payload (Vidar)", "value": "f48697d11699a648b641e98bfc91bd849031eece0979b15f25d2dd2b236a8cf3cc8a5855d2293075d71f9e371a10e497", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Vi", "colour": "#3C384B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371225, "uuid": "eb630caf-9ea4-4f0d-a16b-f7aaadd902e1", "value": "T1B1862952BA81496AC96BF135AD70621073757C0843363BD72F9746A90DFABC0273FB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371225, "uuid": "6210f456-374b-4608-8dc7-34b18edde52d", "value": "11816731f87952ce23da086b67eb30cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371225, "uuid": "7e99295a-9ad8-4519-811c-015a3f1b07c0", "value": "49152:pJasUH3ldYbOxhoSYVbcWK1oTK57uQQUrpp2pCxWGrnAYkwnUQMTkc3I474nGQgK:pE3jYbOgSyhG5KQQcp2pRGUYkxF9wT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765371225, "uuid": "2fd97043-e74c-4778-9b17-3ad4f9b1e2f8", "value": 8348192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765371225, "uuid": "af61cf1b-491d-4d77-b9a8-c949cc8ac9a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371225, "uuid": "0b52acfa-2e19-4137-b700-1fed87a1e422", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48218edc-d61d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765408170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408170, "uuid": "f279bdc3-a137-4e43-95a0-3feb25260b2d", "comment": "Malware payload (Mirai)", "value": "1386b4956c3146da3d3c404a48944eab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408170, "uuid": "8e6ea8de-c200-40ff-93a2-438020520718", "comment": "Malware payload (Mirai)", "value": "53917b4b5658789998371f9a6f2d5bbe08fee8e92834c22eb2d10da465d67ee3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408170, "uuid": "1f33659b-511e-4552-a2f0-ae0fe4ae9f13", "comment": "Malware payload (Mirai)", "value": "d2f4541897c10f44e017b87a376cf5757541e68c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408170, "uuid": "8dbf0a15-ed2e-488c-bd99-ad44ae6d293f", "comment": "Malware payload (Mirai)", "value": "f591c6fd2d33032971df1b4065a57a529811d6a4b22c9257397f8909c318d1fe58a92f2f396378a9277126efafc02374", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408170, "uuid": "79b6de79-a4e1-4953-90e4-9a702366b6a8", "value": "T1B8535A42721C0917C5D709B0293F2BF183FA9E50A0E4F28A690EBB5E467AE365447FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408170, "uuid": "c412db1e-f5e0-4233-8bc9-7c7140474d72", "value": "768:6OCDlXY8VUaUTRtdgymH9PdrbLpadF492A44Ewo96TBgOUzmUGTD2rTjIPY/NT3E:eXYYS6RP5bk29vPZ4iTWT0PYFT3bsRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765408170, "uuid": "0c19a9fb-f59c-4c10-8606-ad7177b9bee4", "value": 65568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765408170, "uuid": "0d2ca912-ad42-4467-b532-bef28801863e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408170, "uuid": "75f56306-b904-4434-9546-3eec3b6c60c7", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "150df9e2-d5f9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765392622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765392622, "uuid": "5126d3ad-92e8-4b97-a5ea-fd6225c7651c", "comment": "Malware payload (Mirai)", "value": "c795fef5f64c1c9ac87e8b9590d4edb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765392622, "uuid": "10bf66d5-97ff-455a-8004-4eddd759f8dc", "comment": "Malware payload (Mirai)", "value": "53ec40805ac9f295e59feb1be2ec23feeb3cb5482edba12cd3a731655b45c5d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765392622, "uuid": "83319d3d-288e-4d98-8cc4-0cbcf8a7ff83", "comment": "Malware payload (Mirai)", "value": "50299d8935040c485503af204ae443e83289fc3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765392622, "uuid": "9c0f867d-9e54-4b48-91af-e27e1ebd1d7c", "comment": "Malware payload (Mirai)", "value": "20e003c09445c6855eafa01dfd3361ff33f9f139c4e65cdb53af5c7323111196ea4fabb0cb6a061d20b2c01c0e799b15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765392622, "uuid": "3eafd019-78fd-443d-8bc9-c7b49a5b32e2", "value": "T19B03E13066956D10CBF25674EB9B8047F20AD9FA78BD307A10250EA9E9C5B2115FFB0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765392622, "uuid": "4823f7b5-67d6-497e-b1d6-e6caacf8f415", "value": "768:i7jvpeyGf4TkHLsrNInf4jroml1TLl8iqfku6Fe6ZswgBds3Uozq:i/vU9wTkrWK4jscLpMqossw9zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765392622, "uuid": "3a329d99-7c0b-4233-9f93-f85d95d84219", "value": 40940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765392622, "uuid": "a32ecbe7-ff95-4c44-a4d8-f180364bb7ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765392622, "uuid": "4674d784-2c6e-4b78-a693-f102ab7a4d48", "value": "Labelloperc80.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb003dd1-d5dd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765380875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380875, "uuid": "387b87fd-b8d5-4025-a1c5-2e48130d1805", "comment": "Malware payload", "value": "178f3f1504d5c52ef7f8376d9e6a3a22", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380875, "uuid": "8fad642e-b22c-4901-a2c3-9f0811c0498e", "comment": "Malware payload", "value": "540d587a05cd74ebd4f8cc80ed41f582962acfb5c38a897ca3a4d6abd72770ef", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380875, "uuid": "6d50609f-492a-4b1b-8766-4fc28362543f", "comment": "Malware payload", "value": "1692a2ff84eea8e4a3e6014d9618f93930dfc743", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380875, "uuid": "4646dd43-8810-4912-8053-783665bade60", "comment": "Malware payload", "value": "443130108e0840d4d987c76257e4af3470ea9040050ba03eb98ddc68a3915c19ab430b9ca032c9d26979c597e47796db", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380875, "uuid": "0ec9b81e-63dc-4431-ba0e-f454b31791f0", "value": "T18D12D6917D25A4BD124EE83A9C456D14B95F40FF2B9D9F39391D0EBE2F902A0737C124", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380875, "uuid": "411ca7f9-9d0c-4f76-83a5-54e5dfad6e3a", "value": "192:Hy51tcKoGrGPAUqtjh8bruSQKhzete2o1Ps6Hmt4hYnuCrihgJ6T3zu5nDw9Iqdk:SVcKo4UqRh+92o1U6Y4dVgDMHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765380875, "uuid": "8078be8f-9f61-4255-b0f2-7c2b8d0caab9", "value": 9602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765380875, "uuid": "6b5c8654-7967-4aa8-bb58-fa0f66b59ceb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380875, "uuid": "23fff3b0-f278-4699-b58e-302e94c76c15", "value": "pr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de3ce128-d5e6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765384799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765384799, "uuid": "867d2987-64ac-4971-b1bb-b87dd45a4361", "comment": "Malware payload", "value": "c466a4c42097483b01107ea0fb49360a", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765384799, "uuid": "0be3b40f-8699-4515-b35e-4e824070b5c2", "comment": "Malware payload", "value": "54ff2c52ed5e69934031a02b43ff8369ec9f12f148fa7b95c2fec6c2dd719de0", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765384799, "uuid": "65de7bc7-372a-4453-b960-984f265fb987", "comment": "Malware payload", "value": "527a45d8bec96686172fb51cd6bc0e68158ec718", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765384799, "uuid": "82a47181-102d-4bfb-9715-daca65f740e7", "comment": "Malware payload", "value": "34b6c03de67f7dcbad59f8eb225f7391d2e9d1da7605e06aef23f460dfb0557e5fc308025561169bd1d6aaadb1f205ea", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765384799, "uuid": "3d828abf-0ba3-476d-8d29-1495e84c8e24", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765384799, "uuid": "3f597aad-e30a-4f59-827d-58ae4699c760", "value": "3:N8FV5AlcBDn:2R8c1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765384799, "uuid": "c795f565-36dc-47f3-bfea-0a8d03ad8dd3", "value": 31, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765384799, "uuid": "24e0c440-1c4b-41d4-b15f-e6863ae461c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765384799, "uuid": "a1fb46e6-1269-444c-95a7-f74e787f00fa", "value": "ikrs.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc2cd86-d57a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765338362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765338362, "uuid": "a75217dd-3146-46ea-b69b-09cb10d0b82a", "comment": "Malware payload (Mirai)", "value": "0cc0dc37ebd7e271883c31468e16ecc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765338362, "uuid": "7711f598-a471-45b0-8acc-4e613117e712", "comment": "Malware payload (Mirai)", "value": "55dec22c3d4d7ccd95129a6d434c1f9d9851a9f0b8638462b4fbff15f8ac16be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765338362, "uuid": "3b016a64-e561-4b6d-ba75-7a8765b2896e", "comment": "Malware payload (Mirai)", "value": "774f6b935eba13246bceb22cf15392e2d2bd023c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765338362, "uuid": "2c1e0213-ac2a-4920-a3b5-b5512c7062d7", "comment": "Malware payload (Mirai)", "value": "a1a506d8042a47857e1125083791db51d3f066607074827f9659972ec3e47207cbec5983da678758816709a9e84b1bcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765338362, "uuid": "b7ed24c8-cde5-44c2-b41e-0d2dd36f2e98", "value": "T1C0D3AE87F79315A0C87206F007CF6BAE3E2322819F6BD9F72D296636197A1CF4505B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765338362, "uuid": "c0e6cdc8-9978-49ba-9026-b924b0a96f72", "value": "1536:OoNOoORvEzurmgH1PIj+a76TpEeQCz5vl30pWHCSya5xJYTk2Hh+yHgta/LWA:z8tZna7auZU5vCKjyat2HfHgtaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765338362, "uuid": "b7458711-a58a-4d6f-b28f-f72ff3cee39a", "value": 140576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765338362, "uuid": "5bdad27f-87e9-4668-adcd-2bc662f99d4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765338362, "uuid": "dc51d7e4-cff0-4590-bd0c-75ca82f2f0db", "value": "colonna.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c27431-d5cb-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765372873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765372873, "uuid": "108290fe-6fb3-455a-b95d-870ec53c9db3", "comment": "Malware payload (RustyStealer)", "value": "51bb1bf58e68f1c17ee0bb95b7eaea6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lamia", "colour": "#C00104", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765372873, "uuid": "4cd371a6-cba6-46e9-b976-761cba7af8cc", "comment": "Malware payload (RustyStealer)", "value": "564768d7bbccf0da8dd07759dec843c5fa675f80ba82bfb6b48b153cd85c63a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lamia", "colour": "#C00104", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765372873, "uuid": "e284c337-7e09-4b09-83e3-29b5acd22807", "comment": "Malware payload (RustyStealer)", "value": "90a1ab4c0c5cc5638c3556b245703e03abb7945e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lamia", "colour": "#C00104", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765372873, "uuid": "460e719b-248f-4d0a-89d0-69b120f740ec", "comment": "Malware payload (RustyStealer)", "value": "68e3913bf636d51127e8e0ebabaee2111bf1b18403b82cb3becbafc5f3a41db4010506b84aa0f4d050f2bcbe7c9f1820", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lamia", "colour": "#C00104", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765372873, "uuid": "12e8d751-4580-4767-a128-67d754113aea", "value": "T1D7663307B729A999C64AC0B4430BD6B6B5217CD90E20BCBF16E44B312F5BE665F0D31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765372873, "uuid": "f6d7bbd9-e5c1-4ed0-9645-c3987f6d4d3d", "value": "78552b80f78cae655e8d73c4d7cc15d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765372873, "uuid": "35121bb2-94ea-48e2-9ac5-fce33efd00e2", "value": "196608:LZOoIgPMYtbVWFwOdpCQopmrUza+u1R4+7AD:L7ISMaIdog+a+u1KB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765372873, "uuid": "49b3ea37-d510-4720-932d-e5b5b015d568", "value": 6934113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765372873, "uuid": "1eeda5d1-0b3e-46ee-bc9d-ced82d9368c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765372873, "uuid": "d0240bc9-b6a6-4dc9-8a4b-314233a8af8d", "value": "UpdaterService.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a67ce3-d5b8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765364981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364981, "uuid": "7d9be71c-d03e-4a30-9ede-cc1d91b34d3f", "comment": "Malware payload (Mirai)", "value": "9300469ee5f5539ee1900923b7fcafb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364981, "uuid": "dbbcd6c8-9c27-4990-bc9c-27000f7e613c", "comment": "Malware payload (Mirai)", "value": "56fec56fef4a92c7c0f98185ea124d9a731e85d6888fc64e05fcf10009e1bc7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364981, "uuid": "36c411ef-c4ef-4cae-ac8f-1f01f2bac815", "comment": "Malware payload (Mirai)", "value": "3e78f0534e16d3348e793b6773bfc18587a61b34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364981, "uuid": "d51df5ea-4e10-4d24-ae69-61a08211255d", "comment": "Malware payload (Mirai)", "value": "f3f9764831e5dd1b959bef9c035c2db5381fddf429d5a3066666bd461c85f8803d8e3b9bb59963eada682ad0b84aa6ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364981, "uuid": "4c144080-2f6b-4094-8385-f6620fa0c1df", "value": "T1D7330226087359E4C3B358FDDD399BC01BAECB67D0E922E51256AAD60BFE121B162443", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364981, "uuid": "cbdf272f-a4e9-4d8d-9ceb-24fa357cda60", "value": "768:CtPjY3Td1vVlmbigb4vyuIT5QySzD1yF74j55OyBiwoX3hIrrLs3Uoz0:CtUjdXiLEvytSpMWjO8i9I2z0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765364981, "uuid": "4be8f108-1725-404e-935c-9b38af43d00b", "value": 54044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765364981, "uuid": "bbb0ba7f-6f4b-46de-9e0b-5a531c875280", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364981, "uuid": "334d1adb-a16e-4a04-b8ee-cb25c4d61ff0", "value": "ecco.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d84ac1ec-d598-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1765351288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351288, "uuid": "f8c63acd-68c6-42be-9f9c-560f4cfa8995", "comment": "Malware payload (VIPKeylogger)", "value": "ab6cad6171538fb4f8d5f48442cebc42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351288, "uuid": "6842d726-83d3-48f0-a1f9-92d3f7720a11", "comment": "Malware payload (VIPKeylogger)", "value": "570dfed70f1b3a3206aa824a873d5c052aed8636e80b312cfa442d8717e2c2b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351288, "uuid": "b893f2ae-bf86-4aa6-9023-bf3dd3b782a0", "comment": "Malware payload (VIPKeylogger)", "value": "3d1757af69bf4122053a0afbfe4b170d94ef9aaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351288, "uuid": "e3b0167a-88d9-4622-a1b3-7c59a3da7e65", "comment": "Malware payload (VIPKeylogger)", "value": "06ee42d22ffe3a159fa332875e18370a7622c1fb3695808c973e7e1857d763d5d7adb80d279e6bec6fcb4f7a35006fa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351288, "uuid": "e3d43dcf-1939-4ceb-b0bc-883aa72538d8", "value": "T1A6940258BB40D89BC6435E308D76F173AA74BC060A305B872B98BF7E29731E2DF09655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351288, "uuid": "6ba289de-3ef6-4c13-8171-efcb4f3aa81c", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351288, "uuid": "eecd8b5c-1825-4388-b7dd-26769df0a64c", "value": "12288:ZXiR7PA9QWY+0dYHCbDqfZeFIWv5pWmoxUj+1sknep8BaxzDZartF4oIO:ZXiR7PA9QWY+0dYHCbDqfZeFIWv5pWmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765351288, "uuid": "aa860ccc-a1ce-4858-a0e1-f15a5561e14f", "value": 427800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765351288, "uuid": "b5153be4-41ba-4567-bd27-2cca866fad1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351288, "uuid": "8e05ee61-957f-4849-bac6-157054c29301", "value": "Recibo de pago2025_12_09_00000045.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2e51df-d595-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1765349715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765349715, "uuid": "26256e64-e71a-41de-a1f8-c0875f841217", "comment": "Malware payload (PureLogsStealer)", "value": "3005e1b8efbed5359fae395effeb4ccf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765349715, "uuid": "23443863-4a5b-45d0-903d-f662095afb86", "comment": "Malware payload (PureLogsStealer)", "value": "576241c7089f20d1420afb7d50c17f936b933455167e40c356d4a97c8d0464d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765349715, "uuid": "5a0abdc9-04df-426e-b826-28c49e797489", "comment": "Malware payload (PureLogsStealer)", "value": "6e178de6e523b048571ab4161913dd78f3931594", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765349715, "uuid": "2f6a03ff-5dab-478e-bd26-5c15966e8d20", "comment": "Malware payload (PureLogsStealer)", "value": "49fc6a7fce541ed0fa5ad604dffd9dd2187e403802b63781ce79db4bf87dd9418041233086da5015e8df04875c51ec2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765349715, "uuid": "50d0eb0d-8d96-48c4-8524-ad27462e4714", "value": "T1E6C4234CE6FC4840F55C5FBFD1C2CA56DBF2A2A74CD2A65CD058C24228B2F63A793A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765349715, "uuid": "56342a9a-28ab-41ce-92f3-7ac3752c541d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765349715, "uuid": "c76473e6-f7e0-4175-8036-686093066404", "value": "12288:v45hypl+rBqS/jWYLU+9sHNf4jL9Py5soADZCP4QSTglxCgcLqcZWejTj:xvkBVVL/9Yfe9qUDoE/VLDZW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765349715, "uuid": "7cf82121-e4e4-4d74-b0fd-ec4fd205c521", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765349715, "uuid": "bf7eedee-c9aa-430e-9c6c-f5fd9b82d52d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765349715, "uuid": "dac1b108-2824-4a31-a760-daebbf4b2909", "value": "1765349347f770746a3e7e2daee7301ac2e1fcd5762b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d203de0-d58b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765345552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345552, "uuid": "c2bcbac7-8f77-4d57-b62a-7f9ab4f49bfc", "comment": "Malware payload (Mirai)", "value": "23badf5efe8666c6900d629a1b96e840", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345552, "uuid": "b6088777-3113-403c-9cb5-f78b8b8f7200", "comment": "Malware payload (Mirai)", "value": "57cff1f0c9fbeeaf55680e7e73279e040d49aa77fa8c23c58119b88fe54b2667", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345552, "uuid": "bd14c28a-f5f3-4795-b4b3-71e14d468927", "comment": "Malware payload (Mirai)", "value": "6a32110252de0c4a9cc82db8ee7f61b93fbb5032", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345552, "uuid": "55c3d30e-6778-4472-b5a2-459946f5d575", "comment": "Malware payload (Mirai)", "value": "8958e6543994e8cf6a8f6fa3df9794a22585dd6d3f06ebad5f2359b2beeff841f000dc10da7a8b97f84cf655d5f5d9c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345552, "uuid": "24233443-bfb3-44ea-a118-7b845f29dc3b", "value": "T17093194AB9919F12D4C622B9FF9F414933536FB8E3E93101DD20AF6027C69DB0EB6512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345552, "uuid": "4e1b1c02-7a4c-4f3c-907d-6c2f0962bb09", "value": "1536:/5nx7AVHJ06XwaY0nTyMKiN+hQ+aUli+x44ZiA22l4ZixfgUdZybY70IVoK:M26HnKi0G+aUli+x44oSfgUdZybbIVoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345552, "uuid": "6b759a47-43fb-4957-a966-7a55901b17ed", "value": 90696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345552, "uuid": "aa7ac66f-5cc6-4dca-aaad-8e50af281118", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345552, "uuid": "415d7cbf-9f20-4b51-a201-3097ef3a98ac", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17bf0614-d5c5-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1765370293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765370293, "uuid": "87d33570-5f1e-43fe-83ce-c26225c3bf6a", "comment": "Malware payload (MaskGramStealer)", "value": "df2ed84c265f7491d81c7927be1f4d27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765370293, "uuid": "d31a914c-9ca2-4381-98f2-bf639c10fca5", "comment": "Malware payload (MaskGramStealer)", "value": "59b8f5eba4497eafaeb8bc16b74073d2a94f3142e5fcf91e9e3d37c666d8fc57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765370293, "uuid": "8eee6d11-feca-4477-b819-267d9136627c", "comment": "Malware payload (MaskGramStealer)", "value": "7c1741c50d325a4dc75e39e3ff4bf66d65d5b012", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765370293, "uuid": "1416f850-091d-4bf3-bb2e-662b7662c615", "comment": "Malware payload (MaskGramStealer)", "value": "40e8b1e18162450d132dd76255ca0e323fa006465cc53159145e6314b63b371073398b6ce03f5549ed687985ef5b21d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765370293, "uuid": "dfdeddeb-5fdc-4983-9ff9-990455744ff9", "value": "T1BE961992F9814629C65BF238ADB062217771BD4903313AD76FEB06650CEABC4173FB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765370293, "uuid": "75c543f0-ef2d-4966-a368-475280114477", "value": "11816731f87952ce23da086b67eb30cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765370293, "uuid": "c4c3f97c-b897-4b0d-8364-3e81d1fe46c7", "value": "49152:SagfF3QZWUYgBNbdtYfkfHZ7zPtcK1jpm0PeoLyP:UF3dQBNJ7q0PryP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765370293, "uuid": "37bb1327-aa18-477e-9fe3-3af562e6245c", "value": 9440592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765370293, "uuid": "aad43a6d-a644-4950-85d8-efc45ea49d4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765370293, "uuid": "88a51b46-1f98-4c21-a67e-b78d235a1179", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91bbf032-d621-11f0-a129-42010a9c0007", "comment": "Malware payload (GoProxy)", "timestamp": 1765410011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765410011, "uuid": "decf6933-834f-4b3f-b9ac-3cd75ba077c2", "comment": "Malware payload (GoProxy)", "value": "172376c4ef78b6aa2e95ad8ca22a1cf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765410011, "uuid": "904ed74a-4a67-4624-a18d-7c61f92e5108", "comment": "Malware payload (GoProxy)", "value": "5a2b8ec78903b0cda31dbf7a145db8eda647c89069af1990b322b63bc0ddd2a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765410011, "uuid": "ddd8fbe5-01d5-47f3-8d26-2b061e53e394", "comment": "Malware payload (GoProxy)", "value": "511f758188af7f054998cce4bc1395c3cfdd782d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765410011, "uuid": "41d485ed-94a5-447f-9e3d-e235bba825ab", "comment": "Malware payload (GoProxy)", "value": "14119aec16e484cfc908825d0c8b7ac8570c0dcdf0ce505cc7e65c3b08c0d2972902339a44f46640eabeb42c5f6d53d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765410011, "uuid": "1ad0541b-c142-4105-b8f4-96f4337bbea3", "value": "T181764AC7F8A504E5C0AAE33586679252BA717C485F3123D72A50FF282F36BE0AE75750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765410011, "uuid": "9d296767-80cd-4fe9-b6ed-fe42eed6aa71", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765410011, "uuid": "714e558b-95a7-42c5-b950-2c4581c16112", "value": "196608:OimCT3paGzZkLUA9/vebQdyMUFWdQ9i+R6z7lsi4+FcmLG99Lozle0bYhoA4PQmW:OimCVaGzZkLUQ/vW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765410011, "uuid": "30e22675-a679-40ac-91a5-a9f605d25ae1", "value": 7267328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765410011, "uuid": "c20d5bd2-dbad-45b1-8a76-ceddbb87b668", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765410011, "uuid": "111b1910-90c0-4c8c-a9e5-f40eef37cc39", "value": "172376c4ef78b6aa2e95ad8ca22a1cf2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbfd4e29-d5e7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765385198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765385198, "uuid": "1903871a-e9ed-41a2-8ae0-14e79482a0d3", "comment": "Malware payload", "value": "caf5577b07a182916ea3b62ef2f4733f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765385198, "uuid": "f92202ac-0137-44f9-8185-c2c18188ce5a", "comment": "Malware payload", "value": "5a96fae1b29481f182219ce3b894a7180a432da54728a7d3f667c465cc9ad580", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765385198, "uuid": "7cfa8a58-6136-4be8-b697-dc13b34f2ada", "comment": "Malware payload", "value": "bade26119b1a1675f05f0df69bd50b0d217ffe8f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765385198, "uuid": "ea496164-9fef-4a00-b379-e5445a974cd3", "comment": "Malware payload", "value": "61c29a8b4bed7fb78d9f0c7b3c61b2967ff5de3f5820d07af24d6f5e7e1bcb24b4a81bdc1b92eea4333ed8bfed5d1e51", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765385198, "uuid": "41d9dcaf-2b7b-4eff-bc8e-17207cfd290d", "value": "T13551A0C912524F316CEFD92F77A588883184A9FB74C6DF64D9EE78FE448CE09B044A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765385198, "uuid": "760c0e18-d604-484c-b90d-0b3c1064b0a3", "value": "48:2KU9SDOEDvdD8GD/9DprDRtiqDtitmDaED5+MLD2uvJDbFD/RDIGDEAzDj6:9npPJNfp/HVLnldPTzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765385198, "uuid": "a5ca4d17-4ab5-423b-ab9a-abe4fcc357ed", "value": 2620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765385198, "uuid": "9ca6a3a8-d5a6-408b-91c7-175476f80853", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765385198, "uuid": "3d8c8ba7-f4f7-4033-9d6b-46850bca1dc4", "value": "sshd.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4674b8a8-d5ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765395282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395282, "uuid": "10dbaa77-0344-4397-a67b-86408ac46eb1", "comment": "Malware payload", "value": "ae174eb521f9503eda05534f37c2f6f2", "object_relation": "md5", "Tag": [ { "name": "185-121-234-211", "colour": "#ACF702", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395282, "uuid": "1152720a-008d-4f11-acf8-be978f50ae44", "comment": "Malware payload", "value": "5b959934fb0324eede51db8ac523db1a9345f763880e9c1c8a1c41d21a2e8236", "object_relation": "sha256", "Tag": [ { "name": "185-121-234-211", "colour": "#ACF702", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395282, "uuid": "e7c9493f-2bb0-4c80-add6-0c697afa3b11", "comment": "Malware payload", "value": "ad7c863df72fd79cd96b21b3a88b02b3d330e099", "object_relation": "sha1", "Tag": [ { "name": "185-121-234-211", "colour": "#ACF702", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395282, "uuid": "58678022-1c5c-4210-b0ac-eefe227c20d0", "comment": "Malware payload", "value": "3fed045ec0943cff840b63acd39ff3a68e406f99fe8d83f9796032943c8f62b426dfcfafe116ae29a2b8616d9547031c", "object_relation": "sha3-384", "Tag": [ { "name": "185-121-234-211", "colour": "#ACF702", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395282, "uuid": "3e7e7b2a-53da-4982-bc4f-110ce6d143d4", "value": "T147B6F11A6FADDE42E0B81EBC96F24F45C532B411463E4263DEBD4F68C476AC46B3660C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395282, "uuid": "987b1eb7-3194-4ee0-8220-fd54266f6e41", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395282, "uuid": "adab40a7-504e-47c4-8db8-083f5452518b", "value": "24576:XQyhexiapkFX+k3iaWoMtuP6hTao1XRL9DUzAW:nh0pwXp3l0wSTT159ozv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765395282, "uuid": "c650c9f4-d52b-49bc-9717-384ec8c0774f", "value": 10485759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765395282, "uuid": "0847f0b4-e609-4cc0-9e7e-5f3852d17ed8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395282, "uuid": "3bdc95c3-36cb-44e5-83fd-17721f3b6a47", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7850bf3b-d575-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765336095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765336095, "uuid": "57dd1f72-8e85-4547-ad7c-9769fc1b3548", "comment": "Malware payload (Mirai)", "value": "441ba453bdbeacecfab56309588edb79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765336095, "uuid": "4dfbba5f-2794-454b-8059-2b98e7243866", "comment": "Malware payload (Mirai)", "value": "5bb6555cfd3e08d19dfe8e568e6115e3d44b756a92a643ce09299c0b3bf80f3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765336095, "uuid": "fd2b40c8-1bc9-4d39-953f-5c2efeb65b71", "comment": "Malware payload (Mirai)", "value": "3703944f4c7f4fdea21913dbe417f151c2a3cbfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765336095, "uuid": "8e4bc394-27f1-410b-906e-5a9061fb95f1", "comment": "Malware payload (Mirai)", "value": "701372b560684dd692982b1bd48071557bb20c3f1d36ced1262fc68fe50cdbcc5fddb78037ae4286e4f7a0552c9b984f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765336095, "uuid": "779b39bc-24c5-4c62-be30-25838ddead56", "value": "T1B604B50E6E198F7CF79987345BB79E31925833872AE1C582E1ACD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765336095, "uuid": "282f62c0-d567-462a-a146-24d1b209f100", "value": "3072:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/QBrj4jTv3TcJ2tD2I:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765336095, "uuid": "3d93c9ce-3764-45a1-b7f1-212bc899e7a1", "value": 175820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765336095, "uuid": "7b72971e-0c95-49a4-b98d-79673779fc05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765336095, "uuid": "45aeb431-a7c6-4611-953f-d86477ba2342", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d220c49f-d606-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765398523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765398523, "uuid": "9d7a205e-a39f-44fe-a587-30f214544b2b", "comment": "Malware payload", "value": "6e69a3e720efca5735b88dc287aaaf17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765398523, "uuid": "f42a2176-5050-44ed-b5fe-150eadf51579", "comment": "Malware payload", "value": "5cbd21fc9ade9e22c472a5ce0c620a5d89053342e13f046ab8be9fff149ae0f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765398523, "uuid": "4bcdcdbc-c2db-4ba5-b37a-aecbb6ce04ed", "comment": "Malware payload", "value": "6967a963838f8f6f0757756bd5efeecbf8f4b3c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765398523, "uuid": "85620aeb-7546-4326-963d-e0166d93a4e1", "comment": "Malware payload", "value": "58b0633312bfaf700003f1cd309d1e616dd47c20abdc76d6c0470cfb7f7ac26e3e1284f153712bcf1ad185013ae38700", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765398523, "uuid": "5e8e322c-b593-4974-bc2a-b512699928b1", "value": "T1DAA63982F9824526C56BE235ADB162247731BD48433227D36FD716A90DFABC0273EF19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765398523, "uuid": "da25e379-0b6f-4c03-b50f-9fe39497a8ea", "value": "11816731f87952ce23da086b67eb30cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765398523, "uuid": "fa63a168-1dde-4d37-8224-e4b000de0e63", "value": "49152:tVWZ63KtOb2AHPxZ5wcoK1nheg1owiWWK0Lc3chropUdjqpw68gvgkDjjORtrGmT:s636kvxEnB5O2VjO7WH3jfPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765398523, "uuid": "26068a86-2800-4dff-b27d-77698de64b35", "value": 9620808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765398523, "uuid": "61f3cf2a-c7d8-41f0-b5db-4d8d3b642efc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765398523, "uuid": "c6865b43-2f43-471a-98af-74490581855a", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96dc0366-d611-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765403148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765403148, "uuid": "55424781-483e-442a-95a9-8bfaeb7c68c0", "comment": "Malware payload", "value": "625324c2823c97276438ab5373214b01", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765403148, "uuid": "eb50c3fe-a532-4fe5-a74c-2bad1567cb04", "comment": "Malware payload", "value": "5da36b89427b237eaf57d03e7f9a4bbcf3fb34f60efcca9dabf8c20bcf7633e9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765403148, "uuid": "9362f8a1-3b83-4c5c-b5dc-d9386e13d724", "comment": "Malware payload", "value": "d7e10bfb215136a8cd094377878dc46d8ffb3cfb", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765403148, "uuid": "ddb26b2a-1b74-4f04-9cdd-3f424f481f17", "comment": "Malware payload", "value": "5d93f9c16a955909fa50246d229e68bb9ec11428dc0a474653778f202d18ec755eeea6db94c345bdbd48f10c8c4f819d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765403148, "uuid": "18470448-b9c9-4d4a-97d4-c3c2d0e49f97", "value": "T15DC312B6591CABB4C9F1C332CDB263E8F7B13D1A3167422F57F430152CB6988696B242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765403148, "uuid": "a3c5238f-c4e9-47d2-8cf1-ae71e1e87037", "value": "45b228818529b5da8b4b637c5fbddd3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765403148, "uuid": "8045edeb-53e9-4c50-9200-28744501cb25", "value": "3072:wGfXVsz92MCeNWHKE6evGUneSddmegp9+f:5emeRfIPn7qHpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765403148, "uuid": "8f6e0994-87ce-4553-9c99-857ca82863ef", "value": 124928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765403148, "uuid": "bf0c3065-b603-4b31-9c1b-bfc42fcdbbde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765403148, "uuid": "02f5edd4-c424-4f46-93bc-dd4e0e70bcf4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccaac2ca-d55b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765325070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765325070, "uuid": "970bfbc0-7b12-45d6-b66d-8723f1c54d99", "comment": "Malware payload (Mirai)", "value": "a7b360378f12553a6d5071f3dee4ad50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765325070, "uuid": "53297892-ac87-4869-b827-8cbae44c7f8b", "comment": "Malware payload (Mirai)", "value": "5db3a4be1c6eb9039ca4fcc8bec385f51f6cd4c3b752d3d13d175449f85e1dd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765325070, "uuid": "b8153e38-5600-4d9a-a016-8d1b15d3cf1e", "comment": "Malware payload (Mirai)", "value": "d1cdb6206b997d4f90aefe9800078b29b6a727d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765325070, "uuid": "798e18bc-81a1-480c-929c-757e4617f928", "comment": "Malware payload (Mirai)", "value": "df1fc29e4b6604a55497055f7591e173328b7766b1e2ef176cd19ad565897a3f2f3c6cab8545580e01259bc926bd2198", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765325070, "uuid": "7ec1b476-77b9-40a8-8a59-d290d005cd91", "value": "T14134BFA7FB8E0590C85602F80BCB8B6C6F17154A4DBB87E2787D353A2D6A1CF15317A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765325070, "uuid": "fd003085-4b27-4137-b1ff-993a7355d1ff", "value": "3072:Db5/iE718wVavu0t3Id2FAggRgbCU+c1x39m3uhiUINq7n2g5CVv+3ddDNq:P5H1ZVwuXa4RgJZ3eukZkTJCVv+HDNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765325070, "uuid": "71115149-fbce-4df1-9205-38356cff4d9d", "value": 239628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765325070, "uuid": "04adbea3-e564-40bc-a994-a304aa32d202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765325070, "uuid": "bd4cbbfa-f078-4127-a0c1-f7348326cb97", "value": "ecco.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "872eaaca-d605-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765397967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397967, "uuid": "86eb2670-976a-4f46-99a8-271fed600682", "comment": "Malware payload (Mirai)", "value": "dce742f06d3cbd34f2d7405f88f81293", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397967, "uuid": "87a6737a-1c0b-4973-a38b-8f99cda38825", "comment": "Malware payload (Mirai)", "value": "5e4d8cbc31a954ee161ac1efd1eac269202116af368f9477d115e3ebf979cc49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397967, "uuid": "2bc5bb38-128f-475d-b5b2-4f1e9cf0e16e", "comment": "Malware payload (Mirai)", "value": "8b07cf60297767c61483dc45ab26ce1fa22d26a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397967, "uuid": "bde87c06-afb9-4c5f-b8a8-d84036cc8055", "comment": "Malware payload (Mirai)", "value": "007628a7cf23fdd9c317f33a5cb81a4ff0600cf780594e5f05213a00481b21a5ffaa72bce33b984e5b29bc40c05c19f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397967, "uuid": "f068f24a-eac9-4f3a-96f3-c4e59bbed98a", "value": "T1068329C1BA8BC4F6D80748304067F33FCB32E53940A5D75DEF6A9E26DA376416B16289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397967, "uuid": "6bfba0f7-c649-4f5d-afdd-c41b7a687e80", "value": "1536:xp8qEknpXLVUkrZlW4HIWRawsK2oXcK6W2EFI9Z:hEkp7VUGZlBgXK7XX6Tr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397967, "uuid": "27b42828-77ad-440b-85be-aea0b065f7c1", "value": 83600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397967, "uuid": "40b788de-ae75-4396-b2d4-0c8b774a12ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397967, "uuid": "a245eb5a-1bb6-403a-a767-a6366f49317c", "value": "Labelloperc80.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8be38af-d5dd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765380871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380871, "uuid": "dc92b9ed-10c9-45b9-89ac-8ebee68f2deb", "comment": "Malware payload", "value": "c46f87014b4439f1b8a07878e2feb06f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380871, "uuid": "cea4c940-7301-4521-a458-89f43a6e4345", "comment": "Malware payload", "value": "5e74fe24389568a30ae37ec3705774b4978c9abc59211f5ca1c608562ca91df8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380871, "uuid": "91ed329e-67ec-40ef-8978-5df052f5d6bc", "comment": "Malware payload", "value": "4d58aeb42d564b3b6d6aaf8425802cccf1d4630b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380871, "uuid": "cef2cd3f-6c8c-4eef-aba6-816e0874936d", "comment": "Malware payload", "value": "5bdebd9f312eb527c8581e4fe683ffe076736c635e99179908e99126a7749e582e52989457f027fbe9892933435e0e21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380871, "uuid": "6326a22f-2e6d-4726-bc7e-3bbee493944d", "value": "T13CC533D48E240FEA48C5C5CEDB0F2186B1D8E930D15A2990164B9E3AD73BB7C771D1E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380871, "uuid": "f3ff3b7b-04b1-4a56-806d-028504a22401", "value": "49152:kaMbcNhqC25xOWIz0z0b2wa09HGMmvFDBC2Z9nZPOJ/CY3z:kaxhqC2zONz0QbvayLQzhZ9mCYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765380871, "uuid": "7d721ef9-a9da-4202-8557-216138a4ae88", "value": 2627344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765380871, "uuid": "a91841f5-c476-4079-b44f-0538d12534b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380871, "uuid": "ea06752d-e54b-42b1-9077-916ad83466d1", "value": "tcp_linux_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d91aec-d5b6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765363869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363869, "uuid": "b942fa07-36b5-4bb9-b9f9-f4cfe995f021", "comment": "Malware payload", "value": "322d43e6100e51d370ca37125ad0af6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363869, "uuid": "b486d64d-557b-4112-8fca-aff820d4dd7b", "comment": "Malware payload", "value": "5e9550d94a227afa855100d2312dc24c90b39e90a2def1238973d612c0bb8166", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363869, "uuid": "71d822ab-9d57-4229-a59f-dfeb5c242461", "comment": "Malware payload", "value": "7db96bdaeacc9a0e3b1437ce47b872174f8efc52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363869, "uuid": "7a25e992-80d6-488f-9013-bbed8f8987c5", "comment": "Malware payload", "value": "fffe7d08ed7fffc3775ae15827ed06e7f8124a91777d96ec66e9eab4606cdbd94f2c570071eda5ab1840d6f9d969d843", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363869, "uuid": "ac9b29d7-b850-4791-a559-d0d07936bfac", "value": "T1F402234AFBA1CE3FC89A53384C6742743270E8A5AF5243232104B5BD6D477D81F6EA9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363869, "uuid": "03b0f188-461a-403c-8f37-f427f13ef005", "value": "96:RFTzlnVB+BkHgBOVKtkE8ukBMRW8kZeiw70sPuBtbB1SiVFX:RFPwexV+9kBXayr/Si", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765363869, "uuid": "5c28d86c-5fac-4deb-8663-481932e1c3c9", "value": 8664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765363869, "uuid": "0e2fc303-1d90-441f-b37e-c4f8114ca942", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363869, "uuid": "f9403db9-7084-4614-8246-dc1d181f2d29", "value": "reverse.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63bf5b31-d5ef-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765388459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388459, "uuid": "ea5a5690-dfcb-45a7-9393-36d9dae0c683", "comment": "Malware payload", "value": "5906ddf2b3e94e7d634f16f908e19205", "object_relation": "md5", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388459, "uuid": "586d7581-3bd8-4a40-8372-6d91df27bc7a", "comment": "Malware payload", "value": "5f35bd0a7b7cbcb9dcb240d53793c6a6b48763eeafb4e16298fc0c74ca844ef2", "object_relation": "sha256", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388459, "uuid": "9f797396-6fad-4fd1-b190-9f6a377d0f2d", "comment": "Malware payload", "value": "3c9ede471f8e1d1fb6fe3b34d881b6d85983f43a", "object_relation": "sha1", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388459, "uuid": "bb3fcccc-5c16-494f-9959-111bc3daff6c", "comment": "Malware payload", "value": "360039d2d663ccec8dd2e08176c4bf5e195f665c03d52199d72d2a024b49b43e101ceeb529324ef321510f152425c488", "object_relation": "sha3-384", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388459, "uuid": "21b6352e-00c7-4f64-a701-2be564825bc7", "value": "T1C4F2F19165F0402BF5D6DD348BDCCD36904A06FEC8F8E01634BB4AF65D0AACF654BA89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388459, "uuid": "8b7b2cd6-8b63-4b57-a49b-c18cd5fab7de", "value": "384:5bnqdhroq2zuejz0uFZqh00XmfU+NJbJyfb38MLzH54dn+4Stlz82tk8G4aNmAJS:5Tohq0uFfgmpGfg2H2dnElSNmCkSEcPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765388459, "uuid": "b0e1a747-9670-4bd2-90b6-89d33ec02170", "value": 34604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765388459, "uuid": "bc4e0453-eb6b-49d0-88ec-9ae12196b9ad", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388459, "uuid": "572b2a3f-5daf-4737-b0db-faf52ac2480c", "value": "5f35bd0a7b7cbcb9dcb240d53793c6a6b48763eeafb4e16298fc0c74ca844ef2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267aba52-d598-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350990, "uuid": "09d76a41-5661-4a2c-8bbd-fec2ab06440d", "comment": "Malware payload (MaksRAT)", "value": "63bce09162593dc4249eb2947945e2da", "object_relation": "md5", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350990, "uuid": "5cbe9d36-9a6d-4675-b9c4-20b141d17749", "comment": "Malware payload (MaksRAT)", "value": "5f8e47d78796bcd3b0202f1641d22254413fa33d2e3dc1d6d164b6e33b756712", "object_relation": "sha256", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350990, "uuid": "c8b39905-e8b2-4e41-b260-58216978436e", "comment": "Malware payload (MaksRAT)", "value": "71f3774782bf8854ba60bc459f519e1bc8f1fece", "object_relation": "sha1", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350990, "uuid": "6831d440-ffd7-4bd8-b951-d5b783dd3bde", "comment": "Malware payload (MaksRAT)", "value": "1681b091087584e7ea7d42d6fee22e47b8c2480dd7d3ee10fea88180ee468e14cfcfd4d19a5673046a8e252ddb5efaab", "object_relation": "sha3-384", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350990, "uuid": "e3c4d7ba-49ac-4d84-b858-67a85d9b81e1", "value": "T1A3F2E13239458672F7D9D73080504F5B66BC237DB14B8A3FA624CAEA53E1861AD21F0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350990, "uuid": "aa81f3b3-f9e8-4e1f-a743-7903f9aee41e", "value": "768:UFMQIDWDgsPezC9xgDMxdVqdk37ITssHWVKbgO4zenAOuRnj7EUNCDlmJ:UFMWgmeyCDMxmdixVKac2nj7EUIDwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350990, "uuid": "91b780a8-5ea1-49c0-9903-d5400d28967d", "value": 35376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350990, "uuid": "d8b378d8-ba1f-4a64-af4c-1834584ccc6d", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350990, "uuid": "6c2272aa-2cb3-4e5d-816e-f5b927c6ff0e", "value": "5f8e47d78796bcd3b0202f1641d22254413fa33d2e3dc1d6d164b6e33b756712.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dafc1b7-d604-11f0-a129-42010a9c0007", "comment": "Malware payload (EternalRocks)", "timestamp": 1765397442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397442, "uuid": "fb03e5b8-4ef2-42ef-87a7-b020abbca1c0", "comment": "Malware payload (EternalRocks)", "value": "bb044fa7c38c6bc1c246026a8002516a", "object_relation": "md5", "Tag": [ { "name": "78-40-193-126", "colour": "#23F4EA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397442, "uuid": "220ead3c-5144-4038-9553-c14ecb3b95bc", "comment": "Malware payload (EternalRocks)", "value": "602194d715d24147d57cd58cdbd6e7fafce9ca198398f7c2e2e22f3a00216763", "object_relation": "sha256", "Tag": [ { "name": "78-40-193-126", "colour": "#23F4EA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397442, "uuid": "ed4ca0e5-3192-47e1-bab7-0076443bde59", "comment": "Malware payload (EternalRocks)", "value": "2be2002ca24fb9e215ec59a24c1862e1f61546b9", "object_relation": "sha1", "Tag": [ { "name": "78-40-193-126", "colour": "#23F4EA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397442, "uuid": "a1cee600-eaac-4006-88bf-46eba3620a7a", "comment": "Malware payload (EternalRocks)", "value": "74bc968d5851dec537cd81b451bf820c1880b93afd09e207970b30d0d40e38a6ff2a28db4dc6c4b3d5f4f3f5b7f952c4", "object_relation": "sha3-384", "Tag": [ { "name": "78-40-193-126", "colour": "#23F4EA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397442, "uuid": "46476a1e-7602-443f-8de0-cea29da9334a", "value": "T19777237E6A5CA4C1FF0785B2D2A7C50C4CE9295155939CAB7B30660B8C6F2C0EB3774A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397442, "uuid": "cba11865-b11d-4f80-82fc-09dbb293439b", "value": "786432:lc6z/chd7TOXNlwGn+pJCVGXPLoXhQOsYseq7Yo6j3Xr08cLF/:lc6oX7iXNl/yYXQ7Y6tFdLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397442, "uuid": "a37c7976-8aa7-45ea-9657-338d9b2557a8", "value": 35937761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397442, "uuid": "eba5fe8b-cf1d-4fb7-bd93-171b618364be", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397442, "uuid": "3eb62a8d-547b-448b-9e09-6b28f88ac676", "value": "(1) Free Download Files.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47fa74b7-d5a7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765357489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357489, "uuid": "c87e206c-170b-475f-b720-26477398abec", "comment": "Malware payload", "value": "6738d790fc0f3928a8a5f19d829cae4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357489, "uuid": "25de50a9-b3c4-4615-bbf4-13bd0dae2821", "comment": "Malware payload", "value": "60ca507ef4ba7dbbb7ef6ea4b975b9b09a24d7d0c91d38d0876331203f962d98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357489, "uuid": "675d124f-8433-4e0e-9908-d48e8ce12b43", "comment": "Malware payload", "value": "db0a727520178061506c7ec07a99bac581610329", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357489, "uuid": "d4400cc9-d38e-4ed1-a347-7c0dac756c25", "comment": "Malware payload", "value": "90fde89c8a62aaf7d5a95d9482d8604e98118d9b79974afcdccfba9941e1f7f43af9391cca7d06f79929d82b31f98e57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357489, "uuid": "e822b80d-b2a7-4e47-a835-0a15f4124143", "value": "T13C96338270D084FBDC2534F4855B163325A2DE2E9E40A96352F8F92D84F54A3DD2AE7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357489, "uuid": "d1c0dc35-4e72-49c4-bd81-da2e5b68426f", "value": "73386bf3d64aacc4f390f8277f3d3e96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357489, "uuid": "21ee8258-587a-4f9a-9097-1778a86392ce", "value": "196608:9O1vl2I4a7SdzRDymXLa4mnb0DtUog3jCUE2nKNfMILF9UBDHLSwxT1aQhS:Wt2O7Sd1ymX+4mnOU9+UCZM6kzWu12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765357489, "uuid": "e7905c85-4026-4c31-9954-193185e525b3", "value": 9458428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765357489, "uuid": "be453964-dc10-45b1-b5a7-50c02ea97995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357489, "uuid": "f07daaef-b698-4ba7-9268-c51f402ede38", "value": "2008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1026ed0f-d59a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765351812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351812, "uuid": "a5dd4b9f-9797-49c7-b6fa-a440fb0351bb", "comment": "Malware payload", "value": "c02bfd0e17cfcc2875481498d7ae8f52", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351812, "uuid": "2307ea7b-30db-403f-a4a0-6f5c33e66086", "comment": "Malware payload", "value": "623e49b54226dc5f4ee6b1a05894a2b707add5683ad950fb49cfc1fd4735575f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351812, "uuid": "c84e9adb-ee5b-4b16-81c7-a0279d49caf7", "comment": "Malware payload", "value": "9594420aa1c933bf15308888fcccfb2de4719bc4", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351812, "uuid": "bf44de2c-e817-49dd-971b-43dedd100680", "comment": "Malware payload", "value": "e3b7ab2579be39bf421eaf15f4faffa6850baf1f282ea09269fbb153a0a5fff787354a9b4ffc6c6c227625487b53a31c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351812, "uuid": "27bc283e-b042-4110-8c85-073558603909", "value": "T18732BC3A345A8D26DFB8907CD49D29A6B37DDC43190B3F9052EA195D20164A933FE2CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351812, "uuid": "cedec83b-9937-4c65-86fd-b8a3ca4782e4", "value": "192:SsBd+Td5OTlb5d/Te5DTYBFzWj/In4cd+Td5OTSb5d/Te5DTYBFzeR1COlkDxBG3:HBoB8hb5Na98nqjyfoB82b5Na98nyGy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765351812, "uuid": "d3e9482e-d20b-4228-9886-68dc88a7313f", "value": 11302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765351812, "uuid": "7c9a690a-6796-4fa0-ab28-99b4814d3531", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351812, "uuid": "3fda2edf-cfe6-44e0-bf4b-75efc4505563", "value": "nNew_PI_Payment_pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676cecee-d605-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765397914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397914, "uuid": "b91fdf9c-b66d-4ad0-b58a-417b130f8466", "comment": "Malware payload (Mirai)", "value": "1cf2bd0de4253a9e7bee2e99dcc0a1df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397914, "uuid": "20eeff2f-56a4-4b5e-bb88-5ccd94ce18ec", "comment": "Malware payload (Mirai)", "value": "627fd3dca685867a5c213225131ffe06ee2cfbb07adb305ca648fa994e8c9ebf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397914, "uuid": "821fb205-0e01-4684-8866-de6bfc5a9071", "comment": "Malware payload (Mirai)", "value": "65e83d0eae79abb0523cd8befb389ae9ce420f56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397914, "uuid": "442a8a7f-613b-4866-9581-81552d24bf5d", "comment": "Malware payload (Mirai)", "value": "44e69ba230f82f255284f73db5dd32be2a686df0130caca0fab45ba34d4333c57577c2cec1e955e59ca2602045d913d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397914, "uuid": "8a7b7d99-eec7-4c4a-8217-156d21af7531", "value": "T1A003E1A095B68A44F02E81BD53EF690D762060EE31589CFCDAA570F39511FB9833C3A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397914, "uuid": "e96bf30b-7b2d-4b72-9e94-2c4735f6da7d", "value": "768:Out792kzPRBNdl4wGEOxQp+JFLqHaEiYDsvNk+AggBnbcuyD7UtQRj4:Ou7nFj+JlqHa9YDAGMCnouy8tyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397914, "uuid": "863b64a8-0222-43d4-946a-5ffe9f3a46cd", "value": 40324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397914, "uuid": "d9e9855f-e16d-40b5-bec8-b4124086b017", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397914, "uuid": "c69b1fe4-4708-4140-8594-dd0a90779e7c", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f29aab0-d57a-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765338200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765338200, "uuid": "70e873ab-1cbf-4f39-b9ed-06f905d14077", "comment": "Malware payload (RemcosRAT)", "value": "c1e9592d23d5ff17a26ef804fa8fa7bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765338200, "uuid": "ee2e14c4-9f3b-4cde-bbb0-c7117da5c34d", "comment": "Malware payload (RemcosRAT)", "value": "62ea4446b44f3afbe6cc5dcf473d25527e03f7e31a14dc4078f0224fecabf0f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765338200, "uuid": "22bc6a4f-24a6-44a1-87a0-628a36f17b22", "comment": "Malware payload (RemcosRAT)", "value": "2940b55a0a5dd544a16f9749952114dcdc0a4c3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765338200, "uuid": "862f9990-023a-42c6-9c23-78c5ea06d0a9", "comment": "Malware payload (RemcosRAT)", "value": "2d5121990f97f5ff8781607f2815179c455f23a20379b2119f6ffa545c3d8f54ffad74bc4e22a434bcb940200a1b66ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765338200, "uuid": "fab6be9a-c2fb-406b-aa22-6b07b8f500b3", "value": "T15794D08DBE106CD9DC154031503795EA98F5E9EDC06B19EA72FBF13AD8321063A1DE2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765338200, "uuid": "8c3fac0b-b1d3-48fa-aed9-ea7c09101750", "value": "3f91aceea750f765ef2ba5d9988e6a00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765338200, "uuid": "6b62c75b-1c76-4056-b652-5416072c0f72", "value": "12288:5Rfu8gWXmW+qhk7KOOSW8T2T6hOC2FUrsIM253:rfu3Wfhk7KVStz33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765338200, "uuid": "fb4ec65d-52b1-4e80-a927-40900b70f0b1", "value": 443072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765338200, "uuid": "fbe65179-a22a-4300-bd45-d132a60d3a3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765338200, "uuid": "466b6a50-a207-4ae8-82dd-38a88a99c987", "value": "scan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58cb1eea-d5a7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765357517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357517, "uuid": "4e2212b8-2ed9-4af2-bcd8-6ebe12e2adee", "comment": "Malware payload", "value": "b88aa58cec2845002c3a8b0e75f5f1fb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357517, "uuid": "59db6437-168e-41ec-9652-b604c23ee6f5", "comment": "Malware payload", "value": "633c93ceea6fb2126ba62f0547f2b8b17188aaaedeea6f43cc0bbb522fe48c8c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357517, "uuid": "a386b8c2-cfd2-4b85-8d5e-1a06ff91e9cc", "comment": "Malware payload", "value": "df149d29de761f8cfb3ffae3328fc6e4c43ff4e0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357517, "uuid": "b2b235d3-eb8d-4836-b757-c6eaa57a5f23", "comment": "Malware payload", "value": "b4e5eaefc919d8888e097af1729da5ff9cb1e6290c1bbdcc962d262097318c199a5e4b0443c607682887119dca1c9a80", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357517, "uuid": "b963e108-654f-4114-b3d5-32e54ec7bf0a", "value": "T173073383EB06ED56FAF7C6319376025BA6264C584257E6435B84B42C1CB3ED08B96FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357517, "uuid": "9f5ddd21-3551-4484-856e-51f69deaea8e", "value": "393216:/FvXTTXyAPVd4ScdF6njhH2Vf8kpYClaTViul40ZMAFJbYpSB5kZrmIfV2WA:pXBP74PF6n47pYbZl7T2wB5fUV2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765357517, "uuid": "27a3f410-e772-420a-9fd8-35119f9192b9", "value": 17641130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765357517, "uuid": "188b0084-51c5-4332-a554-0df941ae793d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357517, "uuid": "3c4fc444-448d-41a2-8232-a8bcb59df236", "value": "atcfx_v1.3.6.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213c8a9f-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350122, "uuid": "d5bf0a1a-db01-4985-8608-97eef4260066", "comment": "Malware payload (MaksRAT)", "value": "1b24f5b5565d1e52b64f94ceafda9adb", "object_relation": "md5", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350122, "uuid": "6562a9b7-e927-4218-99ad-9ac23dd9f227", "comment": "Malware payload (MaksRAT)", "value": "63dad4c073d74a6304e7db7e44c7df8aa17afb7752989880573b3c6d61700960", "object_relation": "sha256", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350122, "uuid": "0ef0da0d-c718-44a1-88b9-1cad969a3195", "comment": "Malware payload (MaksRAT)", "value": "ad00849a63562db404d8c0276168b1c2974b0d12", "object_relation": "sha1", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350122, "uuid": "4497fe23-ce57-4544-87c0-9463e5dec1d8", "comment": "Malware payload (MaksRAT)", "value": "ce4f60bd43c029db616195bf9ae54c9c8d14a54c38000962ca4b6ded1640bbf0d415d8fd5eebed42527725ec4812631f", "object_relation": "sha3-384", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350122, "uuid": "395b9f80-02ed-492f-b60e-fc709535ece8", "value": "T1E092D01A3FDDF00BDC2F68B6C4457D69A2EA8970BC9F5707D3540CBE49B602B51122A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350122, "uuid": "bc45cd51-c568-4ad0-a152-e7a7b9378011", "value": "384:tpCXl9tuhK4db99D+AIw7qJub/r5efwHmM16DamzJ/x6JRNquqRRUxJh:olnu3B95zIw7qJuL9ef8hEi7NqRRU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350122, "uuid": "4b2fc8b6-ecc3-4d27-9a7a-cb5eb4ac5381", "value": 19849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350122, "uuid": "e5b51500-c295-4de4-b41e-3144bc2206e0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350122, "uuid": "a9c02ed8-608b-4e01-bdef-2cfa750fe75f", "value": "63dad4c073d74a6304e7db7e44c7df8aa17afb7752989880573b3c6d61700960.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c8f304-d563-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765328523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328523, "uuid": "d4d61c7f-3db8-4d0c-a631-7efd6ebcfe08", "comment": "Malware payload (Mirai)", "value": "f44b2955b921388f7896b92fdb91c700", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328523, "uuid": "1c864618-28d7-43ea-8cdb-e700c9362328", "comment": "Malware payload (Mirai)", "value": "64e3972234d9b7b0ed463da11209e7568cdc80f3610165f5523ac5efe1136ce0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328523, "uuid": "bb6224cb-0a44-45a2-b16d-5d6f6b9ce2db", "comment": "Malware payload (Mirai)", "value": "657008339b88c11079d33a849714a665090b1320", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328523, "uuid": "b939b98e-6d0a-45f6-969d-79715277d63c", "comment": "Malware payload (Mirai)", "value": "1596e620eec6c15a4ceda37a43cd5c7b1cd16167f6d70af84b549901fe83b200527d9778ed6a97b8db5e90970daa2629", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328523, "uuid": "b082cc08-ade5-4382-bb71-b8333a486117", "value": "T1AB04B50E6E198F7CF79987345BB79E31925833872AE1C582E1ACD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328523, "uuid": "a27dddd1-a76e-41a2-8c77-6d12e5c4f48f", "value": "3072:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/QBrj4jTv3TcJ2tD2a:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765328523, "uuid": "d26a72c5-87f0-4c0d-9b21-20215942406e", "value": 175820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765328523, "uuid": "d2af35b1-bffc-45fc-bb33-218bd71bdd8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328523, "uuid": "28b80467-8fe6-42c8-be6a-cc41e7a7beef", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c27dee3-d58e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765346893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765346893, "uuid": "3f79793d-cbae-45dc-bff5-c93189ce96cb", "comment": "Malware payload (Mirai)", "value": "6efb72265b75e98b396f9fb49689905f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765346893, "uuid": "68264a12-44fe-46a9-b102-73daedf997ce", "comment": "Malware payload (Mirai)", "value": "65634147dc63e5daf3cc106a8a843f2afee4ad623aa4b27a89fa3ef7b9dd621e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765346893, "uuid": "964d094c-139a-4e9f-8c4b-5abbfe734b3f", "comment": "Malware payload (Mirai)", "value": "86a7518a274ecb27ef2813e7a7ddef7d888a9a8b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765346893, "uuid": "60139899-4cd2-40a2-9165-ae039805328b", "comment": "Malware payload (Mirai)", "value": "00ca3077a85d01bdda8fa2f7470a3648d694adcd37884482a06289185f9fc3501486d57a31e5b1fc0e2a67b76b845099", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765346893, "uuid": "110aeda5-0ed4-43fd-97ff-6e5738fab21c", "value": "T1AA71C4CF029537389C6A4FAA36776098F098B0D186CB9E4DF79F26AD404DECC61015FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765346893, "uuid": "b36c58e2-fd84-42a6-9b00-6b1db82d7724", "value": "96:YShtSFESE6voDSzXgbSSMiHQrSqQl3a9S2Ut2JS3zsfGSl5OZISmk9mVLS5F6d8m:phtSFdE6voWzXgbPMiHQOqQJaM2Ut2Q0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765346893, "uuid": "e62c4818-2f7a-4aa7-bc70-b11953bcd2d2", "value": 3647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765346893, "uuid": "af3155ae-641f-478e-9270-b30c30ed2d59", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765346893, "uuid": "288c32bb-10d5-4d45-bc2c-57a6bf2895a6", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3abee3ac-d56e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765332985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332985, "uuid": "9ac260a4-3f5c-460e-afd0-81c6fb1909fa", "comment": "Malware payload (Mirai)", "value": "0581641bf143d6bdedbc7d55b256f9b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332985, "uuid": "cb75c5f5-c17f-4035-97bf-b8d494903562", "comment": "Malware payload (Mirai)", "value": "666f79067a139cb03fa80e5fd8732ade3311eadb6e9bd0ce043ca1f4c1a67831", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332985, "uuid": "d3f8d0a0-99a9-48fb-a974-4927b518ff0a", "comment": "Malware payload (Mirai)", "value": "79f0d0fe879595e70543355dc3e6dd356160991a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332985, "uuid": "4909c959-d35c-4639-ad3e-2fe7354505e6", "comment": "Malware payload (Mirai)", "value": "423d19ea5e07a0254b99aa6419107655b5abd6197623141ba0ebd4f25afd75b1d62e0997a9369ae1119b04d592962b02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765332985, "uuid": "bd06a836-bc29-43e2-9069-4711ab9311e9", "value": "T10FB35AA3CC6A6F58C664E1B4B0B18FB95F939950818B1FAE5577C2788083DCDF5423B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765332985, "uuid": "7aba2f4f-f49a-45be-bb3f-f82b2a9fac52", "value": "1536:wOF473Ez8Cb2RKH5YfS7Wd7hU1eAhULdFCVWRqqkEmO6hfE:wOvz8H4HpH4AeUVWR/cOWfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765332985, "uuid": "3dbd5c65-7ed3-4c00-83a5-905662811e6c", "value": 117540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765332985, "uuid": "3db833e4-4624-4079-8e3e-fc177609a01a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765332985, "uuid": "cfb45a7d-01d5-476f-8828-c9d9930a9189", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a2480aa-d5c7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765371344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371344, "uuid": "5b3f8ab6-707a-415d-849c-6159e856760e", "comment": "Malware payload (Mirai)", "value": "e1efeb1ed245b2ea7a8cd99bd8966779", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371344, "uuid": "daee312e-a3b9-46f7-9733-ef5e758d8b94", "comment": "Malware payload (Mirai)", "value": "66923770ca13fe676287aabe7167c065eccef8d990903a2512fea3d693455402", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371344, "uuid": "6f9ea928-3deb-47e5-8769-c62a0f9b1e74", "comment": "Malware payload (Mirai)", "value": "73838aaf647d0eef527b2e0c1a0e40dac814eb5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371344, "uuid": "24d7dd32-76b2-451e-a362-e6153d30f64b", "comment": "Malware payload (Mirai)", "value": "09a5ec633dacf6786c6bb3a09c61b702f78cc4660de1f5aa8cf1685fab124662a14c98fb1474b8b4b9139c0ed5a620e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371344, "uuid": "f9531198-46e5-4065-909b-bc507380861f", "value": "T142349D72E8766D98C514A278B5F4CF3A5B13B440015B6EF669E7CB34108BE8EF118BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371344, "uuid": "68272219-8b6e-4719-9c88-b8f845b47f26", "value": "6144:Sy7cNYFdLvtiPOdlsfXNWV4Svf+SsVuPP5:SgxLViUV4SnvsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765371344, "uuid": "9f0e8cc9-58d8-4225-a371-7802de7a3e67", "value": 238440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765371344, "uuid": "3e53cade-26ef-4a83-8ef3-cacc6d8193da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371344, "uuid": "5964870d-d8fd-432c-b01c-c5940eb195ae", "value": "ecco.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e54818e-d5c3-11f0-a129-42010a9c0007", "comment": "Malware payload (BlankGrabber)", "timestamp": 1765369579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765369579, "uuid": "baaf5492-b712-4b27-b612-d848f81fc8e8", "comment": "Malware payload (BlankGrabber)", "value": "4e9131c8ae4ae8da5af15fcb190eaa7f", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765369579, "uuid": "b56b5722-0f3d-438f-bfa5-da43ed4a44ad", "comment": "Malware payload (BlankGrabber)", "value": "669a1bace11b71fe0e25eedf67346e283bd4f06b1a901dea1b18716afbb4ff50", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765369579, "uuid": "3f21cb22-42de-4fa3-8c15-15f09f38c701", "comment": "Malware payload (BlankGrabber)", "value": "59654109e146b733db11b95ab12582066dc22970", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765369579, "uuid": "f86c9be9-70e6-4f60-b76d-94e3b0bf063e", "comment": "Malware payload (BlankGrabber)", "value": "ade60a09282d653703aa9f890418e74df9b6904875c885e2171280b7457f8c6389b7337bc3dd9660e633b0229b06c8ce", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765369579, "uuid": "3c6e35ca-fbec-4953-b1e8-b535b2c96951", "value": "T1070833A280E10856E0B2D47AA5A3CD79DE529C964759C7F7CBCD97823E331C2A43DBC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765369579, "uuid": "ec390b7f-537b-4d0b-8fa7-3fb8e2a25fa7", "value": "72c4e339b7af8ab1ed2eb3821c98713a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765369579, "uuid": "73333f42-31bd-405f-8fa3-2edb6cebb611", "value": "1572864:CjqEL/s/8+VPyAiF5R7mP9daWnp+AJvZlxq7OW7/Eoc2PyW+eb:Ip/s/fV0lm/lIAJvZlk7p/nhPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765369579, "uuid": "6bc312a7-758a-4028-a77e-559b1116f408", "value": 78805344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765369579, "uuid": "76bab70a-0202-4438-b9c9-7c0b5a99c208", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765369579, "uuid": "9c9e91bb-1ec2-4964-8f4b-36b8d4af9a09", "value": "283.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd186b59-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350437, "uuid": "d79c3032-fdb5-47d9-b7fb-3f324f449059", "comment": "Malware payload (MaksRAT)", "value": "5e4d374814d16c5e52965766cfb46d66", "object_relation": "md5", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350437, "uuid": "d2cdc13e-f58c-4478-bba8-a81e721af663", "comment": "Malware payload (MaksRAT)", "value": "68b2486cfe44d5c206b6df191b07b947576b9a9a92ea87cf87a1e58f6a0757a8", "object_relation": "sha256", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350437, "uuid": "fcaf78e6-7903-4516-91cf-eec2f7c188f1", "comment": "Malware payload (MaksRAT)", "value": "8540b00bdd40618a2fb41b09ecfde93ce741628e", "object_relation": "sha1", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350437, "uuid": "a6cae53a-b34b-41e3-aa1d-5c867aa5e19f", "comment": "Malware payload (MaksRAT)", "value": "f7252d10fa017743a2d3f217e1a3d72644b2a5b0a74b4a6566d0a794ea20791f239141ae3c0657fcb3c2b21740215eda", "object_relation": "sha3-384", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350437, "uuid": "86869714-770f-40fe-b991-f57228cc12c8", "value": "T104E2F293B86C9177F79380FEE17652C2950DD541F9B5E20323B2B4D07C28BE497826DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350437, "uuid": "0818cc63-b6c8-4ec1-ae7b-2b1685e1881c", "value": "768:Imb4tL79aCvK1DDpPascEJO/8q0TqbKYlkQQg3g5QXj:XbMfUCviQc8/8q0ObHPQg3g5QT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350437, "uuid": "f3876564-c5c0-49dc-a72c-1ad9fe48a0aa", "value": 31846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350437, "uuid": "8b329cad-130a-4388-88c9-b5c47bce1826", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350437, "uuid": "32f9194a-6f00-4514-b518-4dbcf552fe51", "value": "68b2486cfe44d5c206b6df191b07b947576b9a9a92ea87cf87a1e58f6a0757a8.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be49d78-d5b7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765364448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364448, "uuid": "d221ef30-67c6-4819-a738-84e463ce5306", "comment": "Malware payload (Mirai)", "value": "80d3fd175a979c10fb6e359ccf399652", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364448, "uuid": "02c54ef0-c017-4335-bb2c-5a63e37644b1", "comment": "Malware payload (Mirai)", "value": "68e5952dc56e1479c2b0dc59f094505a066895c683bb9a563e140e00e525623f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364448, "uuid": "503297a9-39c2-4aa1-a2a0-c34d7917a6c2", "comment": "Malware payload (Mirai)", "value": "340c6a30fa58861b29d8dd49984953c570bb6ffd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364448, "uuid": "75ac5165-f5b2-4f88-982f-fee5b63f18f1", "comment": "Malware payload (Mirai)", "value": "a3c6fc30018915bde8b9693a646a581dbc558b9e01943f889e532c4cbc3640df7e55023b17146941dd4d0a990a9f2c2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364448, "uuid": "d8044e9c-c4a7-4900-9ef5-ff8eef0b05a8", "value": "T1BBB3121EA73761E3C429043A7575994A4984A339F6FBED322308E9BD6D9302B0CDF58D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364448, "uuid": "9c839334-cb6c-4185-9fab-5ead574b7813", "value": "3072:RyoauFVH1Ql7QB5/ths4suigLELJJhGnq8jQd:R77VCVM/ns4Zi1LJJh0q8jw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765364448, "uuid": "97cb0987-6e88-4d38-b0b3-8c7dbc79f114", "value": 116132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765364448, "uuid": "53620286-5054-4858-b799-fb553ff291e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364448, "uuid": "6ad9f9d0-ab0b-499e-95a7-765016fedf27", "value": "ecco.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d1ac0d-d5d4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765377084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765377084, "uuid": "c699d9c3-3958-478a-9b94-cf9659135738", "comment": "Malware payload", "value": "6b8fa29aba14b1ea79a4ae3b18f39a28", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765377084, "uuid": "6b6a6e23-30f6-43d5-9781-1864b0e8c95d", "comment": "Malware payload", "value": "68f788cb6e558945fa7428a927a8368c72632860ddfc6ee882d2e30295ff4fd4", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765377084, "uuid": "ba719c37-a1ef-4ab0-adf2-2431126f75c6", "comment": "Malware payload", "value": "bcdce6a55cd1eda447b60fac4c225c794fa77f8b", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765377084, "uuid": "b4c848f3-e68c-41d7-a546-91169add5b93", "comment": "Malware payload", "value": "8511b0b1501e0d2a10c3b5721523dc733f8b250cfed28aff6c2629b69388270252c375acf835c2cec6fe456aecac5a06", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765377084, "uuid": "61423b01-9162-411c-a01e-cbf81e3effa3", "value": "T1FEC79D0663E112AAD577D1388AAB5503EBB3B8071730C7EB329C43652F63AE45D7B760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765377084, "uuid": "5f37aa18-4a3c-4250-b202-eb69490b56f1", "value": "ba2b77232a86e1c66db59ece24dedaf5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765377084, "uuid": "c235514d-d67b-498d-836c-a3c9ad6cf052", "value": "393216:+i8g9R/puPnhIoHmDSky10IbQrBA0P6y3ynlKqMCFcgoZ1bbpYnjTduVgyCmesjA:+kO4ylOFghs6ya/xO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765377084, "uuid": "e3af4a7d-ea0d-4399-abec-ffbbc8ebadfe", "value": 53208064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765377084, "uuid": "112ab768-5232-4d15-a606-a1c3ab61d0ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765377084, "uuid": "c37b3e66-02cf-41db-970d-1336178a2de0", "value": "DungeonWarriorDemo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ec7342-d600-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765395627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395627, "uuid": "71a4f8c4-3f2a-48c2-9aeb-3cfe5449faee", "comment": "Malware payload", "value": "2180a7285fed7e507452f7389bd13f9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395627, "uuid": "26e66f43-dced-4a42-a3a7-db2685203383", "comment": "Malware payload", "value": "691db97b59aac692fb1c655e565926d8e3b289cd7e744f043fcbc62e886074fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395627, "uuid": "6c240e31-0d16-4541-b65b-c361c97d665f", "comment": "Malware payload", "value": "839ff76d86e139dc059be97bf71a00767e8c44ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395627, "uuid": "f470b1ab-2a0d-4301-bba3-8fafc4b0c9c0", "comment": "Malware payload", "value": "4ace2e2da43d33edcc4c95c1cff742582c09e8e5ddc4f9d43faa01a677342001723c4f711e63c17c8f3fc83861d2b7a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395627, "uuid": "22ff6e44-37f3-4fd4-8644-b23745b4fb1f", "value": "T14ED41963F46892F6C7B86132F147E63F2A0BDE6166018541B3F13F9E3AB6A651710B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395627, "uuid": "e13e2fdd-fe4f-4ec2-9481-8f08bfe4c771", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395627, "uuid": "65bed44f-20b6-43c0-b5ac-678eb9e0e5e0", "value": "3072:WEre7GjyCaFvc2a/GFGtmDggggquWbPvZmggg7gfg8Zyac+VvE9hVPqB:WPXBMdGABhVCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765395627, "uuid": "1a0155c1-a30f-472d-8746-171131ac682a", "value": 607752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765395627, "uuid": "78f366bf-8eec-4104-8ce8-cb25f738e6c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395627, "uuid": "9a1d1934-5a8b-4c92-b11c-a35d306521fd", "value": "0uw27eixo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4670048f-d5b8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765364788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364788, "uuid": "ed56ed5d-29f4-4700-b7b2-6b72a1adb880", "comment": "Malware payload", "value": "2d0c12281a709108a4628eedc9cafe2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364788, "uuid": "9ca53da6-24e2-402c-9110-a30947ea3d95", "comment": "Malware payload", "value": "691e5a9524f2de8281f42f8508a344a0305fd59a5370ed7fb92f9bb1d97d7d3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364788, "uuid": "8f960fe3-71ce-4eaa-ad5b-1b1fcd7e9acf", "comment": "Malware payload", "value": "7e2a13aa2fcbd9f0c0a9dfc6f9ad4502a9054abf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364788, "uuid": "b2503dc7-1eed-449b-ae9b-f2efcdb3f07d", "comment": "Malware payload", "value": "171a640cdaa9a40af0ecc96485bfe22f5cd536729bc524e984674b56de4815f82d88ff6ba410461475207e2f30469801", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364788, "uuid": "d069e844-284d-41d1-9e37-4320fa57c11f", "value": "T1DE0833C96B51088EEDA4533A4352ED18AED5F08E87ED4447A7F828672D8F3C8CB7D644", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364788, "uuid": "8d45a14f-8c20-4fba-a0b0-3546866891ef", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364788, "uuid": "5e79c27a-d781-41fc-a144-7dbd18350a3c", "value": "1572864:ekEWAzWrAUb9jETHPQmMpnx9luHY7otnq/2cpiI27oeTZHhmqZAD2Ql:ekEWSsnjcvPOn36utLeTLpiDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765364788, "uuid": "532cd5cd-5b40-4597-9bc1-b24c02982c56", "value": 77903594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765364788, "uuid": "445bc1de-4979-4a9b-96da-697f031afdd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364788, "uuid": "1d660446-5fe0-449a-9288-b6f07d52a311", "value": "taskhostw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e504a44-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1765345151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345151, "uuid": "99375f96-18e0-4770-bd38-789900a38bba", "comment": "Malware payload (VIPKeylogger)", "value": "4378313c83cf6c0d50c5a2cfaf6df1d9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345151, "uuid": "9cb89b24-84c3-4447-a433-a84ee6467630", "comment": "Malware payload (VIPKeylogger)", "value": "69b76c85d11260dbfd82fe4380fe8918c34a5d3258560d769038ecc92d86b8fc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345151, "uuid": "3aad6fd9-f3da-430f-a183-61926c2355ee", "comment": "Malware payload (VIPKeylogger)", "value": "d40c17c65cae5ff603a80634e43607bc2befd1b4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345151, "uuid": "02e001ad-af8c-4f7b-9064-d1d6b545f5da", "comment": "Malware payload (VIPKeylogger)", "value": "3b3c24f77629044942d562310bb64db13fbcd3f021e0a055cf00092d9fe955f967834368dde637ce58239f72bb17357a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345151, "uuid": "63eaad16-7009-4a94-9df1-f32a83ae6c46", "value": "T1CAE371412BC9B4D0138B1B77772FF4E5ED6F89AC3449059BC61ABCA065B070BE6E1932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345151, "uuid": "cac5f292-24ce-4b35-bf7c-ebff26bfed61", "value": "1536:4s+ak21ijTEZPacKxm99oCCu14OF71AN+VMcwaLvdus6f+X/lFTcj9XUoT2WC/TK:0ak2boChzYaMcwNf+X2U62J83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345151, "uuid": "7b129a17-dc92-4066-9825-4672886ed35b", "value": 153693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345151, "uuid": "7e525106-9e4c-43b3-b083-35f5e162680d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345151, "uuid": "cd43c14b-4650-4041-a22b-884ba244a50d", "value": "NEW POT0653.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31bd92b-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765345186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345186, "uuid": "87e82b1e-5825-4301-943a-559152fcd453", "comment": "Malware payload (RemcosRAT)", "value": "cb51ab977cbccfce16aaa5bfac5fc814", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345186, "uuid": "9265564c-b95f-4f28-9ac8-1df9b2d2c4e6", "comment": "Malware payload (RemcosRAT)", "value": "69bb0675e3592c5031bfff362a4c7dd39a413ce6035bbf1117ce2d1e65ba48ad", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345186, "uuid": "32bd8df6-b875-4fbc-b207-50d2b90bb932", "comment": "Malware payload (RemcosRAT)", "value": "0f964d1bf6bf53dceefb25d2501c1dc781a7b621", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345186, "uuid": "9addda1a-bb26-44c3-b5a9-8f0dc152a661", "comment": "Malware payload (RemcosRAT)", "value": "f17ca8fe387a524651f740d034fcf6da23fe5df2d30d42bb5da2d071f81c18f85692f65b164cd138ae356cd181371c6a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345186, "uuid": "c722ed78-fe7f-4253-902a-50b876a4e672", "value": "T100D44A20DD3416B94F071BA9FD540E61CAFC960A552A90F1F6DE070E61069FCE3FE6A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345186, "uuid": "e60aa123-dcb8-408c-98c6-8b91d96251a7", "value": "12288:sKOKUKlJYXKlJ+KlJg+IEKlJg+hKlJg+IOKlJg+I1KVKlJg+IzKlJYKlJg+IfKl0:sKOKUKleXKlQKlxIEKlxhKlxIOKlxI18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345186, "uuid": "49fa53ef-804a-45cc-afa1-067037bd386f", "value": 598396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345186, "uuid": "bba96d5b-855e-43ba-9a5e-a91e3101a50e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345186, "uuid": "d4296af4-43b7-4ce9-be27-58b8765765e1", "value": "Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54449e4-d593-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765349109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765349109, "uuid": "639705e6-890e-4af1-a0ee-4fe85c2b94c1", "comment": "Malware payload (RemcosRAT)", "value": "a6ba515de2541be9cb77f4e61916ec3e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765349109, "uuid": "34606286-e3fb-4d0f-aea6-ed7dc723e902", "comment": "Malware payload (RemcosRAT)", "value": "69db3f623fe1895461959fa4396e096c0892ff0fada1783a96274dc9bd0a8305", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765349109, "uuid": "446cfc0d-457d-4bde-9508-c393bbafeee4", "comment": "Malware payload (RemcosRAT)", "value": "4f4a0c3560418b9a8c06462b0024c293f6d0f500", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765349109, "uuid": "da24703e-094b-479f-8914-ed41a5e9fc59", "comment": "Malware payload (RemcosRAT)", "value": "edc5a4770001cb4f124f47a19d9ff4add221d1767993841816e256f77bc0a0dba15c09c484c35e5ce1f081f71e9fb57d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765349109, "uuid": "da636ea9-7d1f-4141-a2e5-96916db44a63", "value": "T1954680502AA8016AD5F5EDAEFD2C5A509E4D3F7712864D2F303E649F3B6F148B131E28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765349109, "uuid": "1c7a8be6-91d3-4d8f-bf32-e296145756cc", "value": "98304:iqu7NpE5J/anYReYTALEoD55hLUeUa8EfCaNT790:jYMJ/9sEoD5fAeUa8EfFH90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765349109, "uuid": "034b9bdd-22da-4f39-910e-04a2e72a04f4", "value": 5622250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765349109, "uuid": "6ec9cb87-51df-4984-b0a4-3b72a52bd038", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765349109, "uuid": "4c5d73a3-3dda-42e9-b596-22997a2a6713", "value": "donotopen.JS_orig", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f4bc96-d5b6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765364003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364003, "uuid": "cbb5ab71-a150-4bbb-8374-2960e4382e81", "comment": "Malware payload", "value": "491518101c265a7a79040ea148bc7ae7", "object_relation": "md5", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "ShadyPanda", "colour": "#D1067D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364003, "uuid": "9b3fb040-0b80-4777-a2d8-fba24b831cb8", "comment": "Malware payload", "value": "6aab340b1e06e2d2f3f591183a6669b70c5a6e5934c40f33f804f9b89b2b5452", "object_relation": "sha256", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "ShadyPanda", "colour": "#D1067D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364003, "uuid": "24aeeb07-93a5-42a2-b09c-78382177d4b7", "comment": "Malware payload", "value": "3afe42b9f0a33dd4b0d150edb1aa809901507d6f", "object_relation": "sha1", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "ShadyPanda", "colour": "#D1067D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364003, "uuid": "0068c072-0896-4e4c-8000-15c69bdfccce", "comment": "Malware payload", "value": "7984cea73414a6f30c5d022a2ed4690433d71aee864d42e83acb6e1b2ae415e33756d8fa9162d69d9401862756643f45", "object_relation": "sha3-384", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "ShadyPanda", "colour": "#D1067D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364003, "uuid": "fdbcd22b-4628-428e-974c-72d49413a21c", "value": "T16664023879BED332E64FF0308DC9F29687A94B4E160A6D2F3545636D3934B488712ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364003, "uuid": "dd55547f-88dc-47ab-9e6c-cfa308a0ab61", "value": "6144:UAm+y+qE9fec1AwFsTvXOGHWaJny3MaBd2Bno2DGHVQjFI1eIP/Cu:Uvp+zfecnsTv+vao1BdiomG1Qoeru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765364003, "uuid": "f4a5f003-34a8-4816-aac5-75afba9841d4", "value": 330978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765364003, "uuid": "1d8847a3-2b9b-4453-a74e-600b4282ec04", "value": "application/x-chrome-extension", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364003, "uuid": "51374b8e-3242-4950-896f-df06d9095496", "value": "ibiejjpajlfljcgjndbonclhcbdcamai.crx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b08d065-d5b0-11f0-a129-42010a9c0007", "comment": "Malware payload (MetaStealer)", "timestamp": 1765361252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765361252, "uuid": "f5795cf4-4ce3-4623-8a48-ac457facd21e", "comment": "Malware payload (MetaStealer)", "value": "5eeef6c263421f46574fcbebcc62f14e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765361252, "uuid": "5e66c7c5-07b0-44f1-bd25-18719027a805", "comment": "Malware payload (MetaStealer)", "value": "6c5f08e03aea51ddbab740787ca3a28fd4569eca81f973ce67e38b95a6f2b9f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765361252, "uuid": "451f47e0-1763-4e62-9903-282673e33ed3", "comment": "Malware payload (MetaStealer)", "value": "122342b51a1f47ef12f500c9bf3134ae628d4689", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765361252, "uuid": "3abb76e5-6f59-4e54-b905-7b6885f86367", "comment": "Malware payload (MetaStealer)", "value": "0283629dd9a82af6eceb91be9226c508747b498cbf1e5331e863b54eb46d98eb16718c03e7f2451dd387b69fbdff7d39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765361252, "uuid": "8eab71e0-9316-4152-9b72-cf72660c9c50", "value": "T1DA758E39F74E98B5DB0353B1998FED779B08E6298030DB7BBF5FC64CA8270026869154", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765361252, "uuid": "b32a5448-46a5-410e-a879-32f3dd1fc90a", "value": "389452d990d81bb5b1ce505aa86c1d78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765361252, "uuid": "a88ec7e8-94e2-48b0-965a-b5b33cdd9c94", "value": "24576:+TAjTzKSXSir69lImVwR7Hu1KwZQLvvJtdUh0j9CRWWL:+WSSaQHBvveh0QHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765361252, "uuid": "e5d0b66f-79f3-4cf4-abec-b81cd3f7b538", "value": 1570304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765361252, "uuid": "60ba2170-8fe0-492c-b26b-9461893fe141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765361252, "uuid": "78f098b1-62a3-46e2-ab86-c5e2691de641", "value": "oc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d5ffd0-d5ee-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765387899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387899, "uuid": "4999e936-d01b-47af-850d-d0e03e1f4f4a", "comment": "Malware payload (Mirai)", "value": "29f80160e6f2f3a94ad1852b4000355f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387899, "uuid": "40c2ceb9-5316-4c6c-a538-e9870353558e", "comment": "Malware payload (Mirai)", "value": "6c7076e952acedc161b1974c697d0e0f2332726bf07930608d0feabe5b675f48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387899, "uuid": "87b284ac-bd66-4490-b881-e7204c1c62a6", "comment": "Malware payload (Mirai)", "value": "2daa8116e12a2d22ec544e6ba8e735e9b1f6f53b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387899, "uuid": "f8dbe16a-0c3d-4917-accb-d3850e6a7fbe", "comment": "Malware payload (Mirai)", "value": "cacfaa79e470a64dcc50441e367ab8c4b80ec5d32c8f2596635e4f0bfb2f85139b6dacc8ac5cb6226802130ceeb900c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387899, "uuid": "97999c9a-88be-48c7-8dca-47154769b575", "value": "T17FA35CC9E783DCF1F96A05B02137E7379B32FD3A4019EA86C755AD36AC61201E61A35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387899, "uuid": "96159920-741f-49a0-8ae2-a5be5ee4c1a4", "value": "3072:NMBOHNniJPs/igpW2X4Oi/4/7vfV2HC3Sz:WBOtniFPiEOFHyC3Sz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765387899, "uuid": "e2801bf4-c476-4565-8aa8-248725c9c752", "value": 99932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765387899, "uuid": "2363a47a-9872-4d56-925f-b52a7f78186e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387899, "uuid": "78d53373-817e-46c3-a607-5fe80d395fef", "value": "x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f61923-d58d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765346231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765346231, "uuid": "912693af-8be6-4e62-a42b-254e42117b83", "comment": "Malware payload (Mirai)", "value": "6358ca189b6b079c2402478726ee7d66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765346231, "uuid": "57afd5ac-e997-4fdc-bcba-54b002dcc7da", "comment": "Malware payload (Mirai)", "value": "6cf5013c6cdbd9aa80c9d2a74f535415e77dea50273c1edeef71164323b98f16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765346231, "uuid": "b0207250-cecb-44d3-aec8-d9870587a2fc", "comment": "Malware payload (Mirai)", "value": "625a47c00cf878d8312f17d41a7cd008df89ab6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765346231, "uuid": "ff142da3-50f8-4a80-a8c8-a6e1f68d81fa", "comment": "Malware payload (Mirai)", "value": "909cdfc00576b7b96a6a31d26a5c1613a5e9c4be1effc1c67ccbf2d9f7c168c1a66247e3bbcc0b2bbc4f0fe2305638d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765346231, "uuid": "9caa5116-e466-4bb4-ac3f-f19f095efa9f", "value": "T1D5A2D028E6454FD2FFEA4DB118D4D5917A700B57B352CA43B2C48A219B3361A3E1F9D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765346231, "uuid": "02c10f2b-742e-4a07-aa78-ecbde0186ede", "value": "384:qVxI2IAvpQ7FRAFPhPYv6MsL6xnzKKu0jVMOFyCpeVf3hYzvNaSyk3ayy0M4uVci:KsAvpoAzYSMvxuKu0jVRNufxWaRrL4uN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765346231, "uuid": "eb56dc6a-f914-43b2-92d9-7b3085109c54", "value": 21604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765346231, "uuid": "43b9fc95-7f47-4815-b17c-2a67b789441f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765346231, "uuid": "5ca2ae82-a72d-4eb4-a96d-5fa4638a6014", "value": ".SppcUNO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46374352-d5cc-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765373377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765373377, "uuid": "36b5de91-9c9d-434b-966f-7ed00e96b849", "comment": "Malware payload (RustyStealer)", "value": "3e79d146966e53f5b30376831d6a43d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lamia", "colour": "#C00104", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765373377, "uuid": "b452c989-d756-4b73-aa94-d5f6e87dda13", "comment": "Malware payload (RustyStealer)", "value": "6d189ef2bdcd62b389018913bd971f4c8e47a8349fa9101935dfebfcb69a5e06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lamia", "colour": "#C00104", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765373377, "uuid": "e75c93dd-081f-423a-9f22-91010f57d12f", "comment": "Malware payload (RustyStealer)", "value": "dd82f8cf35eeb2ab3619f735d77e9b255bbb5c28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lamia", "colour": "#C00104", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765373377, "uuid": "00826ddc-80e6-46f6-b8ad-d93edeaf59f8", "comment": "Malware payload (RustyStealer)", "value": "f7d38cfc48c54c4e7b766a0a6c72237369bf6179779bafe3234d5decd814469ec11a25a0bc6891738c1f1e51f460f182", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lamia", "colour": "#C00104", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765373377, "uuid": "0d0fb52b-2e53-4dc6-ba71-dafbc495709a", "value": "T1DA960103B6A885E9C55EC07883578376BA73B88A0630BABF17D85B302F5AF515F0D719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765373377, "uuid": "1c4eb392-85f3-4922-ad15-b419b050ff4d", "value": "8a353335b38c07a9d08ab9dd98dc027b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765373377, "uuid": "3e11cc74-7449-4835-bf30-2492cab73cdf", "value": "196608:MmaXmZOoIgPMYtbVWFwOdpCQopmrUza+u1R4+7A:MmaXm7ISMaIdog+a+u1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765373377, "uuid": "efa20178-2236-455a-a7a2-6bf01d9c40ce", "value": 8854016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765373377, "uuid": "2b51622d-ea49-4649-be22-dbd917842a40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765373377, "uuid": "bb636d80-7947-41e1-95bb-bf42cde7a2d6", "value": "HardwareSurveyInstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a673da-d618-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765405994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765405994, "uuid": "b76b5ef9-4c1f-45be-9d3d-3da56fe73fac", "comment": "Malware payload", "value": "e4abcf93beab2a25baa6f0dd37170539", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765405994, "uuid": "a36263ac-17bc-4ef4-b4a6-e28094ebf7ae", "comment": "Malware payload", "value": "6d4a451ce38cb6fa44ef47965fe586749c0a51771fa965f040a1a9c3ac3946cd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765405994, "uuid": "b3538560-f57e-457e-8ff4-de7830fb313b", "comment": "Malware payload", "value": "006b64c04e15c61693ec7ca60c75057c894d7ee8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765405994, "uuid": "7bda3517-6123-47c8-8724-8783db733b2a", "comment": "Malware payload", "value": "c6a1f37135c3b499933b0dacb319e0a3a76056d51a30a8ce86011965e22b5a9e71f510712ff47d16f3011d8f10f6ab2d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765405994, "uuid": "2939aa95-2ce6-430f-980b-f8b141349c0f", "value": "T17D76233A17DA614DC09AD999CC41BF93626B36074A2344E1F24820DBEE7D0B847F56EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765405994, "uuid": "399e0fa5-cd3e-412a-aadc-2edc4b1e0d10", "value": "768:1DYnnXYtSpCQjp6EYD9l1xhQYltkFpEQFzN3BzQaYX2owbhQYDh86nq4qlz+SXQL:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765405994, "uuid": "337bc0d0-f876-47cf-9668-d91a95026cc5", "value": 7141961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765405994, "uuid": "5124d788-56d3-4f69-b520-8bcc28b101f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765405994, "uuid": "1970d1ac-0b2a-4751-a055-d2c879c61974", "value": "PO_MOG2025 Liposomal.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc3ef02-d5b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765363723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363723, "uuid": "8e85f456-7ed6-442a-a804-34f989469f21", "comment": "Malware payload (Mirai)", "value": "2e613a029c739a9e582a0e235bb022e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363723, "uuid": "43e1afe3-1727-4407-99f9-0f42c1da7000", "comment": "Malware payload (Mirai)", "value": "6e378cb43fd51ab19e02bef1dfc9d1257feb07b714d288c4acbbe39f698f7ac1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363723, "uuid": "9c77a2d6-351b-477a-9a42-222130bfb61f", "comment": "Malware payload (Mirai)", "value": "743a6e6540c99833dd6b853f98db2e1988b48661", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363723, "uuid": "e850c4d2-7fb0-47ad-874a-7aad2369c8c0", "comment": "Malware payload (Mirai)", "value": "3b307c52cf591380b44cbc72ba423f105952b2e1ccaaedbc43624abb89709f5769a35be787154ac07cb0ab87e27d335b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363723, "uuid": "8cd41160-10e6-4f52-ba5f-ac4efdd2f03a", "value": "T1928312538779F8337CB190B1EE6844319A8347BF42A16683184D58FCAB5CEA272F5723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363723, "uuid": "9b0f580f-d0bf-49a7-8b83-17969e0f01b1", "value": "1536:FKig1vxaDaO30iTxE4tESNmavXDJlTjtxmDrVxrW8VXtq426EivHuEUutSoi8squ:QPZiTxNeS4af1lT5sm8JteevHuEJtSF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765363723, "uuid": "9ac06979-4fd6-4b33-bf30-ae5890bab141", "value": 88568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765363723, "uuid": "a6b704c7-c9a2-48e4-8cd8-33a6a2627838", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363723, "uuid": "3523ebcc-312b-4e7e-a56f-7b9edf6a4363", "value": "ecco.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf7835f-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350115, "uuid": "60acfee2-dc58-481f-a240-43ca2dd9d367", "comment": "Malware payload (MaksRAT)", "value": "046801a9b836c448f5681210f1281e04", "object_relation": "md5", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350115, "uuid": "8c6ba401-c725-4d94-a8c4-aef29bb6363d", "comment": "Malware payload (MaksRAT)", "value": "6e3e06a9b9ff9c594bd0c0dc70d556e9ff44f3787d7ae692f7c13d4b762a2557", "object_relation": "sha256", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350115, "uuid": "53d55928-bd76-4563-8cf8-b251d73f5029", "comment": "Malware payload (MaksRAT)", "value": "4f2719b13740c34d6cdc9a4e6278f6cbc1d3f485", "object_relation": "sha1", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350115, "uuid": "19521991-40f2-470c-a180-1b1a6b664a60", "comment": "Malware payload (MaksRAT)", "value": "5403702b965687764647e28cafaf4dc514ba178e0ff79cef9e17895358b0f2627ee45268036eb14816d96bb89d368258", "object_relation": "sha3-384", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350115, "uuid": "2abff839-914a-40d9-9c2d-fa6d9f8a9a3a", "value": "T12C92D0AE3F2062BCF42FECB3A5179C912996008C260CE162A857564EDD758F44E57FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350115, "uuid": "4e40512f-9d4e-449e-8751-b685b7502432", "value": "384:iL1/c05GYUxfUo9QaWNvQHwHJqcShnnR3vJME0Y2kP+kOMRtXFRkPn:q/cE2xTQlfHvSV1vJrz2nm1RkPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350115, "uuid": "36ee633c-e7dd-422f-a3be-4144221db381", "value": 20023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350115, "uuid": "b1214784-7e7a-4664-806a-05190e3619b7", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350115, "uuid": "edfda8e6-984d-4281-bbd2-935d300d34fa", "value": "6e3e06a9b9ff9c594bd0c0dc70d556e9ff44f3787d7ae692f7c13d4b762a2557.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b02ce0-d61b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765407313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407313, "uuid": "3a5a249c-ba40-468a-beb1-e46cb750810a", "comment": "Malware payload", "value": "fb7a0795cb78244f1bf3dca74dd54022", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407313, "uuid": "92fa92f0-51fd-4213-8351-5e425ec8cafc", "comment": "Malware payload", "value": "6f561ab384d65db9ee11a49b2f9d0a1e6758f9d0c6082f1e65821f6984fa2c71", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407313, "uuid": "f4a96bd8-e506-48ce-b278-1a0cb78f0739", "comment": "Malware payload", "value": "49f8fd5564751f4666f788b1792df0b903a8fef6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407313, "uuid": "ccbcad89-c820-4f94-ba60-6faef47720c9", "comment": "Malware payload", "value": "1d825d902664f7f5854aebbd7578d6efdadddf85b86d4a07e52f54b62b512a104e6a587a8ab062876fde6ce28f757f45", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407313, "uuid": "f30df1c8-6b24-4e9b-a5e1-85500817d2b5", "value": "T1C3C63322F2D19437D1325A7DDC2BA2A45429FF103E24B94F7BE42E8C5F7968239641E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407313, "uuid": "ad0e85fb-4dc1-4c10-be37-1c71df91c7e0", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407313, "uuid": "53f30c2b-8a56-467e-be6f-571663424d9a", "value": "196608:nLIm4FXJv9lvJiYiH7WGSGiYyXD1Jw09vcj6YWgHqJpcdGTTpgq3edU8Fd62tp3c:nsrFVvJiY670HD/9/d2dGCq3mUedD3dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765407313, "uuid": "15901330-beb8-48f5-8a16-8aa9d453c89c", "value": 11507200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765407313, "uuid": "83ada21a-bb6c-4240-ac40-8db7cc1927a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407313, "uuid": "25585a19-899e-41d3-a270-d804ae81084c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e09f10-d5c6-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1765370768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765370768, "uuid": "5c29d64e-37ce-4f43-9860-237b931c4744", "comment": "Malware payload (Vidar)", "value": "599bdb21b9588c79da37b4bfdd046e80", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765370768, "uuid": "353cf7d4-94b9-4a31-8c32-4ac9f3be2b3c", "comment": "Malware payload (Vidar)", "value": "6fa1b950d439825f8ef1b1a9e9b5cb5ba81a09fd1bd598af2b1a5b174e1dad77", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765370768, "uuid": "d9afb1cd-cba1-4696-8177-544faf26e905", "comment": "Malware payload (Vidar)", "value": "ffbe64dacfe405a13aab742b58ebf08aa5d49933", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765370768, "uuid": "38dc9762-ffd8-4c37-8d81-99732b3de098", "comment": "Malware payload (Vidar)", "value": "a87e98017da2419514feb9e091fc6ae60f485049c4b5be570ef5e8db0705f85eeddf0c362c276740847cb78cadd3292d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765370768, "uuid": "24c4c1d5-5977-48d4-b4e8-ec9c8f944d4d", "value": "T1AD75221B73A528FAD5B6563C89F1294AEB7278305731DBDB436042352EA33D09D3AB31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765370768, "uuid": "42c39aae-62b7-4464-b408-f0a80226ca1d", "value": "f73c6a7c47053d807256877f079ae0ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765370768, "uuid": "c79cb98a-0068-4024-9cc6-298ce0d7d75a", "value": "49152:2Mi0kzACpTDYjUpXU1L7mT579QE1ZZMpPop:xi3UCpgjh1Lsx5Me", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765370768, "uuid": "c2be4f13-c6a5-4c3b-abf9-1137ad0a5dd6", "value": 1574155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765370768, "uuid": "44bc43ad-4aca-467c-838d-7f20aa252b19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765370768, "uuid": "f6918d76-12fb-4bd8-8897-83d9ce4dbcaf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "550bda0c-d5a0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765354504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354504, "uuid": "0a913c43-154d-47f0-b817-822e27e034c0", "comment": "Malware payload", "value": "825026ec96bb6b897266eb4773fafae6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354504, "uuid": "59daf130-2c47-486c-81c5-c4d770ddf698", "comment": "Malware payload", "value": "70644e17a1e596f4696a331dea35eb822e74278dd9ab18b2955eba100c87dfbf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354504, "uuid": "c1b2788a-0221-4dbe-b2a4-76c21d8f9a06", "comment": "Malware payload", "value": "66f4d7f051f3bf02f80a3e93ed4eb59087c974f9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354504, "uuid": "8ff03a4a-d562-4053-b796-9101d648468b", "comment": "Malware payload", "value": "369c3cd9ffecc35515290e39c8fe0eb7cc7ca3d43bd4a47d30fd0fcba13f17fefb50c8e36537bde0249662d250a52e83", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354504, "uuid": "6b160efb-4780-469c-a340-30e7fda75344", "value": "T1129127CE356133B38E659D6DF2F68A2B20C2C38002224FA9665970F57AEFD44F520F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354504, "uuid": "70a62f3c-db97-48d1-9f60-f7f2bbc44c74", "value": "96:1xUVpE5xcTL9s8ZV41FgHXWiC6JLZLlejQ6Qi:8X9s8ZV41iHXWn6JLZLlejQ6Qi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765354504, "uuid": "ae1cebdd-4dc7-4526-910d-e0e683ac7725", "value": 4513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765354504, "uuid": "57b0a9f3-c903-4808-ae83-bb498177d796", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354504, "uuid": "8fb35c7e-fa08-4c48-8902-9eb437a0b977", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcfaacd3-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765345230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345230, "uuid": "4666436e-5162-4e45-83de-8a85aa4304e7", "comment": "Malware payload (XWorm)", "value": "cabd7fd6b5beb83fef64f042bef6fd94", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345230, "uuid": "f8e23633-058d-439f-bec5-2d08ff75c436", "comment": "Malware payload (XWorm)", "value": "70c4f474516adb9bba17759bf2023ad445fe8910fa83cdcc225b14a8ccb6fb69", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345230, "uuid": "da7a1299-c6d1-4548-912a-2ce3b7198f10", "comment": "Malware payload (XWorm)", "value": "93ebd1a5251206cf4afec72e026099f55d6ba872", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345230, "uuid": "9db37e85-5cda-4c56-a882-837df625112a", "comment": "Malware payload (XWorm)", "value": "0a0c7690bb332b22852edc09bf8cb09075b8c81990afd9311f0864331bb5849f3ca8a8626e14587e3a23fb16671cf6d7", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345230, "uuid": "41f11908-6e0d-4387-b0fb-915e37fb161b", "value": "T1FC85D339375B6E44E61DF5BFB40497AF98042D12E0DE11BC7D0396902EA6CE29247FB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345230, "uuid": "ab067e71-6711-4832-906a-05c18f7fedb6", "value": "384:DEdAjcsuryNLV6ig0oUOD2xPgmsM7YYR3xTuimeu9:DUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345230, "uuid": "964fb2ca-1ee7-4df5-9dbd-db6a71449727", "value": 1732137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345230, "uuid": "13def004-953c-49af-ae1a-ef2e35025e49", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345230, "uuid": "85d208b0-abb0-4d87-878c-78477942f352", "value": "ODG-10954782-RFQ.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b456fb9b-d60b-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1765400620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765400620, "uuid": "2c4a4b6d-3dff-4413-9e7d-189f82ada51c", "comment": "Malware payload (AsyncRAT)", "value": "e63a4a456c41bc3e1205317447636e89", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765400620, "uuid": "6af0529d-da3a-491b-87c0-309c51266f1e", "comment": "Malware payload (AsyncRAT)", "value": "7107a5aff83a129d0a58e09a5338be703a9ded881cd7d750cbccb2e255898a34", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765400620, "uuid": "bee23621-4b03-4518-9a40-9517ac517ead", "comment": "Malware payload (AsyncRAT)", "value": "0ac98779b41b0877f56f92acdf1d399962adc0f6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765400620, "uuid": "68ccaf93-1c56-4d72-84c2-2a2eccb09774", "comment": "Malware payload (AsyncRAT)", "value": "027ac9574bb719d2064984bfb84c67a39ed973bc8b70513d31b792151caf9b80647b7b07992132d5d394ac40dcbfb02d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765400620, "uuid": "b126c548-29fe-43e2-bd2e-72edecdab5d3", "value": "T119535B002788CA65E2BD4AF8BCF2950046B5D5732102DB5E7CC414DBAB9FFC64A132EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765400620, "uuid": "9975c45d-c915-4819-a8dd-d488a1a2ba21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765400620, "uuid": "ee5730b6-c74f-4338-a7b0-63ee2b41cf47", "value": "1536:CQBmhYLs9kneNUUX5yh94Gbb0wrEsjGlZVclN:CQ/Ls9kneNUUX5yoGbb0IyzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765400620, "uuid": "5773401a-f669-480f-b98d-0ebed9d7a3c6", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765400620, "uuid": "831881c2-70ec-4c73-80fb-0545826812b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765400620, "uuid": "863026ad-3de9-499b-9ff4-cd3d2beaf590", "value": "chrome_updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ce69bf-d619-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765406416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406416, "uuid": "c426d46e-e45a-48b6-8e4b-6fcc94b84e36", "comment": "Malware payload (Mirai)", "value": "857945d0bbf499741830f7d2ead5a071", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406416, "uuid": "e3bd15b7-7ab1-46b1-bcf9-d48c515c3209", "comment": "Malware payload (Mirai)", "value": "72a2aa09b01fcf614990cd14be6fce8970b229841eb23d145e6de76501b61870", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406416, "uuid": "834ad83a-0dd6-424b-811c-113a86312058", "comment": "Malware payload (Mirai)", "value": "df32884e268cd2b6422349bf8995d5b8a8be7f90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406416, "uuid": "9967876c-5cb9-4236-8f07-dffcfefd5e97", "comment": "Malware payload (Mirai)", "value": "2ca77b6e6bd3ac23ac16124abf6e3a166ba281e1a0a85cd9909027b07c44f888476d20277c4cd8696488ac2bd3427313", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765406416, "uuid": "e45fe1a1-444b-45de-904c-6f86ab13d9f3", "value": "T11A334C21FEB65C1BC5C4683B51D74B36F6E9434624BCCB2ABD620E8CBB405C42617AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765406416, "uuid": "d56a929d-1192-4bd6-baed-efeeaabb562d", "value": "1536:O7Z0EvVWlLHYEEHKW+3MxHd51kjIiFOfcnWAWzH7LhM:Od9pXKW+3MxHd5yjIiFicn5WzHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765406416, "uuid": "9198f6c0-4661-476e-9751-0a99af1d6734", "value": 51048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765406416, "uuid": "18167a05-e1ab-4819-a7d1-45332dc39664", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765406416, "uuid": "e15dd497-7610-46fb-97a3-77800e594c0b", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fbdff95-d605-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765397982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397982, "uuid": "074d42e4-5a15-4ed6-b809-f6f3b8226d74", "comment": "Malware payload (Mirai)", "value": "ba1e5c58ef1f22532d900fa5c942798b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397982, "uuid": "258cd2d9-5ada-4052-bd26-a7e793241249", "comment": "Malware payload (Mirai)", "value": "72e4413f4a72caaf08ae8a04b6821c575c5abd3ed4ef11da32df8b86e382dc32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397982, "uuid": "c1191433-958b-4108-8013-a854d56ebc7d", "comment": "Malware payload (Mirai)", "value": "20a02504dde1cfe4d969d8ed84f8a76bcdd7af8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397982, "uuid": "e82effcb-938c-40d6-807b-d92f15d9f953", "comment": "Malware payload (Mirai)", "value": "7f1120e6b87af84838e04d2f8e5a25ee3e5836613ce59aa54a84f929d0ed2023526c81311f2642f10bb6a6b0b6e7634e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397982, "uuid": "b8ec6654-837f-4c58-acab-11066844cf07", "value": "T1B9736CC2AB47C4F4EC2605716077E7328773E13E1029EE43D769AD36ED52A41A62A3DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397982, "uuid": "261d7e4d-30e7-4830-bd40-90000d4e21c8", "value": "1536:XbwcQ0p+cLBZFHKCRIpmQ3Pk798U755e1j+G:40VZxKCRgmQ387O0PU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397982, "uuid": "3484317b-e531-4254-8c17-579638ac3f7d", "value": 79504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397982, "uuid": "9134276f-6969-4475-841d-62cf5c94fab8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397982, "uuid": "b71af997-a5a7-496c-a337-58814be5aded", "value": "Labelloperc80.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae73969f-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1765345205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345205, "uuid": "908e6179-971d-46de-a482-5c8e4b4469dd", "comment": "Malware payload (Formbook)", "value": "e101fd22b6c28e220a001a225754517f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345205, "uuid": "4661c32d-54c4-473c-94e2-ef96e0cc7582", "comment": "Malware payload (Formbook)", "value": "734e91a988165f829e532e99404ae00a081be1d1a97c6561cbc5621e0595e572", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345205, "uuid": "03fbcfa1-e724-4bc2-b797-085b0b6cfb87", "comment": "Malware payload (Formbook)", "value": "b69a9b8083ffee07e76492c6e606241a7068bc50", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345205, "uuid": "9d8dfefb-da4d-4a6b-bc4e-0a45f8d1936d", "comment": "Malware payload (Formbook)", "value": "3e145813a53ae0d4955f261e8a93602bcd9ebc2e356c4ba3b349da8ebd39d4e89f1a115373ec4f46492d9c98ae6ec5d6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345205, "uuid": "ffbe4086-afd0-456e-b730-45044b108ed7", "value": "T1EFA5B25D84B1ACD3A054FEB4F685FFD78C9B5385162B07421FE4858A3312C83FAA72A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345205, "uuid": "1b56ae83-cf0c-4a8d-98e0-200b39c2bff8", "value": "12288:nnwqY65pxgRH2TpcBrsjeMxYV7PA5ZnArM/jFW+HavNyacV2MFVnPTrn3Y0P2CLi:gYHiiZWSDavsNz2CLy3d9OMeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345205, "uuid": "88060c85-584a-4ed9-8c8a-beda94400f2e", "value": 2075600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345205, "uuid": "03cc014a-ce4f-47c1-bfd6-8ff12c6d56f0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345205, "uuid": "565c15ae-9bb4-4fa2-97aa-13edd10a47d7", "value": "RFQ 8401.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf51a3e6-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765345234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345234, "uuid": "b09999ca-0e6e-4720-a3bd-7fde14daf33c", "comment": "Malware payload", "value": "1947215ed81be1627a693828889d2bb8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345234, "uuid": "51bb7b19-1f02-4651-90e0-d877f1375de4", "comment": "Malware payload", "value": "736ab890d4a3deb9d25eaf57cf240f2ece106c960e436b0bdfdf53320304c1b6", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345234, "uuid": "9c72ed7a-6fbf-424a-b7af-5255b6762aa9", "comment": "Malware payload", "value": "195ea30eaf8d08eb2281317a265106c7d3f9de87", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345234, "uuid": "b6f01586-8943-4344-821e-3b9696955adc", "comment": "Malware payload", "value": "303b14c266af982764ef903447bbe46f5d85be8e7abef7d09e423b60064cac7b4829d12c978296ee143981b68b41fc90", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345234, "uuid": "cf42a075-4e01-4cd6-aebe-2d8e1821bcea", "value": "T14C51B181FF0A6D30CCD57401B468459A2F8AE3339C620D6E7ECE980E5F0B5A966E19E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345234, "uuid": "12b2b8ab-1f88-4b10-abcc-50f98a15da71", "value": "48:8GhCEjLX8aeHPVeH5P4NmcWgZWgVL+ejxwX1IJXQY4ZJOXMG0A/:CEj7Q2cXv+epP4YMG0A/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345234, "uuid": "eebfb69f-90a4-4b92-b4e7-716c50bd00f2", "value": 2520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345234, "uuid": "310b93a9-20e0-4fee-bd9c-69747c20962d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345234, "uuid": "e66f92bf-97bb-4483-8d20-32a3c270af49", "value": "alice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff45bc7-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350442, "uuid": "dba7d7be-de4e-43c7-9c43-a5138017b661", "comment": "Malware payload (MaksRAT)", "value": "96d863519faac6913433b4ccdba08269", "object_relation": "md5", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350442, "uuid": "799d9b1c-c937-49d6-ab35-8d14e9471ce4", "comment": "Malware payload (MaksRAT)", "value": "7464ecf795c92626e7bcd04644b68a8a10e7d719d866400e5916fb3773407988", "object_relation": "sha256", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350442, "uuid": "cde40519-b550-4b27-bcf9-c9f8023a8b5e", "comment": "Malware payload (MaksRAT)", "value": "3a355ab7f599feb8114609e8f80c511e1b8bc311", "object_relation": "sha1", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350442, "uuid": "e0e67577-8ab3-4e09-8a07-bd7584508b62", "comment": "Malware payload (MaksRAT)", "value": "db64c5d1054baac22949ab0e220b99db6f0ac3fa70fb2dfa9a9f1056e11ff1521babb07b81046a0818542b85d95468b0", "object_relation": "sha3-384", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350442, "uuid": "6926ccfc-48e2-4c40-8b09-9c67b42d6cbf", "value": "T1B5E2F1E479574085EBD1A971E541C40B627E4B23B78AE732637CBEEA34603DAC8D0CB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350442, "uuid": "85db77c6-25ea-40e1-8c32-3b2f842af868", "value": "768:V9PqiEjfUZGFUVw2rVibJXzDOfCugB1S2Svf2nV9FLfGlQY8+eNsW:bUFUGtbJX3ECug+EhGlxriz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350442, "uuid": "b43a9380-9fda-4b54-b243-e31c9545ab2c", "value": 32941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350442, "uuid": "654793ee-9469-47a3-a69e-85f04cffd33a", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350442, "uuid": "e1370731-74e1-4076-a282-3028506d0d07", "value": "7464ecf795c92626e7bcd04644b68a8a10e7d719d866400e5916fb3773407988.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d00df0-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350110, "uuid": "54a53571-0e03-40ee-910a-0961e33cb73c", "comment": "Malware payload (MaksRAT)", "value": "2f8c264728f92c3a76a910f02033eece", "object_relation": "md5", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350110, "uuid": "1d8f2dc8-ea79-4271-9218-9e17568d3e08", "comment": "Malware payload (MaksRAT)", "value": "74ae055e77296ab32152fe06983d63046ef31d4335ff05b109f27af3ef438cc4", "object_relation": "sha256", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350110, "uuid": "da7dd473-1e57-46d1-8bdf-8d86b9e61f0a", "comment": "Malware payload (MaksRAT)", "value": "fabb8cf5b9abb7f3a920a7e69fbfc378caba7c61", "object_relation": "sha1", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350110, "uuid": "811d6dc8-8cc7-455a-b9a9-ca0ac1fcd3b2", "comment": "Malware payload (MaksRAT)", "value": "7f809a561417195938cf6cf6142a8a034755128111c54a7d5435b44d1fded4194bddf3bb44fe4398689068f50e3e8114", "object_relation": "sha3-384", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350110, "uuid": "a7c177ea-a444-4114-95ea-d91ff2a7be52", "value": "T142A2DFBB5683D966C0B3477E1BE6181FE1905629B6F54FDE22004D382A3C5BB27132EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350110, "uuid": "6179d49b-30c1-4aa6-9f76-e7fcb58343d8", "value": "384:JHcZeoo/zxDwuKX6yGYnmAsFz6VCB9Y5DXEpZgkVMlRe8Sx4K:JaAlDwPIYnmASzWlpaJ3xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350110, "uuid": "e92fa36d-5f0d-460a-98e3-7654dd2dda26", "value": 21377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350110, "uuid": "cde709a1-d84f-4715-a58f-2bac12813cc7", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350110, "uuid": "dd07a366-d19a-4d96-8c61-1a6d00e7f0ad", "value": "74ae055e77296ab32152fe06983d63046ef31d4335ff05b109f27af3ef438cc4.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637a5487-d605-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765397908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397908, "uuid": "05071fbc-0e74-460a-809c-a85a15e101d5", "comment": "Malware payload (Mirai)", "value": "90462559c562d8f9225dabea10512c94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397908, "uuid": "4a4c8420-5d76-4bc3-9a5e-a8c472ce81d7", "comment": "Malware payload (Mirai)", "value": "7676841f8e7626e986a9c57496d26540e1b129c48ce73249127bbf1ef38e1b67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397908, "uuid": "e915a6fd-db9d-4da6-916f-f85ec3accd80", "comment": "Malware payload (Mirai)", "value": "83dbca6d62d1c83573be6180607134d9b0f02187", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397908, "uuid": "cecaf943-7da3-4e7e-8ece-7ae89f65b39a", "comment": "Malware payload (Mirai)", "value": "a31f8ff660cb737c25fc2795c4b7bff1f7d0143f8e4247b356707508fc15f8f31c5f6f13b6e26748cd1afb2111e173b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397908, "uuid": "9c4ebdc9-c75f-4f7f-a186-9a28c53d2f78", "value": "T18C13E1B7D03FE074C415DB76484F6480EEA7F46B4644231F1FDAB1FBE97486A58A2281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397908, "uuid": "df7b1f00-2627-412b-b41c-6798fdbb3e7b", "value": "768:BowaWeonW124mwTRUFyUnvVB170QIWl0imwmVewuxx0KZ:mlWs124LTRUUyVbbl0ZwmBiPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397908, "uuid": "8b5de8be-cf05-4c7d-bea4-932e516cd917", "value": 41900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397908, "uuid": "7fe37ed0-7c81-4fad-a6fb-a38c33da9c69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397908, "uuid": "4277aeb8-f4da-47b3-bcf1-229be26b6ceb", "value": "Labelloperc80.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47ba11c-d5c6-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1765371066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371066, "uuid": "36153112-bbc5-4088-a53a-433534df7060", "comment": "Malware payload (PhantomStealer)", "value": "5f90853a1624e6566f25748d7a5ccf93", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371066, "uuid": "4edc4bbf-891d-4654-8858-99a5a3189340", "comment": "Malware payload (PhantomStealer)", "value": "772b10345350d23f8dd33902f88e08d47cff76ecf7093b8d4de040e125bc31c0", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371066, "uuid": "cb887e51-1d3f-44bf-9e1a-1b2a4cac8b84", "comment": "Malware payload (PhantomStealer)", "value": "b204d09af75c5996e4b51a501788c92eb62ba241", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371066, "uuid": "b54db82c-ee9e-415f-8973-26d00e079210", "comment": "Malware payload (PhantomStealer)", "value": "4b3b4302b4f7d4f1bd14dd3b5a4b6ac78b6dfe5d14ef08d15015e417ce6819b3548cd51a2e8448ce945cc803e119c105", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371066, "uuid": "1626a2c8-fa91-407a-9054-92bb7babef4a", "value": "T132F533209D09EEAC879CD37CA47F2E1C0A924ED65009D0FE77BE548357AEF06291F819", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371066, "uuid": "270cde40-f4a8-4997-a3c6-1edfb4059060", "value": "49152:ThmqZl+wlALLGtHtmQVI1jDVTx70hVVEKNm2xOvZwRe:s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765371066, "uuid": "b252fc6c-9e8f-4cc7-9a98-4a58222ae0bd", "value": 3352356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765371066, "uuid": "9c78ebec-50a2-4ec8-85f7-a853b1df727e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371066, "uuid": "36adfb9a-cc43-4fff-99e9-bc883b586a74", "value": "lq69dp.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5904ac4a-d620-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765409486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409486, "uuid": "e297437b-378b-4b0f-a82a-d961aff59cf3", "comment": "Malware payload (Mirai)", "value": "b9a4baffe50603c18b2aa80a93793c26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409486, "uuid": "bc25e9ec-5773-4835-9859-59c8cad7a981", "comment": "Malware payload (Mirai)", "value": "7767c20bee77e0f693e34e543f5cb7b88f0794ac80085df212c8bcd76ddf0bd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409486, "uuid": "d271a1e6-56b5-45a0-841d-6abf5d55f629", "comment": "Malware payload (Mirai)", "value": "f0277db16a7c7d448dd84b034916e07fdc752818", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409486, "uuid": "0da86580-dccc-43c2-ae37-a8162adeac68", "comment": "Malware payload (Mirai)", "value": "cb54e351cddb9ed4bf72f294a39fadf49469de55472a7f5b98f94b6d1725701c126cb7f866d1a0bce0fd503b33bcbc6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765409486, "uuid": "66b3df2b-256d-4f33-89b6-a00fa7d69b53", "value": "T17483D61A6E25DF7DFB69C73147B78E20975833D226E0C641E12CE9015E6034EA81FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765409486, "uuid": "9379d28f-f5e8-44fd-b6b8-100bfd1e10ef", "value": "1536:tQL3XB2ozeZZuz4gEBPftsVpX0DQxjmiHpZ6TDo7D9x7DDzr4g2vm+GYT3bsR3:wXModz4PftsVFaQxjmiHpZB45mHYT3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765409486, "uuid": "15cd22db-d5aa-4371-a290-59e271de7c76", "value": 86060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765409486, "uuid": "66571553-0a85-44c0-aef4-9f80d89364c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765409486, "uuid": "ddf6d155-9866-4b84-8135-4690666eb3ad", "value": "jklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd1eec6-d5b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765362461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765362461, "uuid": "1f4e4387-a01f-4f59-9422-9966a5e7a040", "comment": "Malware payload (Mirai)", "value": "b8442d6e05b02f432b2fa5d3bcdbb694", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765362461, "uuid": "d81bd226-954c-4b8b-a2ad-29409fdc4670", "comment": "Malware payload (Mirai)", "value": "778e0e157498c9ced95dacf95ebaf2b5eed337e3d7f9bd797fc340091408e41d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765362461, "uuid": "6625af00-5816-4b75-a869-e453b1e583ad", "comment": "Malware payload (Mirai)", "value": "da4b8b4d903b7f9029d48be640c706133cd42b37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765362461, "uuid": "d3f84cf3-d749-4459-821d-7ec5a1c4c9d4", "comment": "Malware payload (Mirai)", "value": "d588109d4e9a7961b8282f7ce6017b34a08150737ef4a3e9192fd47471ffb9f05e05c7d29e03058994e99d9faee606e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765362461, "uuid": "4b2c0656-eb4a-4a1d-8123-0085a8c8e8b3", "value": "T1F0830224EC0FECD8D8DF49B72186577933A0886E466BDCFCF061AE3454298177B19B98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765362461, "uuid": "81f37d63-400e-46c9-95ce-f3429a8920b5", "value": "1536:asTPR/bWvuuAcnB8Ecsr4JtnAGpz/Y6XYO0QdnzRy1j853dWeZIjV4u+qgw0zu:jTPRDWvu8aFsUoGa6fNzE9Cd1ZIjV4uR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765362461, "uuid": "44051fe9-ddb9-4eb0-a809-ab5a60a126d0", "value": 88516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765362461, "uuid": "70a14756-0e4c-4b60-8097-368acdcf531b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765362461, "uuid": "0b02f652-272f-4718-8773-157b2ed749d6", "value": "ecco.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a05cec-d5a0-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1765354691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354691, "uuid": "6ea4492f-d3a1-4f7f-9b00-c599e3362ce5", "comment": "Malware payload (CoinMiner)", "value": "a39d02e965b63a295ad7b289b8a55ede", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354691, "uuid": "0bc210a5-f6b7-4764-b544-04d24b7c2eb4", "comment": "Malware payload (CoinMiner)", "value": "7815ad55f60d7c6adfb81217300cb898a2cb5b570a89a5f45520967731bd1eac", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354691, "uuid": "208f2d92-b3f4-4f8a-acb5-32f827b3f31c", "comment": "Malware payload (CoinMiner)", "value": "f803e5fb860194b938e7377837569b7c130e857a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354691, "uuid": "b6c72e46-4787-43f7-ab4f-bbe7e45adaec", "comment": "Malware payload (CoinMiner)", "value": "e1c24da272e47b8bbbd936bcf79c64354726651cc188665e8a83e630199b1ed34cf27e9818a341668e8054d70d46aab3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354691, "uuid": "abc9bc45-998e-4859-b6de-a42007eae60b", "value": "T12D086B4267EA04C4F9F7DA3589E69217D673BC166F3085CF224C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354691, "uuid": "97244630-f2e1-4428-92c8-8db9b83df663", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354691, "uuid": "5e2a1832-c7b2-4746-a435-85035860a848", "value": "393216:jTI3xpBpYeoGmZcpmjz5GZd93ULfBPLoIJBsIyNOnS0B4AycWMCY6+Y3xjtFRYVj:jYrO/sJY2ByOjR5rs3wbvE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765354691, "uuid": "d9267e30-2366-45f2-addf-d21fa38e3c5b", "value": 78026923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765354691, "uuid": "a21a9a8b-ae54-44dc-9114-2ddb3d88de69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354691, "uuid": "484e616e-6b51-480f-868a-d21bd578dce4", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc98d1f-d5b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Sliver)", "timestamp": 1765363860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363860, "uuid": "7316d113-8c18-473a-9549-cf14606fec58", "comment": "Malware payload (Sliver)", "value": "2e9e0eb0dfef17de734fa1fd52dad1f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363860, "uuid": "2a91e3ba-f476-4d0a-a7c9-1d5690dde006", "comment": "Malware payload (Sliver)", "value": "783117155dbdff7084c24de5a887cb322ea83a5d054fb033b30f735e12348c43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363860, "uuid": "b52bf5a5-f6c0-4fbb-9a8b-ca10d5851d3b", "comment": "Malware payload (Sliver)", "value": "3f284395d8ccec917d9cc70d92dc0baeb285101b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363860, "uuid": "380fee84-6594-4efd-ad52-a282e07c525e", "comment": "Malware payload (Sliver)", "value": "a31da4af4d338754582ef4086f0a862a33dc0526e6363631e479b5629372d2bb3e83f5402ec847f85d5758c82f7172dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363860, "uuid": "2ecc112d-061b-4382-aeb1-94ce5eda8281", "value": "T16EF61903F8D610D8C8E9D1B489614271BA70785C1B7923DB2BA5F7B42B327F48E7A791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363860, "uuid": "f7825858-5b1b-4144-84ca-a84d09a25719", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363860, "uuid": "ab007978-7021-47af-8e83-fcf4fad808a5", "value": "98304:s3+GQFxRWyubeFJ03lydEYpUePbFnNO0qEw5nYPQEkYV9wvV:8+GQUwJgsUwbFnNOyw5nYxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765363860, "uuid": "83d3a253-789a-48cc-9ea3-52164682187d", "value": 15662080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765363860, "uuid": "0cf6e783-3145-4d20-9bda-bfa535679673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363860, "uuid": "5d6c5368-1a46-4d5a-bc17-533207db84c9", "value": "n-psk-ru.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be863d01-d5dd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765380880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380880, "uuid": "ad312554-f0ce-40fe-96a2-8c1a8fc4c667", "comment": "Malware payload", "value": "d1adff72cbddbb98f36e81964cd8c66f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380880, "uuid": "8a01a5fa-7e97-42e7-a9f7-d5ac8dae9c7d", "comment": "Malware payload", "value": "7834ce14fd60aebabb6697f1311362e83a9ee20bab94471e2427e6b150dbec68", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380880, "uuid": "a818d160-0c09-4eac-95a9-d64be3d38911", "comment": "Malware payload", "value": "742076b094fa434b0a1a68e14ab810dfbe47ce20", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380880, "uuid": "4a380d42-a12b-4462-9adb-6757bcbacb26", "comment": "Malware payload", "value": "20da0934516a15759a96a4a280e50cc14ebb231c521043ed7d510911708dd6644aa3a7122239f8ce3415566ab674da27", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380880, "uuid": "2d7c2e38-2544-4e69-b11a-30fa3a6f5f6d", "value": "T141E1A4932C01B9911F16C9B5D0CF6ACCE90E12E3C42CADB4780E799E57C9D45A89F8C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380880, "uuid": "fe9b6f9a-1b52-4b06-a5eb-036b5eeb8e3b", "value": "96:baaIwkY7e4fZaM5r/NYrNZlfOm0D+rkYrp9SWivQA2fP56YpkGyJOPlkm7pq:ba/wkY7ekcM5rWdOYrSDYV4u8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765380880, "uuid": "a27ad73c-4cbd-42b4-9b0c-cef41ffada7c", "value": 7135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765380880, "uuid": "fe22341f-9721-4ce6-b536-e7c450cbfb6e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380880, "uuid": "db0d02ac-6843-4b0e-a520-04813866941c", "value": "exrce4.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e1b323-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1765345198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345198, "uuid": "fe29f535-911f-4c10-a199-7b7407085066", "comment": "Malware payload (PhantomStealer)", "value": "97c64a48e35abaf75a152d3a832bfe15", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345198, "uuid": "3342990e-0ed6-4b6a-ba44-d25396e1f0f3", "comment": "Malware payload (PhantomStealer)", "value": "7906a61e3db04c4d29070abc2e5e0af2700953a82c64bb92c9c6da69fbc2c62d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345198, "uuid": "7a0d6270-b3b1-41de-a408-33c01cfd1ae1", "comment": "Malware payload (PhantomStealer)", "value": "af7ad9ca8c22e780369b4873d0999a1e4d3b6eb4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345198, "uuid": "f0f9053e-68fb-42f8-bc08-edd852607211", "comment": "Malware payload (PhantomStealer)", "value": "044444f6088d35000b6035c3355eb97c024014e6cb1509c76fe570e1136c44adf12a5a4dbe4b69c5dec60f1be6d49452", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345198, "uuid": "26b214dd-1f94-4a2b-85fc-29f0827fcef1", "value": "T1F7D44B20DD2416B94F071BA9FD541E61CAFC960A552A90F1F6DE070E61029FCE3FE6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345198, "uuid": "e323a7e3-155b-4463-b2f4-aa7d7d9aca6e", "value": "12288:sKUKmKlJRuKlJjKlJg+ICKlJg+9KlJg+IjKlJg+IIKVKlJg+IgKlJ/KlJg+IcKlz:sKUKmKlbuKlhKlxICKlx9KlxIjKlxIIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345198, "uuid": "86ae93c7-e99b-495a-99cc-7a9c6d9ae13e", "value": 598721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345198, "uuid": "65739a90-3b61-4918-a2df-63545b7503ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345198, "uuid": "e2b0ba4f-1f45-4134-9212-4a6dca536df9", "value": "Bank Remittance Advice - PO 4522756771_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e1cb7d4-d5df-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1765381470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765381470, "uuid": "78358ac7-42b0-47d8-a4a0-5aae86517171", "comment": "Malware payload (VIPKeylogger)", "value": "ce7c693c313a32bcbfce6d59473cddf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765381470, "uuid": "110f1317-68b0-457c-947d-7f34da2eb757", "comment": "Malware payload (VIPKeylogger)", "value": "799093044ef3167fff0911dcd58bdff51533957af83bcd195009249fa78fcdf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765381470, "uuid": "ef022406-a0e7-4c6b-8da6-b517ea815e0e", "comment": "Malware payload (VIPKeylogger)", "value": "48ff0de9bf2cd2c7596f2220b8632391c6db49db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765381470, "uuid": "af27cc0f-82a7-484d-80b5-05e00830a85f", "comment": "Malware payload (VIPKeylogger)", "value": "f0491f2edae7c479a0b9595df67c5512c0661cd898cdb60e655faff9c6c64483978e4887abe03fcb1d249cb2851ac762", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765381470, "uuid": "c44f1118-be03-4012-a132-1a76c16acf13", "value": "T1D7044241A2C074A913471FF6772FB1E5F51E09ED7998085FE220FCA4B675B0AE6E0932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765381470, "uuid": "f7f6f0b6-a05c-43f8-9e85-ce32bec28bff", "value": "1536:bZzSjk+Bqx6lzJatTB4Db3VUNdK7gpoyh00ShfP1N5gaqA03kFyqzCD2:bsjk+/xGG3Vmc7vH6aqA0R6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765381470, "uuid": "cfc16e2f-cb43-4c57-b991-4914d7ed3629", "value": 187665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765381470, "uuid": "f418e8af-2285-45d6-9ccd-2be04155b4e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765381470, "uuid": "17c003df-db77-4a15-acbe-ca1a41e5ecf1", "value": "20251208152306.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecba0b9e-d623-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765411023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411023, "uuid": "591d9fd4-9cbf-435d-9d86-3fb73fed128d", "comment": "Malware payload", "value": "7b101e141e7aea13294d7787d5ec5724", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411023, "uuid": "e0e31059-74bd-4cec-b5b3-a590c05de31a", "comment": "Malware payload", "value": "7a9a0983981fdd2b95c6415ddc658d2fb9648db7561d5318b058d8a10fd677ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411023, "uuid": "2130ccf8-7a81-4c35-889b-97fa285007d0", "comment": "Malware payload", "value": "2fde51a135a85e60dfb4b5bbe8a2949a74213595", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411023, "uuid": "da8f65c0-b87b-4e6c-8b0e-2f8e396b308e", "comment": "Malware payload", "value": "71d4926738c18a1fedd3e6f9e3c1b917f8610a6182ddc3508ab8281803964d005df0713ef7179ca61be7d6c15148620f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411023, "uuid": "793dd01e-61d1-4556-a2f3-82bb169f7244", "value": "T1B493D604EC506737C2D23BFAF79A42CE77351F986B97334196287AF41BE5B982939120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411023, "uuid": "4722241b-7bf9-4cfd-a703-7df934f76d98", "value": "1536:VKqeJwbR4W1i4sB9xQMOvA9dHB1WoAgqWhQ2atiod0p+BhcP3zjSMu4oBfHObH2W:QwbR4W1i4sB9xQMOvA9dHB1WoAgqWhQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765411023, "uuid": "7ad49f72-2de8-46d6-9829-2bd4fe5d1e47", "value": 95137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765411023, "uuid": "e3c66ede-bb01-4a44-9b10-8ba22a15cc80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411023, "uuid": "6ed1ce55-af6a-42dd-977d-5bcfbb0ba206", "value": "apache2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449a86ec-d61a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765406875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406875, "uuid": "6f753aca-b744-4606-aa62-b915a07c0e87", "comment": "Malware payload", "value": "bcdd6e6557670f6487e8bb939e780dfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406875, "uuid": "92a02d02-b137-4794-bda5-7476dddd5944", "comment": "Malware payload", "value": "7af5eda25d187fb733388f98b4c7a9951c5d5b8eaf1073537e2f4c55b57a7d2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406875, "uuid": "9f0e27ca-9c3a-4a0b-8514-5f70b99013ed", "comment": "Malware payload", "value": "852eeb140ee46e6562a6d114da81d07342fe7899", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406875, "uuid": "c76d2977-7a0c-469a-a28f-7dfb44b45572", "comment": "Malware payload", "value": "154499a31018c8523bcb9252fd98f82d4b046554292ae1b4bf045c2cd5b5c9ab9a9e71d2a60453026abe4a3bae21485e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765406875, "uuid": "9d24de46-5d14-4935-b68b-51cd894833ed", "value": "T16243D809BB618EB7D8AFCD3745BD8B05349C920722A43B757930E428F35B14F5AE3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765406875, "uuid": "f19ce9a0-6ee3-410f-aa45-3ce4de91a44d", "value": "1536:f+saokklTfL/mLmH7qIZGmlxFe5Qr2bRT3bsRR:f+s71L/ufRT3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765406875, "uuid": "6173a7b2-83df-4b4e-b20c-0db270e5663a", "value": 60196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765406875, "uuid": "36353409-0c4d-413c-b25e-ffc4c947122d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765406875, "uuid": "9667fc89-42dd-4d07-8b6d-f467012ceb76", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fdd99b7-d5a0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765354495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354495, "uuid": "a6c86d98-351e-43b4-8d82-fdead8b259fe", "comment": "Malware payload", "value": "03d09b5ce3ef15dc2b1134bace6918ab", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354495, "uuid": "2cc8a7c2-835d-4788-878e-19bd53444062", "comment": "Malware payload", "value": "7bb5461853cc60cb6540a4eb6cb92e96e28addd7795fcb90f2fc6b322fc54918", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354495, "uuid": "e60b032b-e367-4d82-9309-d469b92ac57f", "comment": "Malware payload", "value": "427edc4e8acba05ea1f76fc427538275c64bcd7e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354495, "uuid": "805b1142-b992-4896-9275-8f12a09d6ddf", "comment": "Malware payload", "value": "77615a4f6d27dc2afe2fd6f166a455366cbbb3e7c550b74db46ada27d9bcd14d753b901d672957739a3261001a7c4fae", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354495, "uuid": "55286225-94a4-49b9-b2ea-102e87af5b93", "value": "T19BA108DD78603333CD92AE3DF6A58D1F2081C0C089258F94E65930FD75ABE56F650EA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354495, "uuid": "e8510d29-6be6-4d51-9302-4cbe8a783ee7", "value": "96:1xLc8okWcegXz49Lt6o/IvUAkMSg2MX/Bq6X6dvkrUB1fOfe:R7Xz49Lt6owvUAkMB2MXpvX6dvkrUB1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765354495, "uuid": "40cd13d2-0e1d-4d63-82f9-9f356e3e9611", "value": 4905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765354495, "uuid": "043b65d8-6082-47ae-a4cb-bbffd094c5b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354495, "uuid": "02c0e623-63b5-48cd-b9ad-d224709341ad", "value": "ru.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6103af01-d5f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765392749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765392749, "uuid": "1df5a06f-f1a0-4782-83ba-c4dda3797809", "comment": "Malware payload", "value": "f29b7756a8a9b0253408f8b2f0655ff2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765392749, "uuid": "82d56dcd-042a-45e7-8c6b-182313a36e09", "comment": "Malware payload", "value": "7bef9c0f29aeecc76a1326ccc935b7e7084af90f2e40db5fe21e46a0a0d8e9c5", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765392749, "uuid": "d1c68743-5c1e-4dec-9bb0-41e68e61b48e", "comment": "Malware payload", "value": "63adecc9c7a8ab88b9d672a75397bf11c0a0eb4c", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765392749, "uuid": "5caedf9e-2e53-482c-bd88-f3e6b6ced388", "comment": "Malware payload", "value": "2038f751f38d2ee5e9e1e95c38c7618db91854e6102959bf22e669338bdacee94e5060cc2c76715f8cefc04bb0af6f58", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765392749, "uuid": "2dd9dc0a-40b2-42a1-b558-e1aed09e338a", "value": "T19641CB253FD50B29E3B78E73857BE6159B7ABC12DD169A1D008082481822F01DC76F6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765392749, "uuid": "d2b078f8-321b-466b-82af-a4ee986c45ac", "value": "24:88JV9+ztutCNgAWx609Dp+/x2xCpqZqddNXuHY8hyNCabfp7mll:88XSN3B2AUkdLXuHACa7p7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765392749, "uuid": "fb083cc2-f3d4-4526-8c05-f78ff90c156b", "value": 1973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765392749, "uuid": "0fb98f0a-eb08-4b1e-95e8-284e63ffed7b", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765392749, "uuid": "4b6f34cd-5021-4b58-96dc-3c53695b4409", "value": "Factura.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75956b49-d560-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765327071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765327071, "uuid": "908f0640-5951-4893-9dbc-cccbbaad86c2", "comment": "Malware payload (Mirai)", "value": "893db1db87c15c811f563090fa1d737f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765327071, "uuid": "2229b184-0552-45ec-b90b-c259a1d6c10c", "comment": "Malware payload (Mirai)", "value": "7c02963fdb148b9a2bf9b9913fa1db9a62dabaf47b281cef30ce83efa4e9675f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765327071, "uuid": "0cf12654-bb8c-4de5-b956-d9baa44c5d99", "comment": "Malware payload (Mirai)", "value": "2a3324a3934bd9090b48848dd4414587f6ec28ad", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765327071, "uuid": "ba2f11de-a0ee-4bf5-b038-6da12b34ac8d", "comment": "Malware payload (Mirai)", "value": "4399da938390eeee629cf569f8cdc6a745e7524c80c77c346555fbbf3ce51b0fa3a3ab946e5abf3f55dcd35ddba22e70", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765327071, "uuid": "30fa150c-3958-4d1b-ab13-026715d1486d", "value": "T1A31160BC070A6DB88088D83A7292C90D30E24FCF143BDB906E69217D30E05DE7132E0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765327071, "uuid": "3a8a6e2f-d8de-4c64-9529-40a2544ae4a7", "value": "24:QXzFkVrFl5fVrFGVrF1VrFApVrFJVrFwVrFvVrFTVrFWVrFAJVk:QjeVrf1VrYVrPVriVrPVruVrJVrlVrMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765327071, "uuid": "15299e76-5127-4c36-b6c6-23668c348027", "value": 1014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765327071, "uuid": "6c0640e4-4b7b-4ec4-b987-25ca4eabb350", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765327071, "uuid": "68e22a63-a75b-4e68-872f-07992675cb7f", "value": "w", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75ab417-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350455, "uuid": "6ac483d7-ea61-4835-8141-a5442ed6b998", "comment": "Malware payload (MaksRAT)", "value": "e33ddfd9f531c5e3d4186d5aa893a25c", "object_relation": "md5", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350455, "uuid": "240a6975-5333-48ec-8445-90519609614e", "comment": "Malware payload (MaksRAT)", "value": "7c5b5dee4e0575f1d6d408b20aaf6813f69fe5b6e2b27369fe6ce42ad315a5bf", "object_relation": "sha256", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350455, "uuid": "eb937221-87f5-458e-b77e-b6b22b6c49e6", "comment": "Malware payload (MaksRAT)", "value": "fd47e506b9f0eaa05f902a514e9319476aee7f5f", "object_relation": "sha1", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350455, "uuid": "d55be922-193b-4822-b1f5-34e8a0d0e457", "comment": "Malware payload (MaksRAT)", "value": "647ddf442e8cfd3a0038278e2d904a42190e43b572ba37e7aeb20e99324b1d716c302cccf436eafe8a54b8b7c1f6db97", "object_relation": "sha3-384", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350455, "uuid": "54c5a6ef-7208-42aa-a52b-f8170a448e20", "value": "T18FE2E0A22A63C89FD2D781760457C281DFD609263794E206C3DD0F9DADE451C1EB9F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350455, "uuid": "025fd19f-8f4d-4715-ac1b-a259bfd6d0cb", "value": "768:jIw/Jq65Mxt0UIrw9rHmK/bisJs4mDEbTZK+9K:Eis6Cxt0UIrOfT049g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350455, "uuid": "57b1f824-78e7-403e-983b-b05fa5e94916", "value": 32344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350455, "uuid": "9277e287-ad5e-4aa8-a4fb-aec714adfe6d", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350455, "uuid": "8871d938-e3fc-4b87-8cd0-939f657582fc", "value": "7c5b5dee4e0575f1d6d408b20aaf6813f69fe5b6e2b27369fe6ce42ad315a5bf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6024f6f9-d5ef-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765388453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388453, "uuid": "75ac2db0-8564-4e07-b045-28e2c64fe555", "comment": "Malware payload (MaksRAT)", "value": "40850ec322fb1e28e38cb431c6a0654d", "object_relation": "md5", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388453, "uuid": "8f718f05-b34f-4be1-83b1-1115f9f7440b", "comment": "Malware payload (MaksRAT)", "value": "7dc3df1a3ed26b6465e222f59c6b092c665b583aadd10fe2f75c790e3570d007", "object_relation": "sha256", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388453, "uuid": "28acc37e-c252-4b80-8ada-1f54879814c0", "comment": "Malware payload (MaksRAT)", "value": "30f4024c240e229f7cd41faf5c2d6cd9c9f6236d", "object_relation": "sha1", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388453, "uuid": "3a1fdb63-f9c0-499f-b6b0-e34b6fd623af", "comment": "Malware payload (MaksRAT)", "value": "b85966465d1ce30bd1b9875a925fe026edd810fd9ee3b37efe25169ceffcdd986975efae42a4c67889c426d0096f040a", "object_relation": "sha3-384", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388453, "uuid": "8caf438b-d0bd-4299-a3db-437f6a5ecf65", "value": "T12CE2E11DED76DDA1E43A3270ECADDC1AE120E41C161EF477EA72689247EA005CF8358A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388453, "uuid": "b75e19ec-5425-41e1-9f6c-b09f9753184c", "value": "768:L4u6gdsONKCosuEbUwdW3GPmGyNSqYFxD5V:LZkzsuEtc3GlywP5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765388453, "uuid": "d1bcffbf-7692-437d-a217-a5c23b2191f8", "value": 32114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765388453, "uuid": "d78510f3-de01-48d8-8889-e60a617bd7ff", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388453, "uuid": "815113c7-ea88-450f-839d-eb90052a59c9", "value": "7dc3df1a3ed26b6465e222f59c6b092c665b583aadd10fe2f75c790e3570d007.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99cc681-d561-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765327722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765327722, "uuid": "80d062c0-f779-4ad0-a32e-6c918175c5dc", "comment": "Malware payload", "value": "1e4278cbe9a5d51c2e382f37a8cd402b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765327722, "uuid": "1e5e11d3-2b22-4a87-80cb-a43f56e400d6", "comment": "Malware payload", "value": "7dce3a66020b720476ffc8b6fd5b5d59256186c8c54e56ff5b1f93b24130834c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765327722, "uuid": "dd8d58bc-0295-428b-a562-f2ad793af93d", "comment": "Malware payload", "value": "800562e54eeeb369eb9296d1d59b1d299ee8e845", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765327722, "uuid": "a7515386-0eba-40e1-8793-c497179517c3", "comment": "Malware payload", "value": "6eff5598f0761239b99fb1e69bca7700a979126ae46bc0260b9d591c237440a193c013fa8dc15f25d8e73f3458abd91b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765327722, "uuid": "a793354f-c450-489d-9185-c17083888b61", "value": "T1450633977AD021BBC004DE708FC459078E60BE6BD65F47DA3C0366E998E7CD8B929D09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765327722, "uuid": "a5ac2d21-208e-4887-a07e-dc2b04e6f0fd", "value": "7bc8e644e89bb9df12b84ba824e5c5b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765327722, "uuid": "9bb71981-5c99-459e-9235-aa55d81cad60", "value": "98304:bEl2pk7yy/HqLPipZkSjCnlc9kA0Hr4KBw9EG5J2LR:nayoK+pZxulq0HrTB5eJ2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765327722, "uuid": "06779c52-a726-4567-9e53-a5c9603c0398", "value": 3859456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765327722, "uuid": "317477eb-ae52-4d29-953b-030d0ca0ffc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765327722, "uuid": "ab6cfc23-4c0b-4ca7-9b48-41ec30d751c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6ac5a4-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765345145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345145, "uuid": "48076e06-8170-4ed4-b255-38401d6760dd", "comment": "Malware payload", "value": "745f8a0e516047eb9b075e565fa03f5e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345145, "uuid": "5f8a0166-b750-40a7-af3a-1cb34db8697d", "comment": "Malware payload", "value": "7dcf50088278f801969ebbcdb6166fe78efcef01df503286263e547ed7e94e69", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345145, "uuid": "573004b7-1503-4961-a6fc-4001ba1f51c9", "comment": "Malware payload", "value": "357c618553fdac698c39bbd93665cce2aedad2f1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345145, "uuid": "554a7b94-74c8-4e6f-aa44-c3362122795e", "comment": "Malware payload", "value": "0945c89e4b0239f160a88879c2a35b5ae681026067db59b78697984f55a1e2dc7d1e1f7c2f84a3ee080592aeb5eac51e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345145, "uuid": "5e82035d-41a4-4ff6-94c0-25d9b85857d8", "value": "T15AB5030481ED68A9DDA3766C5F1282E2E75DBCCA140E464FBC1CDED45B711DC02B081F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345145, "uuid": "164a74c9-0a32-453f-b2a9-801f7a39ca87", "value": "384:/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXa:p9bC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345145, "uuid": "69af7f96-8a05-47d2-931b-c566f8663e5a", "value": 2348060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345145, "uuid": "690a793b-96d9-4ee3-ba45-269a0a5907fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345145, "uuid": "e9ee423c-489b-4b7c-9124-1c430cbda20d", "value": "RFQ - RTA ROW NOCs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1669d7ac-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350104, "uuid": "643b0321-711a-4f07-a2da-fdeaedf669fe", "comment": "Malware payload (MaksRAT)", "value": "e0c3cde675cbe1bcff6f5da03883e855", "object_relation": "md5", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350104, "uuid": "07c4fd08-7187-40de-8a85-c686ccd06945", "comment": "Malware payload (MaksRAT)", "value": "7ead0827fef50aae62f6d60e45769b55b2df365c966ddda4b6427cb3a0ddb462", "object_relation": "sha256", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350104, "uuid": "de1814ca-8ffe-4be9-a539-26aa80fffe3c", "comment": "Malware payload (MaksRAT)", "value": "d700fce5a9b2fa8c5b3b370bc694f786da14287f", "object_relation": "sha1", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350104, "uuid": "1e3320d2-fba3-4ea0-a32c-ac28abc9d161", "comment": "Malware payload (MaksRAT)", "value": "9e663c39d06281a0cfb8eae1de6392df09fa8db83ce71694b1c09d077c9351cc9ab4463f7dc97f13a163ca12a7eb643d", "object_relation": "sha3-384", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350104, "uuid": "98049699-ce51-40ab-8d9a-f7c172f6718b", "value": "T171E2E1DD2DAA8888EAF28C35E05DA17257FFA468A64F13058BCDCDB60C355611747C93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350104, "uuid": "12d4d8e6-0ab4-425d-a629-ffcd39e5359c", "value": "768:3W0xIeRyBuupSaLFCx1Ozchrb3yeDzjMD3y0daCJ:3WOIBuuwhHochrdDQ8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350104, "uuid": "0f741740-b6cf-4a6b-8b71-88d725de1b4f", "value": 32382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350104, "uuid": "46547766-f2fe-47cd-9756-9ccea515709d", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350104, "uuid": "4e4ce292-9669-4b38-9b9f-e993b0818904", "value": "7ead0827fef50aae62f6d60e45769b55b2df365c966ddda4b6427cb3a0ddb462.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9344e7-d5ef-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765388447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388447, "uuid": "36b81a23-082a-4d1f-9925-3a3b55edda55", "comment": "Malware payload (MaksRAT)", "value": "9f78ce79bbdca789a79ea9106d62a8a0", "object_relation": "md5", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388447, "uuid": "7e03a248-a36a-4d05-b246-a296e46d461a", "comment": "Malware payload (MaksRAT)", "value": "7f1312afbe3592f8246d68b454a4d158e454d0f92757220a6506a76a7afd8b53", "object_relation": "sha256", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388447, "uuid": "14693f3f-ca6b-42de-8ae7-0dbc9b4bba7b", "comment": "Malware payload (MaksRAT)", "value": "bbef1a6f30f35f27ce34b53ff5ba1a804c4e1015", "object_relation": "sha1", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388447, "uuid": "1ca69276-2542-4651-9c94-92f0c8011497", "comment": "Malware payload (MaksRAT)", "value": "afe02d76c46fb6b8c0cde4080064e1e8806251d3d3110cd10e252042cf13f78394729c5bae3e2b104345f746a8a3d4c0", "object_relation": "sha3-384", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388447, "uuid": "085b7379-c092-4d00-a16a-c55e1be6f7ee", "value": "T1EFE2F18D7EAED46DD88CED3CE25500DD4CA1CEB18B9A8DC961D920E50D437858AEBCC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388447, "uuid": "43bbfb78-36bb-44c8-a5e5-a5b612fe5f7a", "value": "768:h5dTQs76JZidRgAR/WPBrTH8i3A34WXUkqqJOtzfg4KXB+o99gmlEf:hTTQs7iidmAxIBrTHZ3Y4WXUkqqJO5g4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765388447, "uuid": "aca31167-004c-40e3-b119-f235fe64dcce", "value": 32415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765388447, "uuid": "68278c62-2e30-4996-a5a2-609ce6aac325", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388447, "uuid": "6513b70c-b3a6-4efc-ad0b-0ff3ab7d9d70", "value": "7f1312afbe3592f8246d68b454a4d158e454d0f92757220a6506a76a7afd8b53.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d67d88c-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765345177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345177, "uuid": "7fc5c73e-dbb6-4e33-8ef1-955628578b40", "comment": "Malware payload", "value": "8781b206788903569154e6de7f21dd3a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345177, "uuid": "5418e70f-f788-4160-8d95-a9ad98ae1877", "comment": "Malware payload", "value": "7f3e28391f4ab42ba7a4a5f02645c1c02a7b7a0b3023c4b6328e95ef4b3518af", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345177, "uuid": "a789c2a1-7b1f-41f2-abb9-47f459ace2c1", "comment": "Malware payload", "value": "03e5c79c5fc2cb3b1a682b3decd9f3ace85ba4fe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345177, "uuid": "b751334f-3d87-4203-b8fb-eb4713b3c279", "comment": "Malware payload", "value": "aeb71ebb4a9f3e24bf35bed75ebed3a47ffc4f97b82ff44247b1fc1e1ce69fa36f302c1b6dc3fc570063fcab65575839", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345177, "uuid": "8d12f782-7b40-46e3-9be1-b496639f5f24", "value": "T155042F5162D078A933871EB7771FF4E5FD7B09A83949044BD219FD90A1B8B0AECE1632", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345177, "uuid": "e2e0a66f-c95b-4776-a4f6-f94eb77488c4", "value": "3072:fNmnQXbc+vWJul8o6ctSHjcvbkPNMYC/pFT:fUQXbc+Pl8HjcvQCV/pFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345177, "uuid": "7f3ac94e-f96b-48ef-b7ea-3c202cca4b2b", "value": 174630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345177, "uuid": "341a7407-decf-4c4e-8308-0af488592a1c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345177, "uuid": "38a757e6-4ef0-4a9f-b1ac-df28ee78c12a", "value": "T2900W.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d9c97f-d5a7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765357492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357492, "uuid": "6444f635-4e9a-4769-a1fb-10433569267f", "comment": "Malware payload", "value": "ce4e5b5322a812d2666acc45f9c73262", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357492, "uuid": "1556eaf1-1149-4094-a0fa-22fb4760120c", "comment": "Malware payload", "value": "7fb6a78ce0ef50bd9a6e36df081af52b353fa36b946b23c7461b9db59d2d2837", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357492, "uuid": "7f976e1a-93dd-4051-97ff-3e89149cce07", "comment": "Malware payload", "value": "86de73fa564d73da675abf47376d3c486cd1894f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357492, "uuid": "a664c913-b947-4f52-b261-e8a8c7b1c6ff", "comment": "Malware payload", "value": "627b4f8183083c8ed16dd3e605935208fa4270ec25b6c55b151619eb9226cf1cac3e1c03184e1c65706a379065cf4d41", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357492, "uuid": "23e41f75-edae-48e0-aacc-7f5a0cde0094", "value": "T168C6124AF309985EE8F352373D76436265135C268F03C687A921B63C6EB76E04F1EB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357492, "uuid": "1d22479c-28f6-4560-a343-7711bbb0eff7", "value": "196608:Nno/7g+fLa8Tc0sWoq5tV/iE802XIFT/cnUQBe1nM7Kvu9/q2urIkh0swn7o7aeQ:Ns7r/I0Qq5tQs2XI9/cUg0S19/vurIkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765357492, "uuid": "deb24782-aa20-463f-a53b-6f46e66bb870", "value": 12427186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765357492, "uuid": "f70cd299-a617-4c95-8e3b-58ec4a8180c8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357492, "uuid": "62872705-b956-4992-b337-b5a006ac5dd7", "value": "Rastreiolog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f67264-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1765345184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345184, "uuid": "ec7f5815-14de-423a-86c8-71d019051727", "comment": "Malware payload (PhantomStealer)", "value": "c8cabe5984b18a1448c85e83b651807e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345184, "uuid": "2c858e35-721d-4505-8507-876bd3524cff", "comment": "Malware payload (PhantomStealer)", "value": "7fea480fc0effe3b4698eb4dbe55d4832f8251091b152620cae281c2440f6460", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345184, "uuid": "8d67267f-d2ee-4309-b37e-b1246e74061c", "comment": "Malware payload (PhantomStealer)", "value": "0dede64f26123309de785e21e199d12aa5a1f462", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345184, "uuid": "7a3dc387-c7bd-4c7e-b958-7f589e76b043", "comment": "Malware payload (PhantomStealer)", "value": "890a1342165725bbc63ea414273ed52cf1b284960f17bde8c8c9ca35b07fe65cc220878315a4c9b5404ff48246f8e808", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345184, "uuid": "fe03c76f-1071-4d8c-bced-2455f69817e4", "value": "T15D1613940284BD16FBB9B9C58B545377F3180C8A9C525E2E706B89CA57F90A393FCF48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345184, "uuid": "d80795fe-8274-4d5a-a7ed-3a7af326762c", "value": "24:sNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNl:l57wKXWo4C4Yyutl6Ikb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345184, "uuid": "614e4c60-49ef-4eaf-8a15-1eeea0738db9", "value": 4154348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345184, "uuid": "fa7e3e3f-854a-412e-96e8-f357a7def311", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345184, "uuid": "bf0bbf8b-03ef-42f9-852d-4163d2c8f7bc", "value": "Paymnet_Advice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20241696-d600-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765395647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395647, "uuid": "2f317eca-96df-472b-866c-41803f517eb8", "comment": "Malware payload", "value": "3ea3b2aae56ee004d7e8d321c8b37543", "object_relation": "md5", "Tag": [ { "name": "185-121-234-211", "colour": "#ACF702", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395647, "uuid": "fc96d074-1b36-480c-a037-fae3366d441a", "comment": "Malware payload", "value": "8057668808e5529f8deabb384d51f5b914b1a2516dd1b03f6b1a3b99748fb808", "object_relation": "sha256", "Tag": [ { "name": "185-121-234-211", "colour": "#ACF702", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395647, "uuid": "3df8440c-524a-40c7-b863-9545283589ce", "comment": "Malware payload", "value": "a6dc2cd4948567c0dd7e32fc0420087a403cfc17", "object_relation": "sha1", "Tag": [ { "name": "185-121-234-211", "colour": "#ACF702", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395647, "uuid": "31502705-114e-4384-a1c9-bdbd3403682c", "comment": "Malware payload", "value": "a6d70f09d88243f5fb6ec271e7251f580c2756ff27db5f3c091bed8dd8e862573966650f7b01437178c2aebc37f85da1", "object_relation": "sha3-384", "Tag": [ { "name": "185-121-234-211", "colour": "#ACF702", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395647, "uuid": "f6d105df-42b6-4860-969e-fb422a5c7f48", "value": "T15B36220672E424F6E4B62374DDE206475633FC6027384AEF22C9CB7D8B27A90E931B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395647, "uuid": "92b2a2af-5ccd-497c-9534-9e5979ab687f", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395647, "uuid": "c16ca5e5-739a-469d-927d-07d9cfd779b2", "value": "24576:AKyfJnHlRAQ7s4BDxbApZMZxczQ2dqGY5zUFBSCQXRM:ifdfrs+bAmczQ2dq8rSC42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765395647, "uuid": "1e86332a-4f53-4484-943a-a10aaeda284c", "value": 5221377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765395647, "uuid": "e59acdca-7216-477c-ac35-1a2cc33967bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395647, "uuid": "288a7238-1c18-4655-a2f2-e5316839892e", "value": "activate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569b1931-d5ef-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765388437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388437, "uuid": "3818642e-02a5-42d3-a8af-7322413000e0", "comment": "Malware payload (MaksRAT)", "value": "160138f079e19402402d441a3600010e", "object_relation": "md5", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388437, "uuid": "489fd426-7ce1-4030-9469-57bc5103ea44", "comment": "Malware payload (MaksRAT)", "value": "80affcb85f58ddbbb4d884d452d4697b34cb6da35289b13ebff5b6f83a81442d", "object_relation": "sha256", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388437, "uuid": "a0da1850-2f9f-4842-b3fc-bb180c03ef0f", "comment": "Malware payload (MaksRAT)", "value": "f750d481c72400a60ea77d175d051d9ea34eb4ea", "object_relation": "sha1", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388437, "uuid": "94cc02ff-7dfd-4906-a46c-64aa3d68c510", "comment": "Malware payload (MaksRAT)", "value": "545105430084290cffc0feb5cf2beea463694f6390c01fecd4fa6ac880588f452cd88949b1841513a7e2c897a3735c5a", "object_relation": "sha3-384", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388437, "uuid": "435dc8f9-c9c7-4d67-bcf9-621817b9ec56", "value": "T1DDE2F14333D3EF7DEB7CAAF2628A3283424430A44B26F07FD9A74D3657851630C5A228", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388437, "uuid": "dedc1cbd-d0fe-4078-a501-710ba6871b36", "value": "768:1M14uh4n6ya3xmjQM44AKjAa9o8WJTbuBva50XOL44J:1Mye3xDM44NYjJTCS5FLlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765388437, "uuid": "c772f1ba-b7df-4311-b450-53c74a77b989", "value": 33032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765388437, "uuid": "3d62b082-84bb-459b-b965-bd31e4b07007", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388437, "uuid": "59a1966b-7d6e-44d9-8cfa-1e211d2622e4", "value": "80affcb85f58ddbbb4d884d452d4697b34cb6da35289b13ebff5b6f83a81442d.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b31159-d600-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765395633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395633, "uuid": "86da0b76-f122-497e-b08c-923843aff510", "comment": "Malware payload", "value": "7b43a9c1a9d12355b23ffabba6d5dd71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395633, "uuid": "a7a2534d-36b8-4c04-885b-14b1cf176c02", "comment": "Malware payload", "value": "8115a9afea28efa0fb8c8ae58b7449444b975fe8cc80dbebf19067ab8d0c5c23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395633, "uuid": "7e1b3210-6917-41e3-bedf-045ba6bd8b2b", "comment": "Malware payload", "value": "eee1748fa3b264e9ec3ab26fffd5b65cb0b6a3c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395633, "uuid": "16fe2b1b-a50e-4b04-b05e-d3d7034385bd", "comment": "Malware payload", "value": "4cd9a93496ad607519a55d1585c2b07aa9fdef8c445a279bfa0443786e62dea761322df64da811540dd022cd78fc8493", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395633, "uuid": "d395dc56-c873-4bf0-a750-ab9edd1a90ea", "value": "T1D5D41963F46892F6C7B86132F147E63F2A0BDE6166018541B3F13F9E3AB6A651710B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395633, "uuid": "1000b5db-a275-4dfa-a538-256519ec59eb", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395633, "uuid": "b02444ed-e4c6-4fb7-933c-ad925e011e22", "value": "3072:kEre7GjyCaFvc2a/GFGtmDggggquWbPvZmggg7gfg8Zyac+VvE9hVPqB:kPXBMdGABhVCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765395633, "uuid": "0031a2d6-946d-42b7-b5db-b12ef38c28ea", "value": 607752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765395633, "uuid": "6f40f8c3-c628-4f8a-b0f1-fb71d5205e8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395633, "uuid": "2280577f-dd08-49c6-a9a8-68fddd25da15", "value": "dbz6ey.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e91f8f-d61f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765409312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409312, "uuid": "dc4ebf24-0bbc-4b9e-b6f7-2fa9bef7c316", "comment": "Malware payload", "value": "c043362c95eb02e45a68ae00d609aac7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409312, "uuid": "cb5557a6-38b6-4518-87c3-77760dd1d62a", "comment": "Malware payload", "value": "8167963f03012b1397c4a0af5813f05d14663e4437943fe4b0d9104fd1519821", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409312, "uuid": "922ea31d-9c8a-4b4c-9fe5-a21ef390a5ad", "comment": "Malware payload", "value": "d852ed357ed8acd21e8b5a1d6381876851bc8faf", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409312, "uuid": "543062d1-0814-4de7-b6a4-4d4f1e3891c4", "comment": "Malware payload", "value": "6316288661574deb348f9415c2f33e18712b88958108d1a6d45b1d198064ebfabec4adb309df921bcd855d6747398502", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765409312, "uuid": "cacbd115-b7ea-4d9a-879f-6592a8951acd", "value": "T1D8536DBB81538EEED906F5730B3F84FA99D84F6243204F6A6C48A90E11354577F887DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765409312, "uuid": "653805e4-7e8d-4ddf-951a-1bda554f045a", "value": "768:yYLy9iKk7B7/vpOKF4LTG0yL9BF774Z2oC9n4fGJ88ylwFalJYt:yH9iKk7pkKF4nEHZ43C94eJ88hIlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765409312, "uuid": "42e820f6-adaa-4139-8be0-5c3c299b8905", "value": 61945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765409312, "uuid": "55ca95c1-50bf-427d-9ff5-c6684f297619", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765409312, "uuid": "5a619752-5a00-43e0-bd18-48c11db1b930", "value": "Riservatezza_EDEKA_IT.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e3ed6ea-d5f1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765389309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765389309, "uuid": "a34d3e2f-267d-4f56-809f-76e4d831e0bf", "comment": "Malware payload", "value": "3f7ee2027543a9452a41b9c1968e5105", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765389309, "uuid": "d0752bfe-9448-4897-8331-ff954196b30e", "comment": "Malware payload", "value": "81b40952955a000d73cf1393e83ecccc338a7f84277224ba9cb63210ac3a1e78", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765389309, "uuid": "3734e5a3-dfa8-46bc-b0cb-ef060919f9f6", "comment": "Malware payload", "value": "4b629cb3b0a8dbb8caa5bf29d18bf5a1744fb8d9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765389309, "uuid": "a16c6775-2b00-47f2-94cd-437170d80bb0", "comment": "Malware payload", "value": "18b7d9029883c8a5d12c1c2127ad7dd3c047d70fcfe91134eb0c1295454f1da40eca966996e35789aa5cf2757e7ca3a2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765389309, "uuid": "5e00c21e-92e5-4c4b-9be2-0281942101a1", "value": "T1F4C2D617665C065F62F4862AE60481F04B5FCBAF4196D119F6ECD22A1F0BACFA0F3592", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765389309, "uuid": "da20d7af-615c-4e3e-abaa-ea43937adfbd", "value": "384:f6uA6fJfjnQPVk6S67sqhulG/6KVOHUyb3z:3AWJ2l6qW3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765389309, "uuid": "c888cf9e-1dfd-483b-b51f-0bdf3feada66", "value": 27382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765389309, "uuid": "c3576889-8628-44b0-bb68-07bd53a84e6c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765389309, "uuid": "37d4a1e2-384a-4f78-bf71-eb668b7bf9bd", "value": "payload.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6237fed1-d5ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Rekoobe)", "timestamp": 1765374283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374283, "uuid": "0a4255de-9ba8-4970-b327-e8a199e8f74b", "comment": "Malware payload (Rekoobe)", "value": "23decc99dfefb103db790227247563bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374283, "uuid": "84a9e87a-90a0-4c63-b967-c327439fbc94", "comment": "Malware payload (Rekoobe)", "value": "82335954bec84cbdd019cfa474f20f4274310a1477e03e34af7c62d15096fe0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374283, "uuid": "a7b6c3f6-8a4f-499c-85d3-9a95ca9af227", "comment": "Malware payload (Rekoobe)", "value": "86c82af9ff33fb2aa29a1d02aac55fdf583375bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374283, "uuid": "d453f379-731c-4791-bfc8-dd16427bd0e5", "comment": "Malware payload (Rekoobe)", "value": "a6cbcf35b78fb09a43fe5e1070295c87250ea4dcc125a9617e3ad3e334d349369b39f0713bf32dbb4bc0dd8c62ce7296", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374283, "uuid": "8a40d8bb-261e-400a-b166-de58c16a932b", "value": "T1B753290AEA47D1F1CC270971528BF56F6A753030ED2E9F13EBE40EA6CC13A416729792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374283, "uuid": "37fe8605-bf0d-43e0-bb85-4ddbacb2bbc7", "value": "1536:eRJoocGMbwZVFuE6gD+gv5HDJzlS4AKi:eRJrc+1VVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765374283, "uuid": "48622c85-cfb3-4bf1-9c52-db4b691f86b2", "value": 64456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765374283, "uuid": "6b0cc004-ad25-47a4-8234-13df0e936437", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374283, "uuid": "49f3da4f-6e76-4d46-a8d0-f95b42736e1a", "value": "sshd32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370f79a7-d59e-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765353595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765353595, "uuid": "021b38ea-9f05-4e85-a809-4f84eb69ca84", "comment": "Malware payload (AgentTesla)", "value": "742b30c737aaeb6f953f9e77307eb626", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765353595, "uuid": "9c8f1af6-c429-44e6-a972-4f3fb256175e", "comment": "Malware payload (AgentTesla)", "value": "83018cb8f2ee7ef80a1d1ad27459e98998e52d5ee148b816d0c3a44bdcabfc90", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765353595, "uuid": "93f79f14-d821-43ac-bd6f-72ce9d90c52c", "comment": "Malware payload (AgentTesla)", "value": "619a2821af487c977a37491c8a4411f9cd54caf2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765353595, "uuid": "5fab3db1-646e-499b-91d0-6e8d4d3e2663", "comment": "Malware payload (AgentTesla)", "value": "4489cf5fb750d9b93723be31de61abb5fb3635771ed94ca6775062525e825c9e1537b198e1f285cb633f7cfbbcfce8ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765353595, "uuid": "1b9c3d64-8b88-49ca-b99e-ddfcfbd1d926", "value": "T160E4232536D1D237ED8646322C878AF986E89DC565151A4FFBE03E24FD326231B042EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765353595, "uuid": "508d098f-d44c-4728-8944-b82d1875589c", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765353595, "uuid": "be73e8dc-1a14-44ef-9ea8-e38e8e229c50", "value": "12288:CGhUY/UEKoiJAHFt8smjVfZMcHBXLOYGJNvipWoRm2W6ag2w1AqXEYfff:CGriJ0DmTM68dJhipHtW6amAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765353595, "uuid": "28f32d1b-a835-449b-8d99-1f102163a0a8", "value": 670432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765353595, "uuid": "21aa842a-619f-4d48-92a4-ec5ec989a3a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765353595, "uuid": "67ad3ab6-fe6c-4137-81ea-0d4cd463e46e", "value": "Proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375682b7-d56e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765332980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332980, "uuid": "ddb4699d-1b8b-496d-9e90-095a2c3d4039", "comment": "Malware payload (Mirai)", "value": "3f5ebfabe5eb2ae1765ad9a0de7ab682", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332980, "uuid": "51d6b4e4-92c0-458d-bd8b-26176c2aaafc", "comment": "Malware payload (Mirai)", "value": "8314c1d1bfbb360884714aff6e7e27864e83094093273e67cf0b3d03f891880a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332980, "uuid": "867d850f-93b4-4bf7-97a7-8ab251f04ea2", "comment": "Malware payload (Mirai)", "value": "0fd50b37840ac4913fc7880cac145c2f3ed19960", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332980, "uuid": "a9d9c43c-99f9-4acc-b1d6-840ed5aeb157", "comment": "Malware payload (Mirai)", "value": "600b0fe27e0461d8b6ec5ef8c35746323c3ea8a7eb03fb7e1f2e738402ff9ead3a225cc6afb9f6a196d784497992e5a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765332980, "uuid": "c379311b-ac11-42d2-897f-28526b6b76dc", "value": "T17CD3F945FD809B12C6D225BBFB4E428D7B2A1758D3EE72039E256F35378B85B0E3A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765332980, "uuid": "a36112f2-264b-47a3-a50c-33a20ab05565", "value": "1536:S9ojnvfrWq/i+iu6yWn4run6eEr7Ynj6RNrHHDZDOkg5mhpIzfcLCdlkiwywT2IZ:PjXrP/i++Jn4ruWa+RNLDrXGfCTwEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765332980, "uuid": "6c718bce-e7f4-469c-adaf-129d3d1d9570", "value": 130984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765332980, "uuid": "6a80db1c-dd4e-489d-ba7f-8a8f4f1daa5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765332980, "uuid": "33acad19-4f3b-4484-b7d6-03289662c1a9", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ffd500-d5de-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765381237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765381237, "uuid": "0279b84b-ba02-4e55-9ced-62e76b5e070b", "comment": "Malware payload (AgentTesla)", "value": "84d82639aa0891e1fdbcb3fdd3157496", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765381237, "uuid": "0b531215-c841-40d2-b232-e6838fb915c3", "comment": "Malware payload (AgentTesla)", "value": "83a66ebda837bfa52232a03128d32dc773f827fcf20c5696e54a6077293b8a41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765381237, "uuid": "b6166a41-9af2-4c4d-bf35-c6be4632eb5d", "comment": "Malware payload (AgentTesla)", "value": "44aeaa360be25e06e67268d5c610d422c390dd03", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765381237, "uuid": "d90f10a8-aae0-40f2-b415-789ea40132bc", "comment": "Malware payload (AgentTesla)", "value": "29c2af4f8b161b0489edf736e955a283a103cfbf39704293758df425026758698c2285d9d304caf04c05429ea76ef852", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765381237, "uuid": "c642c68c-0dfe-4243-bb8a-8bfd566d557a", "value": "T1C345BF0273D1C066FFAB91334F5AF6115ABC79260123A62F13981DBABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765381237, "uuid": "80c1d5f6-dfc9-4693-8132-8574223fb50a", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765381237, "uuid": "2e304196-a77d-4ece-8035-ba10fd94917f", "value": "24576:J5EmXFtKaL4/oFe5T9yyXYfP1MAXDzGIXm2+chTRylvqnu:JPVt/LZeJbInGizGCm2LTYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765381237, "uuid": "12d983bb-bd44-4034-9936-7a5661099010", "value": 1241600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765381237, "uuid": "a0446d42-5264-409b-b62b-cd89a3c47ed3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765381237, "uuid": "39b4e09f-667e-473b-b5aa-bd241dbef08d", "value": "ITT-QT2025DMT029.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ba119d-d562-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765328152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328152, "uuid": "d3d8123f-9d8e-412d-ab8c-3fbea2f1bf53", "comment": "Malware payload (Mirai)", "value": "a7b8c324d9516811637fc39348f91c5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328152, "uuid": "02e0cbea-c801-499d-9908-68d3527456b2", "comment": "Malware payload (Mirai)", "value": "848833cb1e3273d305cb532934f2582495d3d7814edbc1bd5655bc9e06e333b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328152, "uuid": "19eaa1b0-5a6a-4531-9ede-d30eb076df09", "comment": "Malware payload (Mirai)", "value": "69cb21743add0649965c6bff073cec637621d0ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328152, "uuid": "55a54950-0a46-4487-9c70-8f622c5bc021", "comment": "Malware payload (Mirai)", "value": "ef648f862c316763f8913754b3723e02702df22d253008f90029e7a430e7fc54521710a5d817999f3b2ba6d9aa496f13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328152, "uuid": "efa29ba5-0c17-4eb0-9a54-0a946c923ccb", "value": "T16BB35D05B3680A53E1A71EB0393F37E587FAEAD122F0F689251E9B454275E371086ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328152, "uuid": "de298657-967a-4af6-934f-0d45c3f1b100", "value": "1536:kUUqPdsu1sFVsLHOxdxPSG3Nk08EVg8B1WtTy7Zg8l5AqI4ss/:k12cVsoPrG+g8itqEn4ss/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765328152, "uuid": "e564b88f-710b-41bd-baab-1d067385b639", "value": 113508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765328152, "uuid": "4509158b-18ac-4ac4-95f7-aa129fd437cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328152, "uuid": "f98e4bb5-9cb5-42ee-beed-68a9fd280a5c", "value": "colonna.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1333c8f4-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350099, "uuid": "673be3f4-02ed-46e8-adc2-a8fb3fd51726", "comment": "Malware payload (MaksRAT)", "value": "5887bdf27c50d11859743ee878fbf8f0", "object_relation": "md5", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350099, "uuid": "15ec2724-0202-4a3a-98b0-5b6b69c5a1bb", "comment": "Malware payload (MaksRAT)", "value": "854f4180e2e03bc05e2d09823acb2a70c7d09f394c729156d495bf21532fdd7b", "object_relation": "sha256", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350099, "uuid": "8f16d997-491f-4b48-ad1b-96294fd4a302", "comment": "Malware payload (MaksRAT)", "value": "e7a62549aa057c762c13c2a0c2eacc047d0e881d", "object_relation": "sha1", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350099, "uuid": "4085eca6-50c3-4ccb-ade7-52278a1da07e", "comment": "Malware payload (MaksRAT)", "value": "e911a221c647a8a06a330cd7f09cb3fbe8ede7e826d1a1487098df90a338c515e23573c0d7412ad7190d262b0f4b2746", "object_relation": "sha3-384", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350099, "uuid": "ef1267f1-1552-4e14-91a1-57046b9ed306", "value": "T1CC37122AFED4E029E96787FB8C81C592F42D1C98D44BD01F03A849899A74D4A1B53FFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350099, "uuid": "641895c6-a96f-49c0-8093-6facc8f82b3a", "value": "393216:8OQvlRYuQ7u0DljhWUucTw1epiM+zkLsSCpIspNoaAKF3T5NO0m8WSN4L:2YuQ7hljh99WTx2M5AKlevL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350099, "uuid": "605fd1c2-a316-4db5-b410-3cea3e850c31", "value": 22702582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350099, "uuid": "dc2284bf-c386-4d83-a781-d443eafb4c02", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350099, "uuid": "00208b7b-6add-472e-9069-10169a0dec5f", "value": "854f4180e2e03bc05e2d09823acb2a70c7d09f394c729156d495bf21532fdd7b.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53253bdd-d61b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765407329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407329, "uuid": "5cb41f40-2d48-42ac-8500-1a5f47540ee7", "comment": "Malware payload (Mirai)", "value": "169203e195b1dbc894ff4a36168cad66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407329, "uuid": "d4e147c3-2057-43ff-a059-ea91812bf7b1", "comment": "Malware payload (Mirai)", "value": "85a67c925e841def6cdfe301693ce8fd17f39978eb7a99faf6288bd9d99c8356", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407329, "uuid": "d200c517-5459-40a9-aff1-d78070f369e1", "comment": "Malware payload (Mirai)", "value": "9dcfb6291938f9cda9047e48e8b3173998490ee4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407329, "uuid": "98b667b7-f6da-45d4-9166-81c7e761b35b", "comment": "Malware payload (Mirai)", "value": "396757f5be061514e859d891dce4e0b60627ec9c574c9c3c4ae2652ad4a1bc83cc4b15e1aa2b752a2e2a68030e360a5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407329, "uuid": "58c60be7-b469-4fcb-9709-ee67ad5c1954", "value": "T1FD93F686F8819B15D5D922BAFE1E518D331357BCE3EF72029D105F14778A92B0E7BA02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407329, "uuid": "7e53626f-33c3-48ec-b7e4-819212d18ed8", "value": "1536:K5nReUBA7gy377daTm79Jhsl7zs9/j12S0GY9yDyArTphU2jGlG9lozifCG/6RTW:pUa7rITDG/H0x9yGArTphU2jkiCGyRT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765407329, "uuid": "01ad1e1b-93a2-4f3b-9e84-647bc3a74fae", "value": 89444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765407329, "uuid": "ea12285c-f1f6-4ff0-8c51-98d019742d01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407329, "uuid": "bb81a07d-39cc-4e7c-bf30-71f42b0d3405", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ccdeb8-d5ef-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765388431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388431, "uuid": "e5200726-fb17-4512-957c-6acf8bae9a62", "comment": "Malware payload (MaksRAT)", "value": "3e93ea537c666c28873a45b91127e5c2", "object_relation": "md5", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388431, "uuid": "020c23f3-a0ab-4771-ba99-84f4af48184c", "comment": "Malware payload (MaksRAT)", "value": "86d03bbe5b77fd102f858b8da030139fd32aca07c3b1966283ba765913547ff5", "object_relation": "sha256", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388431, "uuid": "c3c47017-e4e9-4d3f-a266-22e3225e76c3", "comment": "Malware payload (MaksRAT)", "value": "67788de77f5d63ed4c310850eb9da254d95ca690", "object_relation": "sha1", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388431, "uuid": "880862ab-9631-4741-8baf-726f1c4bdf0e", "comment": "Malware payload (MaksRAT)", "value": "2646e3e9bf003eee4ee542076956fcc8551192c08d70a357d263cfef8aaf388e995af6f45ed71980e212c1c8e193f2d5", "object_relation": "sha3-384", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388431, "uuid": "e3fd84e9-eaa0-4af2-935d-22227fd1c320", "value": "T1C8E2E106CAF1E92CD547D0FDC3A472837B6C056FAD7986C9D0D8DA8836B8A01D90D8CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388431, "uuid": "01e33dee-851b-4301-8156-ae6c250ce1ba", "value": "768:a/LBmthcaoUsBLRN2We1LxQVDyzxrVb65+1YExk5PzvA:4Qhc6gY1FTznbbYES1vA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765388431, "uuid": "e8c2a491-7ded-4780-aa8d-dd4e45222ce5", "value": 32387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765388431, "uuid": "57acade7-90b0-4d7a-845d-281135a391ba", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388431, "uuid": "49d4297c-9ea8-48b8-8281-fd3a1c09146f", "value": "86d03bbe5b77fd102f858b8da030139fd32aca07c3b1966283ba765913547ff5.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d3ed6a-d598-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350984, "uuid": "4514cc6f-d1af-4217-b695-fed93a0cfa03", "comment": "Malware payload (MaksRAT)", "value": "ba27cc6aa56bf3dec8d3f2e3d326b364", "object_relation": "md5", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350984, "uuid": "78ebb5dc-0e3c-47b8-8990-3d4bdde6b969", "comment": "Malware payload (MaksRAT)", "value": "8707f4dcbbbb63e67f87d11778c639cd76716a490e77b9a043833e72c1dca31d", "object_relation": "sha256", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350984, "uuid": "42255175-d46b-4e83-b8c9-607c4704f8d8", "comment": "Malware payload (MaksRAT)", "value": "836fd48cd3c325776a0a50a035350711abab6f04", "object_relation": "sha1", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350984, "uuid": "fda7bbe6-a321-4aa3-894e-97358cdd0db1", "comment": "Malware payload (MaksRAT)", "value": "229914744e2c259aca9eb3e429b138c586ca2d902ed6d69763604f883ba407ce4ae3684630a92b0c993842e5eba3045e", "object_relation": "sha3-384", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350984, "uuid": "8f23540e-6dcd-47d1-aff4-35454a03dc35", "value": "T177F2E16ADAA0CA43FD5F297E6057D737F410457212A17A03532B70BBBE36500E8935FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350984, "uuid": "f1449cd0-fae5-4a3d-95cd-875949d0a4d8", "value": "768:5+bGmln/irVkNzvyy+QJOjT/TCte4umvZ/HpnGnP43Vbkv:5AZuuNRs/TCUrE/y43VAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350984, "uuid": "9520cffb-a31d-44c9-9a29-530115e3922b", "value": 34847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350984, "uuid": "6913ffd4-3553-4160-9262-d871cce951a3", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350984, "uuid": "afda96ad-b0f4-4f63-a792-a66d63c8a686", "value": "8707f4dcbbbb63e67f87d11778c639cd76716a490e77b9a043833e72c1dca31d.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efb3c90-d589-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765344508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344508, "uuid": "f86c2f86-4c5e-4497-b587-4c46f6af2706", "comment": "Malware payload (Mirai)", "value": "ba117deddb8dbe6da31b9af6da6890e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344508, "uuid": "81442ca9-dc51-4fdf-b6f0-a83eadfc9fcb", "comment": "Malware payload (Mirai)", "value": "8777f01d9ae6256c3a2feef7e8970672ac7ebd4536c1df5cbd31a6dab1f750d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344508, "uuid": "b411b42d-d9c7-4f85-9fd2-f7a233c0fda7", "comment": "Malware payload (Mirai)", "value": "72f8597101778d95f6d71e2a3098ceb7aa5556e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344508, "uuid": "55201070-5265-47bd-bb0f-685e46d5fd29", "comment": "Malware payload (Mirai)", "value": "1c937a2bd3929844a123fff9ed671b11b43372d707e554f153b8ca6398b096aa1e008de6c04c7e44330f06f9aa0a9e63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344508, "uuid": "cf00de0c-9ee3-4134-ac0b-88fb172d92db", "value": "T13BB35B85E683E4F6F9A301B2103B93665732D939A026EF16C76E2D31EC62550DB1B37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344508, "uuid": "e841bf9d-1ad2-477d-b6c1-7904c0803c2b", "value": "3072:3q/S2W9ZWwOPbmVv3gArq0NzhzgdOPwgQQ:aMvJ3lrq0Vhzgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765344508, "uuid": "19d6027d-0074-4e0e-9b92-fe5c3718f203", "value": 114532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765344508, "uuid": "c588c591-e671-4d7f-94c6-41d1423b67cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344508, "uuid": "916cafab-6f21-46cc-907e-b765c702227c", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c11d26-d5ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765395583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395583, "uuid": "e4512bf2-dc91-458a-b5d7-a9472339725e", "comment": "Malware payload", "value": "3a0f3886f274f80a6e8b2e6d96ee7e48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395583, "uuid": "4fb2449f-eea2-49e4-ad5a-280f65fe365b", "comment": "Malware payload", "value": "878be6ac74a05d768172bcc5a267f9803743599b472502ef160c438a30e5a4fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395583, "uuid": "acbf9fd8-712c-466e-8a57-9757a5065542", "comment": "Malware payload", "value": "42c88dd63a054dce426d9b46b22d1749802a7230", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395583, "uuid": "b8e2f369-cbfc-40b1-a054-059e974b360c", "comment": "Malware payload", "value": "1a6550efe7bb0d1891b1488905cf0d2d50398dca30302df8f8452a3866dc708f1e619b4839c89cd7b90f7e02819cdb94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395583, "uuid": "f6c4fc16-cb5f-493f-a1f1-ff6fd38c140e", "value": "T115F75B46A3EA04C5E9FB9A3489E65213D673BC063F3085DF324C176A1F736E09976722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395583, "uuid": "06a926c9-cd51-4cc9-8c21-d35442cc65aa", "value": "a0ed6f74434f534f1f822b062187f900", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395583, "uuid": "f75a4855-ea83-45e7-8e27-c1bbe55b5e75", "value": "393216:H1MVDcT2hfGTpBPCxEEB1demEz2nZnHMtunUIgcCW1G09zfyIbiPOmtP/yJyRgIk:HWhsLTlc7U/1tGExMVJvxOOxuv4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765395583, "uuid": "e3782ceb-f8e2-4178-84c9-5b454e5befec", "value": 76337670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765395583, "uuid": "20e23e77-1e25-4676-8e9d-f292e3df4543", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395583, "uuid": "2eb39219-91d1-4457-9b26-6d22a09bd1ca", "value": "ClickMe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf39a14a-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1765345260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345260, "uuid": "f8c06ac9-8d1a-46b6-87b1-6ae0d9f8cd17", "comment": "Malware payload (VIPKeylogger)", "value": "82c4763a9209380dd522e63f316a8493", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345260, "uuid": "e0d58e11-3cdf-4346-add4-802f47499c36", "comment": "Malware payload (VIPKeylogger)", "value": "87e1f494281dcbca37be740857148487baa4d8b44846abf95cf78be6148be69a", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345260, "uuid": "d31a10ec-d8d6-4e97-a6b0-1c0d6c0aa72b", "comment": "Malware payload (VIPKeylogger)", "value": "c175e3fdb5393bef0724f6624123a6b1afb73c2c", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345260, "uuid": "73e9f40c-2700-471b-abca-2d6d078be30e", "comment": "Malware payload (VIPKeylogger)", "value": "165c3b897846ee91a4794aa3afceb4bc607e3cbe48f17d071451d9bb35eb8061030934b2550734458e83485e0a42ad52", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345260, "uuid": "beafca7a-a348-4da9-a558-8430bc509408", "value": "T16DE371412BC9B4D0138B1B77772FF4E5ED6F89AC3449059BC61ABCA065B070BE6E1932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345260, "uuid": "b76b1a95-ae0a-4847-8d7f-d2decf2b4ccf", "value": "1536:4s+ak21ijTEZPacKxm99oCCu44OF71AN+VMcwaLvdus6f+X/lFTcj9XUoT2WC/TF:0ak2boChoYaMcwNf+X2U62J8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345260, "uuid": "49f9be79-a98b-40e4-a050-03f86da50c91", "value": 153689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345260, "uuid": "d617d26b-45cf-473b-8dcc-fc94c47c6f7c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345260, "uuid": "c832a573-234c-488d-90b2-0f95901e06e0", "value": "Teklif Talebi \u00d6zkarde\u015fler Makina Ticaret A\u015e -10-12-2025_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea166f7d-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350459, "uuid": "769a36ac-3e65-478f-a512-eef51187cd29", "comment": "Malware payload (MaksRAT)", "value": "37bdd9f5f2621037d05d456e05919b4b", "object_relation": "md5", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350459, "uuid": "1c7373af-d968-4d29-a501-c77ec5a36f77", "comment": "Malware payload (MaksRAT)", "value": "884fe38f1f87ffeea867d79f922800fdefb6856d99ec2c3022057fa670317a2a", "object_relation": "sha256", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350459, "uuid": "54ff4224-2c92-45e5-8074-e9bae1672572", "comment": "Malware payload (MaksRAT)", "value": "783384c4febd9a64b6f7c0216c3ed61cdcdb157a", "object_relation": "sha1", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350459, "uuid": "01e73146-368f-4c2c-8ead-77a3ac63c039", "comment": "Malware payload (MaksRAT)", "value": "db4018260214ef516731165fdbb8d24da9e6155a42f21d76de2d37e0361a889e2a46ac40600cb59c8c0dad9c38eecb17", "object_relation": "sha3-384", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350459, "uuid": "8e16d088-8b81-460b-8708-54c4b06d5340", "value": "T1D3E2F14D78B0F68AF33AC4D5852838DE22B7640F8BCA8398D442D8017B67C9FCD642D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350459, "uuid": "bd34aa7a-4748-4645-9211-4bbe2e94bd27", "value": "768:Y0yKkwFYH4M64JUldfFfyTmRr7sTZwvMnWSPAN5FHbuvAWdbI5yC:+KkLH44qB5yKrS9nw8RdOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350459, "uuid": "c7a8f463-6427-4009-8f6f-eb8755bcb69e", "value": 31816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350459, "uuid": "beaf500d-a622-4311-b124-ddc4921ae2ca", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350459, "uuid": "3ba2dce2-ddfa-4f21-ad20-0dec255eaf52", "value": "884fe38f1f87ffeea867d79f922800fdefb6856d99ec2c3022057fa670317a2a.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "656aa56c-d605-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765397911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397911, "uuid": "edc42d72-fb27-441e-b937-513704d859e7", "comment": "Malware payload (Mirai)", "value": "8a3231390997bf380d4370c05e316e2c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397911, "uuid": "e0010ed3-b754-4691-bca2-d1d210868803", "comment": "Malware payload (Mirai)", "value": "886635513c57cbfd93b2a3fc7e2ab13ed5cdd1c3057aa2d09e29a5c0f89c7446", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397911, "uuid": "edb0201a-2da7-478f-902a-a700b2b6c085", "comment": "Malware payload (Mirai)", "value": "e9a0b7c7e1ae66327315733a681c11581dac65e9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397911, "uuid": "4f5fc36a-df26-4c24-95a0-8f93591bf3d0", "comment": "Malware payload (Mirai)", "value": "c42d7d1231fb339fddfd92b09762a065fedd866101a3917b90c9ca674f42a928e800ac5fa583c7d95d33d736f626021d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397911, "uuid": "81acd055-4030-4d42-a948-37a7bf448efc", "value": "T1C5713FCF0295332CDC694F9A3277A044B0A8A5D686CB5A0DF69F26AD844DECC65015FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397911, "uuid": "f5db231c-84f3-4365-a792-fc792629498e", "value": "96:i/YtSFE/Z6voD/aXgbS/xiHQr/nQl3a9/jUt2J/+zsfG/c5OZI/Tk9mVL/gF6d8C:2YtSFEZ6voDaXgbmxiHQLnQJaxjUt2VB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397911, "uuid": "aec184d9-e902-477a-8d60-5c4b0ad88ea8", "value": 3644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397911, "uuid": "8f942fb3-13de-4d33-9cb5-ab834e56b5b8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397911, "uuid": "1c336306-a310-441e-ada3-ee5b76289fb6", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0873e2-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350092, "uuid": "0b768fee-6d3d-4d25-9fe9-fce4c2b15ef2", "comment": "Malware payload (MaksRAT)", "value": "0b5f3c6210ad9574d59da064170997e0", "object_relation": "md5", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350092, "uuid": "9613b295-c61b-4280-a5ad-cfa751b76e4b", "comment": "Malware payload (MaksRAT)", "value": "8874d92d0e7f53f5c2a030b0129e793adb3484dc2a4d1a621858f44a34e262cb", "object_relation": "sha256", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350092, "uuid": "2264a0f1-a05d-4860-895e-26263bf8b896", "comment": "Malware payload (MaksRAT)", "value": "b0adb3a65e10cfb710fb753be6f213fdc2dcef13", "object_relation": "sha1", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350092, "uuid": "b3d722e2-f59a-45b1-acb1-d3dae4c7ae7d", "comment": "Malware payload (MaksRAT)", "value": "2a063625bcd1af59668139013e23c5fefb33ee2bbc4726049ea491c76e55c0c939d181a0b725305399df24363f037e5b", "object_relation": "sha3-384", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350092, "uuid": "555c10a8-05f0-4a1f-9f39-2015c4c4be28", "value": "T12D37221AFEECD029ED1F457AA081C592ECAD1098D44BD2DF03A849C98A64C5A075FFFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350092, "uuid": "6921a8ea-1025-48a8-806b-c1db664d8067", "value": "393216:KkMF3c4JpMBz+pMPyzldaepy20zEL2aepSYpNgaAuN3/5nSOm8WeF46:j4QBz+pAaWDTQoBAu9e76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350092, "uuid": "ca2bdf6c-2c7e-4684-9c1e-7a68b991ff5d", "value": 22674390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350092, "uuid": "d91268ea-3db2-4e51-b9fd-a876f3f09d5c", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350092, "uuid": "bb638f1a-5950-4c14-b1a0-a866fb228f1f", "value": "8874d92d0e7f53f5c2a030b0129e793adb3484dc2a4d1a621858f44a34e262cb.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb392eb-d611-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765403265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765403265, "uuid": "ade61d1a-18c0-4036-91cc-4119e01e1bf1", "comment": "Malware payload (Mirai)", "value": "79c9571d32c1af7fbed2bd2d31b67004", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765403265, "uuid": "75ef7994-a44f-402f-a9e2-16abd6d4a74d", "comment": "Malware payload (Mirai)", "value": "88a3f58039fb3d3af3fd4758723739de08261b6b140872cb7969e282f3bcbfea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765403265, "uuid": "da8763a5-5608-4d8c-990f-0176c8d2f0ed", "comment": "Malware payload (Mirai)", "value": "f5cb5c8820170e8229ecb1c5f4df74f20229a0e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765403265, "uuid": "21588f9c-9359-43fe-a148-52bbbe8ed72d", "comment": "Malware payload (Mirai)", "value": "c4388be00231a240a5721557e61b6101f89f414a5aae8e6ce3635db70c6f4b6becbd15da35e1d376d96956db185f6483", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765403265, "uuid": "2129a821-a1f6-412a-8038-608736664ec3", "value": "T136439E76D42EACD4C58C12B4A8318AB56F03E100A6561FF79E87C5F59047EACFA4C7B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765403265, "uuid": "437ab7a8-3d5e-4ed5-be91-2413bc4f83fe", "value": "1536:baetwtqGz/ErlC/q4UOtZvIV0eWJWZZmawsV65zBUNkxZp6C8AT3bsR:bdnrWHAV0BA6oNkxZp6eT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765403265, "uuid": "b358f408-a368-46bd-b218-750100a6d63e", "value": 58616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765403265, "uuid": "61f7fc5a-c014-46da-86ab-3ee2a5b0391f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765403265, "uuid": "a34f6f3a-8cf6-4d14-b214-631c6f84d113", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d298e29a-d563-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765328516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328516, "uuid": "b4dd328f-c4b8-499c-a933-dc43788de519", "comment": "Malware payload (Mirai)", "value": "4bae1e3646105cbca92d2daf0da0eb3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328516, "uuid": "711f6e4c-071c-48c9-ad9a-faec0a733dc9", "comment": "Malware payload (Mirai)", "value": "8999160985516d1c8666124b957f7f87c7faaecf7d2b3af8d8688caa34b98e33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328516, "uuid": "e1186144-d10e-4035-9011-ff64526a44aa", "comment": "Malware payload (Mirai)", "value": "d179229dcd4019d9f846bbf73d62d65949896ebf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328516, "uuid": "5ff64cbf-8296-4aba-8a0c-86e23e22ebae", "comment": "Malware payload (Mirai)", "value": "a84ea193f64479c5c82fb975ff3388ff438eb05faaea3cd22247a501dfeac59b6fc7658e95320461cc7bca483f95e1c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328516, "uuid": "a6d45232-6d40-4976-9927-ef4e2fb78085", "value": "T1B4B339C0EA47D4F5DD1642302277F73B9A32F17A1139DA83E3A89F327C52A41D90A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328516, "uuid": "541e804b-3cdf-485c-a912-d90ab8760377", "value": "3072:XFmzGpEWmXBLFkpzjYS3Z/5+JcDEh+ohHw0pJbL1:XFmzY5mXBypzjYYZ/5+JblHL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765328516, "uuid": "2b83cb32-8a28-49e5-9f17-bfc139e84297", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765328516, "uuid": "772c5a0f-5dc3-4b6b-a817-d802afb15bf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328516, "uuid": "fc2b4da8-64c5-4937-8855-e4e280b96f45", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e1f43da-d598-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765350976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350976, "uuid": "3fa4113e-52b5-4e16-a8c7-28d6fc2957cd", "comment": "Malware payload", "value": "69839295233497f9216cd55804907b12", "object_relation": "md5", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350976, "uuid": "340f4e3a-265e-4da6-b554-989f7f0cdbb7", "comment": "Malware payload", "value": "89a48b258bcb01e7c1fb4d7f08c8b6b286cbc1960fcbc7868b13da9581e24233", "object_relation": "sha256", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350976, "uuid": "ea7229f8-21b5-4565-b7c0-ac0208b7ac59", "comment": "Malware payload", "value": "d84d608e072f17c3c5deb164273de13f6fce39c0", "object_relation": "sha1", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350976, "uuid": "92aafa03-25eb-4457-8640-eb5f02a95bd7", "comment": "Malware payload", "value": "dbd89620c02e1f47f9b105b95d5a05d98851d459b67c1f20c9744399ff0556f4ad19f804b456cf5d504a4b4cf83b946e", "object_relation": "sha3-384", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350976, "uuid": "f2871dea-e898-4482-b272-a653ff5a75d4", "value": "T143F2F298A87195F2E7BACA33C200EEC9DFE9485E7C80F2851ED421A7C59510DBD0EF59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350976, "uuid": "2766324f-a9a9-41b9-80dd-bda589f185f7", "value": "768:REVbRr6odo20z6uRL2FIY0YIvPvnzLaYzjGmEQTMLNNpTqZoY+wqaFw0t:SXOodSrVtYo/nzLayGmE5poo9wpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350976, "uuid": "7e08e012-4a3d-4591-aea3-2a7e6ccccb9b", "value": 35022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350976, "uuid": "f3679fb1-2525-42cc-a874-a84ae114b7c0", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350976, "uuid": "aea9ed2a-830c-4b8a-818b-bb3c0866ac91", "value": "89a48b258bcb01e7c1fb4d7f08c8b6b286cbc1960fcbc7868b13da9581e24233.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa49e51-d623-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765411019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411019, "uuid": "6ba33db9-66bd-411a-9dff-8e3337cc6b22", "comment": "Malware payload", "value": "65f283f9f364846eeb067938930bc178", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411019, "uuid": "8d36c832-03be-4e37-85e5-37820ab602cd", "comment": "Malware payload", "value": "89b171ea420defb806405645fdb2c2d0a5ef348cf4f27218c040773c035bba16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411019, "uuid": "1dd88a3d-a412-43a0-8aa4-7de9fdde2591", "comment": "Malware payload", "value": "cbb67ad6fbdb27908c6938025bdbb949c779adef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411019, "uuid": "5facfbf3-7abc-4c93-8b4d-47984adcce37", "comment": "Malware payload", "value": "7d068277a2f0b962b29745455254bd9c3bcbba0075c2619179a3b0886a0502257e7dbe2377815d03f7cc41955548465d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411019, "uuid": "48ac1a2b-f2a5-435c-b951-1d1d906c1f81", "value": "T1D783182B9251C1BEC08346B52ADF9961AC73BC390B3662067395BE6D3F35CDC4E99342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411019, "uuid": "5eccb8f7-8026-4078-bc57-c27818a91f51", "value": "1536:qIu1gTrMtjWqlgI6kev6mJgyPyp6z7m4fkr6iLHzElwOPkIpHqJRU:q51gNqOLDv6gPyu7zCDLHzElwOsIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765411019, "uuid": "68f3cf79-6545-4f25-8c99-3f65ac877232", "value": 88523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765411019, "uuid": "b57cc63c-b93c-4298-9a22-24c3ec10991b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411019, "uuid": "a67eeaff-12b1-4e45-9cf5-0f1a79f2ce27", "value": "bash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60d64e7-d5dd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765380866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380866, "uuid": "fa5140bd-16c5-4ba8-a3ff-47fb55b1bcd9", "comment": "Malware payload", "value": "ce0f7e3deb2fa1b148c72eab0ae29643", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380866, "uuid": "fbf3bafe-5bcb-473c-a485-5bc4aea4f80d", "comment": "Malware payload", "value": "8bb1004511631650878b41c05ef083b450d16b8e1bdba36df5d4b1a442349a0b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380866, "uuid": "0845b4a4-f435-4622-92d7-b26bc643f6a6", "comment": "Malware payload", "value": "226d6857ac53774cc8c0d3a4894e26913c589040", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380866, "uuid": "ac328b73-efce-4ddb-924d-7b6a36a9c980", "comment": "Malware payload", "value": "42937b2f2cd4e97de96a09b1d106ca6b952959add795b99f32b3d77830ad5f63f2b3d58e6795fc670935e60d959065f9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380866, "uuid": "9fe0d6d6-66b1-440d-b116-aba242ebb8f8", "value": "T1D8019C8C3815C2B6128E84B5B951524575478187CA901C1CF61FC06D5F684F475F5A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380866, "uuid": "63171a01-a548-4e3c-ace3-4bd6a52fb28b", "value": "12:DpWLpkERj1+eO6gzoZB7vyow+SW78FjeFvBa05O/p1S/BFFjZ9FvZf/p1SYyK:1EDQ4gkB7vG+SvghBJkSJFb9hh/fyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765380866, "uuid": "29830430-9cb6-4f4e-bd6c-96d74a01ef83", "value": 812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765380866, "uuid": "945fb13a-6f86-4019-97dd-df6f5e8b8e1d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380866, "uuid": "6a7ad0fc-6c11-4df8-a056-063b1f277caf", "value": "ch.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a969115f-d611-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765403179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765403179, "uuid": "de0be320-fc0e-464c-be6b-c1c95168bf67", "comment": "Malware payload", "value": "c27f7de4428c2e56900cf2fb0bd1c891", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765403179, "uuid": "937330fd-22e2-4540-8620-1824248b81bb", "comment": "Malware payload", "value": "8bee6e2f31a9dba9d1005f17f87ecdc3d6cdf7ce1fe11d4c7db66e03ae7ee8bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765403179, "uuid": "2ab6bf54-440d-4ce0-bafb-8c69068bd925", "comment": "Malware payload", "value": "94c829cdf588d1259ef551b04c409098324044d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765403179, "uuid": "955f4eaf-7dc8-462d-bdd3-eaaa5e381780", "comment": "Malware payload", "value": "1f0b0b6a47eb6e20d757ce87cc47e53422fce7d1dda85f5ad9be56b808e3d9b3cbec1b87d703d6a048ae9e833927f34a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765403179, "uuid": "dca3d4e7-14c6-40b1-8c98-db9efecf204a", "value": "T10B547C16F3A514F9E977C57CC9424906EB72BC5647A0E7CB03E04AA63F236A05E3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765403179, "uuid": "8beaf232-d1e8-44e2-8c2e-574df1db1781", "value": "37ed60ef05780bfaea0c2d867899a228", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765403179, "uuid": "8ea4a14c-2c95-40a5-bb6c-d209e816cc8f", "value": "3072:n0il3qIbVHR/or68zNjgEk57IAxdLkpNjeX75dMFOSzPJ/0vMrSWeyfdX7d8bKwR:nT3T5Gz+t9xdLWjIMUMrSZ84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765403179, "uuid": "7ecbf061-ff12-4ab0-a589-8574bacdd898", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765403179, "uuid": "100c36b4-1ff4-46c3-94c4-1b9cd28c948a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765403179, "uuid": "43e07e7a-76c3-4ec8-9a4e-fff65c538944", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a3206ab-d598-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350969, "uuid": "233c505f-2b6a-4983-9908-13c173c23190", "comment": "Malware payload (MaksRAT)", "value": "ca47176fa163a4697238740ae591f353", "object_relation": "md5", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350969, "uuid": "b01e0d1e-c43d-4d0f-9b7b-176eeff3cdca", "comment": "Malware payload (MaksRAT)", "value": "8c026a28c92a1d815378eab106971ea6d25e79dc6481e86d00001142acf00c6b", "object_relation": "sha256", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350969, "uuid": "05caa799-116c-4375-8505-c158a1cfcd20", "comment": "Malware payload (MaksRAT)", "value": "4bc8c156e60b995c468f2db36833ce40348c0338", "object_relation": "sha1", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350969, "uuid": "6d77fd05-757f-4226-8f1d-fe8479e8f420", "comment": "Malware payload (MaksRAT)", "value": "62be62f098574e303aa8da5f15efbee7266c8678c2a437076a48efc90cce2a2eb587c97d31f8f722c1f3d03beed0d80b", "object_relation": "sha3-384", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350969, "uuid": "5aaac03f-2ef7-48a9-8bb3-e759dc3a9a94", "value": "T16892C01B6B39862ECF5A40BA91D1619C2B423BD90F84FF0762A1D19CED642FB63D5D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350969, "uuid": "4aae40e7-4dbd-493c-a7c2-0638d4e7fdbd", "value": "384:Yg0AfulXd1fS65uCMxaFRiqxfgzAkSBYX0obP6e01q2osUn:Yg0Afu1fS67iQoSc0QYqBJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350969, "uuid": "c5bc624a-aff3-4cac-a77b-d688a26d5c46", "value": 19762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350969, "uuid": "85cbd32b-7c51-440a-85fa-7c3be0d70795", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350969, "uuid": "8bf345dd-9cdd-4ce7-80cf-57bea599a1a6", "value": "8c026a28c92a1d815378eab106971ea6d25e79dc6481e86d00001142acf00c6b.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93c1308-d61a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765407178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407178, "uuid": "fdad3818-b390-4f2e-b1ec-b5bd20dd9d31", "comment": "Malware payload", "value": "0299f0016df9074a34067ed26a7681c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407178, "uuid": "4cfeaba0-0aff-4b6c-bc25-ec1ae93eac27", "comment": "Malware payload", "value": "8c779e227cd3e22ef07522e9dccc33baccf506324ade9e592f7295970d107595", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407178, "uuid": "9da9b826-8fd9-4f1e-ae71-01f285f89905", "comment": "Malware payload", "value": "83565d5efc6e083fe63f73c37a5c01c56c3ae241", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407178, "uuid": "86405cbf-ef2a-4ba5-a5e6-4e7ff8a15db5", "comment": "Malware payload", "value": "a8183829b7590106be26f9876e54b2081f051580593f5537ab7b6e940b21ea845539538ece79aa8fe7d34c08acb48209", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407178, "uuid": "094a6f95-dd6f-486b-830b-a24765de2c57", "value": "T180437DB6C46DAD94CD8C02B4B831CAB95B43E10093562FB76D85C4EA4087EACFA0D7F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407178, "uuid": "9ecdb308-fe5a-41be-8f7d-1cfb7fefc597", "value": "1536:Pa9wttXJ4oizsZo2jJyYxAyuzUnw5hjKtLFC6ET3bsR:PSyJy/extdnWh2tLFYT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765407178, "uuid": "9fb9870e-5405-4ad1-8823-a6e76dec5477", "value": 60480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765407178, "uuid": "fb4dc31f-99e8-4896-b52a-911cbf130a9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407178, "uuid": "3560ab3b-ba69-4f62-986e-70882b3f2537", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6c6247-d5ef-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765388425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388425, "uuid": "a01ea6e6-25e3-48e4-9065-572f58f83471", "comment": "Malware payload (MaksRAT)", "value": "844fff5a6e50a1511368d26a65652554", "object_relation": "md5", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388425, "uuid": "1ef77198-5a2f-4db1-abc2-dfff8d6b89fd", "comment": "Malware payload (MaksRAT)", "value": "8c9f9199930ea8476c36e1d24c69909a295be3e127613fe333165784a83aef5e", "object_relation": "sha256", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388425, "uuid": "250319ba-6d9f-4937-819f-8c174aa1abd6", "comment": "Malware payload (MaksRAT)", "value": "deec5f5e774a50b78c558ddb6023406be4dd1465", "object_relation": "sha1", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388425, "uuid": "d3a25724-6def-42d6-b0a5-44be4986a041", "comment": "Malware payload (MaksRAT)", "value": "4fddbd7bf7e6e71cf89f860dd9f44f31525e6d6c0072fc11ec8f5a333468f8a09e8127ed7c758d91e21964b1889a284f", "object_relation": "sha3-384", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388425, "uuid": "41e96fc5-d5bd-4cbb-985c-d997c7de70a6", "value": "T181F2F196B792EE1CC85B0AF96440A040037E5BE5E3D284CB51A52DE49E8E6B71C237FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388425, "uuid": "11923e70-0fdc-465c-aa13-d253b2f510c4", "value": "768:svYEu6wr3mjVs9E1BsJWmtzNdx144k3i8JlH25Jqkcef:4KnrmjVs9CIztzNBo3blW/zcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765388425, "uuid": "aba9b561-83fa-4f77-962f-a97ef7e735f8", "value": 34847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765388425, "uuid": "71d606e5-f3f9-45de-a07f-d3f2483fe5e5", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388425, "uuid": "de20ae8e-aaef-4108-8171-d76dbfee3b33", "value": "8c9f9199930ea8476c36e1d24c69909a295be3e127613fe333165784a83aef5e.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b46f33d-d5f6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765391425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391425, "uuid": "dc9e481b-6670-482d-9916-f202c2bdae36", "comment": "Malware payload", "value": "be10a2aba5ecb5be032f874b9b1be15d", "object_relation": "md5", "Tag": [ { "name": "jmpbowl-space", "colour": "#8E4207", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391425, "uuid": "360e05a8-c1df-477e-a248-43ff75d16557", "comment": "Malware payload", "value": "8ce9563c209b5089c7f5d2e3d8c6c390caef026d88c4c168ca05556ee50ff2fd", "object_relation": "sha256", "Tag": [ { "name": "jmpbowl-space", "colour": "#8E4207", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391425, "uuid": "eb0b8431-667e-4b66-9bdf-510a8f335620", "comment": "Malware payload", "value": "a03a8ad0558aa4d1ac14000fdc945b0f2d296239", "object_relation": "sha1", "Tag": [ { "name": "jmpbowl-space", "colour": "#8E4207", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391425, "uuid": "43fa4593-2d49-4007-a516-10b8d3636380", "comment": "Malware payload", "value": "fc2df352a1064eda675d73ebbefebd708f433e5704d1306dcc4f0cbfd4d19f5c16764480a4df41c03c21428dbf986beb", "object_relation": "sha3-384", "Tag": [ { "name": "jmpbowl-space", "colour": "#8E4207", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765391425, "uuid": "eff0878a-b263-4c97-922f-1b17bef7e028", "value": "T138F19EF7B236DA92CE807431539314EF7869A17688FC3759C6200A0C9660C5F2F4B9F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765391425, "uuid": "fc7a72f5-ea0c-4982-a192-c839ee57fa74", "value": "192:HycL5v94iUka4xoAdyjLYvoYg5Dbe1qO/TMIq:nL5v94iUpcy/YvoYg5DS1oX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765391425, "uuid": "0414259e-46fc-4b5c-8926-365c06cb832e", "value": 7910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765391425, "uuid": "300edb59-f947-49fd-927e-09f051707f19", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765391425, "uuid": "421f1493-ec08-4f3e-b4c2-bd9981bf0f75", "value": "81b40952955a000d73cf1393e83ecccc338a7f84277224ba9cb63210ac3a1e78.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79af0524-d5ce-11f0-a129-42010a9c0007", "comment": "Malware payload (Rekoobe)", "timestamp": 1765374322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374322, "uuid": "48696a57-0cae-47e4-a8a1-cffeec656207", "comment": "Malware payload (Rekoobe)", "value": "be57570e68bc503887a5d8c16aeae6e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374322, "uuid": "575b22e8-08ef-4398-981e-e555877b236b", "comment": "Malware payload (Rekoobe)", "value": "8e07beb854f77e90c174829bd4e01e86779d596710ad161dbc0e02a219d6227f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374322, "uuid": "d73b0227-dbf4-4c98-85ee-bc8999aa60c2", "comment": "Malware payload (Rekoobe)", "value": "25ff6b77ff24d2267ceced55b707f6b3b2cb1c95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374322, "uuid": "527fad43-d30a-4d08-8b3d-66c24f36fb5c", "comment": "Malware payload (Rekoobe)", "value": "4c56a5030b754c8d884180f7ed259791cc6b795b46e5cafc52eb27f6c73ee2273fd71c84c74b213e2647f3955569056b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374322, "uuid": "6b91aad7-e2eb-4e12-bbb5-6724f4ea7aa9", "value": "T110836C43B6668DBEC859C2304F0FA436A873BD58EF66321B34405B64392FB192F29765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374322, "uuid": "a2ee01bc-5a3f-4817-aabd-335c5f97d1d2", "value": "1536:rV3T+Q0YNuV8NnUTnhhW+LUlP7oqHekyN/1H5xuM8VS:rVqxWUTnhhW+LOoq+xN/1Zx2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765374322, "uuid": "8730a4c1-532c-4928-9512-ae5f61cc1af4", "value": 86176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765374322, "uuid": "f7dc433e-901b-4f46-a806-4c73e8dd5f2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374322, "uuid": "e8a80647-37c4-4820-bd75-83e01c42d98e", "value": "sshd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a89fa7-d598-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765350964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350964, "uuid": "f158bbd8-49b2-4496-857f-395377fa8f91", "comment": "Malware payload", "value": "a2854239a3be2b721bebf472e57e0664", "object_relation": "md5", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350964, "uuid": "e08618be-86cd-405f-8931-21389bf734ee", "comment": "Malware payload", "value": "8f63291cf013856a0bf61a921ec179076a46ecc73563b3a0821e7cdaaadfa40e", "object_relation": "sha256", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350964, "uuid": "08c6a02a-38e8-4ca4-9bc8-63e4d8f48e50", "comment": "Malware payload", "value": "4b0c6e188eb7c5ff05e59c1b45a69b15f8863fae", "object_relation": "sha1", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350964, "uuid": "d033c43b-04ac-4519-9af9-69b5013eba3a", "comment": "Malware payload", "value": "62c268143231a968407998c107a6aff9070beae9e045a3139532a2bed2af203037bbabcb4d3a4105f9ec24e9e96fb899", "object_relation": "sha3-384", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350964, "uuid": "3391438b-5359-4103-bdcd-f9039074a3d9", "value": "T190E2E1FE9DB8A0B4C02B6775F21DC103006BA6BAC24877D34B509B0D90B26525D63B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350964, "uuid": "104dd265-6c98-47ed-b738-c2ef44a9e546", "value": "768:dovZZ4Bgk2253o7Yk5Vle+VZUjIK6xYA9kR2hfxNVNnmSsqu/B7t:dO/4d3ERFTUjIKF4hfTmrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350964, "uuid": "aa2584c3-c79d-4856-a274-f6ceb883103f", "value": 34119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350964, "uuid": "b2ea6b91-4154-4851-9628-069e25964def", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350964, "uuid": "63be286b-c4e8-493b-9b5e-6be1bc6883bd", "value": "8f63291cf013856a0bf61a921ec179076a46ecc73563b3a0821e7cdaaadfa40e.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4d5c23-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350084, "uuid": "af78b8cb-d4b3-4fe8-a723-16c33c30fada", "comment": "Malware payload (MaksRAT)", "value": "5f96ba11198bc7aa9f0570665373450f", "object_relation": "md5", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350084, "uuid": "11afbb8d-c510-4114-906d-e0946033eefe", "comment": "Malware payload (MaksRAT)", "value": "8f67449b72cba0fb1df35a22ecf86f905e43a0866ac47c70ef45213e8ded78ba", "object_relation": "sha256", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350084, "uuid": "28889b92-9f4e-4545-b3c7-5e10eecfe759", "comment": "Malware payload (MaksRAT)", "value": "28bdce11df1c25e87fa8e638a20fe9898ba73582", "object_relation": "sha1", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350084, "uuid": "0e1195c0-1bdd-47ea-a556-6b92bf57e229", "comment": "Malware payload (MaksRAT)", "value": "3556e2b5d7255b8c250bc40838a6994726e7b14cf80e6a4dbab38f80fc2456ccc7876f28709fff267450b898e211fa0d", "object_relation": "sha3-384", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350084, "uuid": "72964be9-5b2a-4d1c-b9c6-5e1ca0e44715", "value": "T1F0E2F115AA49DBB1E34DE2F684ED4CC34EE19E2CCF8EC61EC94219A82CE55773E410C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350084, "uuid": "65c82bdb-e770-4c89-b1f5-2a3b7db9c69b", "value": "768:lWBKDdS8wJKBGcvo3kdB5OxKJPXdfauRNFx19D4i6m:lrDJ18cXd+etfd9T6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350084, "uuid": "f968375b-5668-465d-b746-0f763c7acb29", "value": 32095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350084, "uuid": "203b7bca-7f7c-40ad-beb3-fb9e99b23178", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350084, "uuid": "500505c4-7da9-489f-8c12-b0dd21e2abc3", "value": "8f67449b72cba0fb1df35a22ecf86f905e43a0866ac47c70ef45213e8ded78ba.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2c2c69-d5f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1765389384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765389384, "uuid": "0ff46c43-7de7-49b3-ab98-56638c50dc56", "comment": "Malware payload (Vidar)", "value": "f475dc74ff2dfe6c48e323bc2d3dab37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765389384, "uuid": "a5af4c3d-f624-4db7-88cd-d1a4aa59bc1a", "comment": "Malware payload (Vidar)", "value": "8f85357f6ffa9ed4190aecc8d75270df936ec412f578bf265e1c655975b63578", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765389384, "uuid": "75708bc9-b31b-42b0-929f-17a03c078c11", "comment": "Malware payload (Vidar)", "value": "c653f36918bf9ca405840c60cec672e38045afba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765389384, "uuid": "db40384d-eb03-4a05-9b90-253a1c46885e", "comment": "Malware payload (Vidar)", "value": "ac92554a069b8221a2261237882a93393f1fcbd7ab93864adfccadea368deb9b9eb4970ba9e9b497dec7ed768e551308", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765389384, "uuid": "95788b83-4ade-4462-8358-c30cc4b33052", "value": "T1479512D03E69B70AEEA14230E47DDDB442E93CA870157BEA1AE93B5B74DD3109D48F21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765389384, "uuid": "308f05d0-3e14-48e7-a7b2-bfa1cfbd4e0f", "value": "49152:AlP45AXXJci2singp8JvS3L3gsa4dAamy:gwuQsWtvS3sOdAam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765389384, "uuid": "72afcd6c-905e-4aaa-96c1-bca5d85e78c6", "value": 1969664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765389384, "uuid": "7084a37a-ef8a-4609-a840-e30e17193c09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765389384, "uuid": "294d4990-65dc-45f9-98d8-8fc552749c90", "value": "Vl42rA8dkRKp2D9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbcde171-d614-11f0-a129-42010a9c0007", "comment": "Malware payload (GoProxy)", "timestamp": 1765404552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765404552, "uuid": "c0d97ede-30e1-4e2d-a46e-197b26b0cd55", "comment": "Malware payload (GoProxy)", "value": "2c67cc1c9a9167214dd93ea827cf64e7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765404552, "uuid": "8e89d486-2223-4dd1-ac3c-abd34c1f5529", "comment": "Malware payload (GoProxy)", "value": "901fca1aa7efabcfbb8d5dda152f632e46bb3b86259163956a3257480ade7f15", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765404552, "uuid": "023fdae5-2135-46a0-a426-82e2a71092be", "comment": "Malware payload (GoProxy)", "value": "85aa2fe2cc3b718ccc2e2111c31cadb79b75910a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765404552, "uuid": "3908047e-91c1-4984-9ba6-e90094ea9695", "comment": "Malware payload (GoProxy)", "value": "64fa59d1656ad3b58419d74ec72b585b2d70e01da1eca5669e20ccb0bee948f87e32c4d547decdcae877d6d9046ac1f4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "GoProxy", "colour": "#E1423F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765404552, "uuid": "dec6c2f3-4ad4-45a5-9573-a93ba80922e4", "value": "T19A664B03ECA555E9C0E9E2358A669362BB717C481B3123D33B50F7282F76BE06E79750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765404552, "uuid": "401ba85a-b8fe-4890-81cb-2a0a25ffa984", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765404552, "uuid": "7210d267-e38f-4d23-89c6-24e0a1d0194d", "value": "49152:5auWQu/I2XUSOsv1hHLl579KLbDpF6FseL+1wjZM2gCXYh6jBy9I5eNUfKiK9Kvk:51af37aDn6Ft+19zG5bJMEiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765404552, "uuid": "5685d1c6-b628-44d8-b91c-41229fc3018f", "value": 6647352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765404552, "uuid": "3d65dc7c-b94f-4afe-8402-68c640a08c47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765404552, "uuid": "62d5c5b8-af76-4e74-a80d-71c198933177", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b11b67-d5c2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765369075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765369075, "uuid": "9aee750f-1cde-4476-90b7-96a1fd9098eb", "comment": "Malware payload", "value": "583cbe6dd27498a0965ab9e0e54dd674", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765369075, "uuid": "2815a80e-acc4-4d27-8a2b-efcb605f713d", "comment": "Malware payload", "value": "908350ecfed89b9cff83be0c4789b47b0bd145a5e9ebf117dc535a0e787e5f48", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765369075, "uuid": "0c1b725e-6590-474d-b1e1-a522dc6ba3b3", "comment": "Malware payload", "value": "7a3b258aa7863b27fb3a2ee708b65d9eb6e18ffa", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765369075, "uuid": "9201829e-fb15-43fa-8d94-7fbac51e4889", "comment": "Malware payload", "value": "b1319ad8786654ed68f5cc116e308a802976350221f484fb0e01d8c5090d38cb72a3c3950187fef7227672a792b4b28e", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765369075, "uuid": "3dc10854-b924-4408-ab17-bf30c3e89892", "value": "T1D224F95092E50348FCF74F7CA937738159B5BE19FA91C3CC0160A14D6E70B65D85AF2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765369075, "uuid": "4a2201dd-236d-48fd-bd4f-2114de2c51b3", "value": "12:8d/Yta0oH/VU+f4SHo6is8X2ZniLXAU4oNBXf8XQLyD+ssMh/4xjb780Fj:8d/f/pfiKiLRNBP4DnPCF8ij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765369075, "uuid": "babea1fa-7611-4a1b-a4fd-3f44fe2d93ce", "value": 218079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765369075, "uuid": "e0b56c67-6675-4ab2-8919-53c7b84f50be", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765369075, "uuid": "a5f9ab8a-1e0e-4bf9-8452-ac8bfbd91819", "value": "IMG_9.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e302c36d-d61a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765407141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407141, "uuid": "fe923dae-cc0c-48fa-9156-2ff333a86345", "comment": "Malware payload", "value": "bec053796102aace66437c22db744908", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407141, "uuid": "dc707751-4320-4c3a-a08a-0a3308bda19d", "comment": "Malware payload", "value": "92d8996dca7f85e9800bdacf8b2286c7c43e791edcb503cc92c40e129c270213", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407141, "uuid": "e32943cd-dcb9-4436-92bc-68b82b04942a", "comment": "Malware payload", "value": "55d4aaef34e3a7c59f2252180b28bdb383651ed3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407141, "uuid": "b81e9b69-9564-4242-9734-ec0138b2f4b6", "comment": "Malware payload", "value": "65455f02c469df42a2a6703a48fe7fec26be5d20dd5e8e1eae14cb26d4cc1af6abedefc68773cf9ca1ba1dba8d317c55", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407141, "uuid": "183522d1-c6aa-49b4-930a-298dff282769", "value": "T14E5302D1CC65264E9B4F075FD9C6E8AEC9303A9B7A830EBC0DC72285434A4E44FA13D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407141, "uuid": "59c45c8d-4ea1-4992-8bf0-cab1763b1a80", "value": "768:MXCKcrDS6gvS5DRf2Sk3pFR5CvefIqS/uSlmvb846u4/RDKz8e7Qge8aHxSa0CPy:MXCLVDtIPCmf50IIt8j7QgePSJUlamSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765407141, "uuid": "36d94ea6-2899-43eb-a473-a6ec77ef97bb", "value": 65149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765407141, "uuid": "ac0bb845-a788-4d62-a1f1-fc9cad37e578", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407141, "uuid": "613b10d6-ea7d-466e-8595-3a047cbfa9f1", "value": "Merger_and_Acquisition_Details.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090f8d03-d5c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765370268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765370268, "uuid": "6fade8f8-0fe1-44fa-85e2-d85143257637", "comment": "Malware payload (Mirai)", "value": "c8c17662cdfd2994c9f39c2dc1ff3d59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765370268, "uuid": "bc97cc6c-b360-40e1-a403-19355a005cf7", "comment": "Malware payload (Mirai)", "value": "92fbaa224dbd7668c1866cf032287d6252b908dc59d5a6a26ceac85a43354206", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765370268, "uuid": "d0907782-fb9b-4063-967d-5b4be0d1999f", "comment": "Malware payload (Mirai)", "value": "4039f5b684d476ae83aab4a72d53fce82930b770", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765370268, "uuid": "efb5ba80-67f9-40a0-9445-dc264b34c034", "comment": "Malware payload (Mirai)", "value": "221076430cab41fddefe2280628fd8f59d6344421818b45850c2cee6f5b05b1b12ca588c80e0f8f8610a75e95dd39df8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765370268, "uuid": "53fb613b-5fea-40f7-83af-2ff8fed40115", "value": "T19EB34A07B6C084FCC48AC2744A9FB63BD971B96D1134B26F67C0FF222DADE226A1D554", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765370268, "uuid": "9e469fb5-0521-46a8-b652-48eef6311276", "value": "3072:8Kpvl0R/avjDjhVFqG/FA2Zk8Qb31Msgra3A/4aPsUUU:8Kpvl0R/a3VVFpFAG6ltgUASUUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765370268, "uuid": "75d70a74-3487-406c-9453-fd2b31c9fbb7", "value": 107632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765370268, "uuid": "94f0d301-80b2-451f-ab95-2de662f28ba2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765370268, "uuid": "3905a1c1-39c5-4887-b015-10933ed954be", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5071ebd1-d5a2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765355355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765355355, "uuid": "8da1af85-e37b-4ea0-a819-45a14010e497", "comment": "Malware payload", "value": "6e6ad2f4ddf3d0069ab34e281dd272c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765355355, "uuid": "9555612d-8e0a-4d56-9a48-04878cce692f", "comment": "Malware payload", "value": "930984868b1b7c3492e8e763349a00a21cb5b1348c59f4676606f5213274a3fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765355355, "uuid": "76547ded-98a9-4e1b-8b5a-03ddd6aa8f5b", "comment": "Malware payload", "value": "cfc03105ce96fb6275bd6720c04c9109d65f5f32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765355355, "uuid": "193e9561-fafb-40eb-846e-fb99890e95d6", "comment": "Malware payload", "value": "98d0c02024f011bdfbf585636705e5d409ed7cf0d5e51db1ac47ae7494204705ec54774568b2fce135b7ff0de9fec60a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765355355, "uuid": "a1a98c6f-23e9-471a-a605-873197e429d5", "value": "T102B6330BED7B8EE4CB13077894A319076B6341195C6BF08AF089663951E6CFEC9397C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765355355, "uuid": "1ae78c81-dee4-47ac-bf16-5d03b5c87285", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765355355, "uuid": "b6378df3-7035-41dc-8c80-a75b84728ebc", "value": "196608:waZk+w9NX02MyR1sn3+cvXR2sPFOsti7A95lGsFp29XaIT030Hy0RNNC:Kn9NX02xrmhvE7ANZp29qIT04C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765355355, "uuid": "d6324f27-5dd9-4416-866d-0895cca43a56", "value": 11055944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765355355, "uuid": "fe68b9a3-211f-44e9-af65-ae7e36bfe15d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765355355, "uuid": "f8c6b4f1-6a1d-42d1-ae19-73f250e29290", "value": "MicrosoftTeams.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a679a06d-d607-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765398879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765398879, "uuid": "42585f93-9e69-43d7-b4b8-8e3c942377d2", "comment": "Malware payload", "value": "f68d5a7cf097fc262391800c7bf1077d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765398879, "uuid": "7501b954-1c20-42ec-b5aa-225437629281", "comment": "Malware payload", "value": "9384721425cfbbd46be99dd3190b5d5e09e6817dcb811ea526389182ceef5881", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765398879, "uuid": "bc896b46-539e-4dac-85b8-64329975bf81", "comment": "Malware payload", "value": "304d50d1312e0479728f7d12d76fd5a52f1258f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765398879, "uuid": "626eb88b-e55b-4612-8188-93440eac638a", "comment": "Malware payload", "value": "713c1e32ff7abc09ea71a7956a29d8cbfcc291b2889f08fc928eb249ced6d4207a68648338ceffd6e07e396cb5cdf6ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765398879, "uuid": "28121767-e994-482c-a706-2baec4c6880c", "value": "T142A62993B9854629C5ABF97490906211F7B0BC0943313AD75ED816E50DBABC82B3FF39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765398879, "uuid": "fe5aa5af-287f-4e9d-b4bd-0656ac66b3cf", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765398879, "uuid": "3fe1d15c-5324-46f3-bd65-f3c72152d2f1", "value": "49152:Bk9h3nJbZSLvqL2xeQGyzVevGxBsA9CJfZ8S+CmoBOsKZaxwDEzSskJOPMVfAAZk:4h3nyLnzzVev2pMJfZ8imoBOnsu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765398879, "uuid": "137dc4d4-b35a-4c3c-9987-c0ac7dac1f9f", "value": 9592960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765398879, "uuid": "c9de2df2-e3d7-4160-a7e5-7cb15f63b41f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765398879, "uuid": "b057805c-e991-4df3-89cf-1a8b98406c04", "value": "RivalMods.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ca5bfb-d623-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765411014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411014, "uuid": "14c1d884-c2b2-4162-9953-1c42e224aa7a", "comment": "Malware payload", "value": "44294f0f0d13ce49c1d25a3596f17be2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411014, "uuid": "d28333c3-f129-43f0-8675-4d1edc18b450", "comment": "Malware payload", "value": "93ab7c9aecdabd7a07fe344189d38e8be5556b508cf5c0296e15aa081091b9c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411014, "uuid": "651da33f-6b76-4c0f-aac9-d8fe154ba2ed", "comment": "Malware payload", "value": "a3f05a6c804ca268668f5735222b8c9207206330", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411014, "uuid": "3ebd4c80-f2f9-4e7d-be04-59b134e5d451", "comment": "Malware payload", "value": "3be16173b52c2293df4807f845378e38b70be297d150c9f0c28f21abc373bdf8ec6666edb34c086b0abaabdc71590038", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411014, "uuid": "063aa434-3789-4ca4-a606-f2e203e9c167", "value": "T1BDC3945A6761CEB7E84ECE3B069A450110CD9D4A12DD6F2FB2B0F61CE3AB88E45D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411014, "uuid": "0c21ee61-a167-4255-9300-0085e7e9298e", "value": "1536:qiSoeTAnp5Dae/NfeKOpyzLZ3UX1y6wo7I/EXXj+vg8:qQpffeKOp4LrKqEXT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765411014, "uuid": "0b81bc66-97c9-4988-9477-07ba006faf40", "value": 119167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765411014, "uuid": "99d00d5f-7309-46ee-af18-4459d6328812", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411014, "uuid": "5d8756f7-992e-4682-9d83-ee2b6ddb5727", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66caa19-d623-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765411012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411012, "uuid": "049b88d2-2740-4486-b6ac-3cc6c9fb936c", "comment": "Malware payload", "value": "31cc5c0ff9fce07125a047d887f3efe1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411012, "uuid": "81f6a3d1-154e-47e2-a2ed-376a8c9b31ee", "comment": "Malware payload", "value": "93ce367e397ebeb13d489cf11de4a2abad29711030e29e47e91f967a983fdbf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411012, "uuid": "2d043b2c-7c1a-48ba-abcf-685305af5628", "comment": "Malware payload", "value": "1f4e6e7ce4783753c2213a6a8520a43f8106f70e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411012, "uuid": "bb315a7f-96fc-4abf-a91d-b255be610b7d", "comment": "Malware payload", "value": "1db9aed77e7a6b164cd48546136f9c5744b5b963a9e47b52ebff607f191501f449240b5f21f8bd5db73e61f8c16d0cdf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411012, "uuid": "ba5cc78f-983f-4a64-8ed2-fbf74e9d85b8", "value": "T15283F99BB71D0BABC59B5BB12CB73BF18B69ED6002B21184910EFF9007B29741532F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411012, "uuid": "902c68f5-fc77-4f60-965b-66145764568f", "value": "1536:rhU9XPp5/lzOi5fBTAQX7KqpFsYe8IYV5wtwHUIe:1G/RSkBTAQXOGO8bwtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765411012, "uuid": "17b77471-2396-4365-a57e-fc6e3f80e46c", "value": 88575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765411012, "uuid": "fa288716-aa21-4448-8494-59fd160d0153", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411012, "uuid": "1a86e8a0-ea27-4cdd-affe-0d9ca839e8a5", "value": "cron", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb6c27ff-d574-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765335859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765335859, "uuid": "3ae5341d-51a3-4b95-9ee5-3ed3168e03c6", "comment": "Malware payload (Mirai)", "value": "0f57d6adbac1d43f2d74f7c0510543b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765335859, "uuid": "d583abda-93ae-49fc-970f-81b653d18f8b", "comment": "Malware payload (Mirai)", "value": "943eaf398ab7e9767c727a429a772f924770599b1569868539829757e38db6db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765335859, "uuid": "cfbbe322-fa2a-42ef-a320-def4e38048c6", "comment": "Malware payload (Mirai)", "value": "7486e199d6ea02ccfc271153aab55a7f1308234f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765335859, "uuid": "9358f33a-98b7-4a0f-8492-ef159c38245b", "comment": "Malware payload (Mirai)", "value": "566420af8b34465e997f8cdd18d7c453d333f215f85c804809ca7db4952ea86acba7fcb953f7dde89706be300ec1cac6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765335859, "uuid": "b56b3114-d023-4215-b008-634bf06bf6ef", "value": "T13D041A05BF150EFBD89BCC3B45F9270529CC581A22EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765335859, "uuid": "5b05520e-fe52-4e4f-b99b-bfa2aa78e855", "value": "3072:J60NEpL/RdBtJN9xFZ9hkOmG5RdelJgtTwn2APPMzEzvQ6WJ9G2/7ZiYlTBVmJTQ:J3CTRdrD5GFnrPU4sNzZt0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765335859, "uuid": "43da885d-3ab8-4725-85fd-b5ee03eef19d", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765335859, "uuid": "495d83a0-c77b-4a8e-8a9e-2f947b7c2368", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765335859, "uuid": "3ba999a6-0246-4ad0-a50b-d9fad0c0581b", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d57f1c-d5b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765364094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364094, "uuid": "3a94da71-83d5-4928-9d6e-04a618d34793", "comment": "Malware payload (Mirai)", "value": "6b605db305dbd011cdddafbab1f68a5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364094, "uuid": "980eb6f0-eaeb-43af-90b2-3e2c856837de", "comment": "Malware payload (Mirai)", "value": "9440dc8f19584608d360d0e34cef50ff1b49b8a928044541aba3e0c9a70390a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364094, "uuid": "71239760-f09e-4fc1-a732-816bd7500737", "comment": "Malware payload (Mirai)", "value": "a2737cc1dac96d940b7f5e6015ea36969d21ff39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364094, "uuid": "0c577b7d-ffa1-41e9-99ea-d11c0d2a00de", "comment": "Malware payload (Mirai)", "value": "7696555bf618171b3b7ac4db9ddc0d306a9932fcd44a5bf3f0538acef34b72b951143f231f2fa5aaa398440fb2b230c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364094, "uuid": "315d5170-e7c9-43a5-ad22-912850187e2d", "value": "T16B9302CA5D14C0E3EB12D0B7A7EA2B7C1F11849247E3AF6525107E97C2DA6ADBC13C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364094, "uuid": "014d7df8-2e8e-4e9b-9916-1f421e0814c6", "value": "1536:WyEkFf1pv9yEt6ewjHBUT06yoQHXodvHZxYKqSbCpEZSXEBVJuU:QkvUjHwtQQQObCyZS0BVQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765364094, "uuid": "3a9dbeeb-edb2-4df1-93f1-b7b7327b95db", "value": 95540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765364094, "uuid": "28c2ca5a-2fc8-4687-8959-1c86692e4bda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364094, "uuid": "8cdef988-71f8-4530-a4ca-579b9e4e2ed5", "value": "ecco.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59bbcaf-d61d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765408326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408326, "uuid": "a5c77ffc-c66c-40f1-b636-efef6f47deb3", "comment": "Malware payload (Mirai)", "value": "c6e119bf8a5a8adcbad9147a8407b07a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408326, "uuid": "b2d8fab1-76bb-4b17-ba9d-732c82e9c3f6", "comment": "Malware payload (Mirai)", "value": "945c501a287c17bbedd86918d543164a643c7b2c068aac929ae02c7a09bb3446", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408326, "uuid": "8837f571-dc90-44bd-844b-a8e2330052f7", "comment": "Malware payload (Mirai)", "value": "c34ecf193327751d5a9e8bdd551ab43cc901f39c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408326, "uuid": "2f20e47a-bec8-4f57-810d-b82a61cc2182", "comment": "Malware payload (Mirai)", "value": "e496159f32356b2297655fe3bed08f0f95c60a297e3eff64ada6af6dbda04f806e3a59ae7b3250c24a28ae219a66adae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408326, "uuid": "10297f8a-70a7-4b06-85cb-2d853fd09df4", "value": "T14783C41A6E21DF7DFB69C73147B78E209758339226E0C645E12CED015E6038E681FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408326, "uuid": "f88fcb7d-49f0-4855-a179-45339be077d5", "value": "1536:tOQLX0B3oTeZZOzEA7PftsVt/i5ssTDo7D9x7DDTLpBoG+m4T3bsRgv:t09odzJPftsVti5s/gGn4T3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765408326, "uuid": "396df356-e475-41a3-9cdb-6b0f1f2ac479", "value": 86028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765408326, "uuid": "8b4af909-a5dc-44e3-b8b4-2d010b5097ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408326, "uuid": "30373b6c-133c-49f4-96eb-b95c32c6fab0", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c06b38cd-d5a1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765355114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765355114, "uuid": "28511bcd-06f4-44d4-9e1f-739ccb11b6f3", "comment": "Malware payload", "value": "3e36ba235f000b0aac58a8d297bd4e05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765355114, "uuid": "134f5f92-d472-4f5d-a24d-761db943c55c", "comment": "Malware payload", "value": "945d0516c078c0255dfb8476056580daee0309bf6cc4bb1542671686e42d85ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765355114, "uuid": "bbf9342b-d6d2-4af0-a4bc-efa2d8984da0", "comment": "Malware payload", "value": "9d518264b75accfe43229a3c51f6849b03f031ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765355114, "uuid": "d24ddbb6-7a95-4b83-b344-826b4539f11b", "comment": "Malware payload", "value": "0dd81f24861bc5a9d0331840725adcd253b6988ce588d8eb831ea4aea738e487c410158f9cc6905c5d83c3514386033c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765355114, "uuid": "5ce69538-8cda-4f42-bff9-51e581220c0a", "value": "T1BC859E0922599E03D12E533790B146C8C3F84C24EEDAF71B5E84BE661EFE3815E3959B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765355114, "uuid": "62e612e5-74c0-4e61-8fb4-3633d111b101", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765355114, "uuid": "9e771c1d-00cb-4058-aa2d-267ab0262ce5", "value": "24576:A+SWZbScfhdHUklbtxo8M3Y+dGyon1ixso2wuOTjyA3YAIhT:ABWccZd0go8oY+E1zo2FOTjyA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765355114, "uuid": "b149a112-b3c5-41f4-a5f7-deb2ede49689", "value": 1796304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765355114, "uuid": "be1e21bb-3aca-40d2-9696-298def06b699", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765355114, "uuid": "700dc0d7-dfdd-46cc-9352-0f7b7c63756a", "value": "screenshot202512106878m.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499f4b6d-d5fc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765393999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765393999, "uuid": "0b36435e-5a76-4496-9b93-3fa913e50da3", "comment": "Malware payload (Mirai)", "value": "1351e0614b974a170aab11508d2235e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765393999, "uuid": "27268d44-6f9c-4f7c-8eb9-0b461fbde947", "comment": "Malware payload (Mirai)", "value": "95ca02990b107413afc0217427ecf19ef72340bd1211514587872ebbfb1fe006", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765393999, "uuid": "8d0097d9-2946-48e8-8e67-567c504de567", "comment": "Malware payload (Mirai)", "value": "976c9f9ad7bd711da5a9880e6507ae5c25747993", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765393999, "uuid": "47d4d336-b539-49f8-b98a-265ed36eedfd", "comment": "Malware payload (Mirai)", "value": "de76d407f229d843eff5f533423516c1b9358f0cc92aa373e18f44b92f72f33c0e1a70b74e222953f553e5972847e795", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765393999, "uuid": "1309064e-632d-4c68-b91b-3d4c355aa2cf", "value": "T197C3F709EB610EFBE86FDC370ABD0B0525CC651712A87B7A7574D828F64A24B49F3D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765393999, "uuid": "f0d4d062-9f30-4465-9ca4-e710405ca85f", "value": "1536:gVukiJoDyZO8ePxR0hV3RJf2QHm2a1un+pXwwFLJZLdbl08KleqPsHYNxhKD8r2:gVukiJoDDR0lydwwhJvcTrHr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765393999, "uuid": "98c58fb8-392d-4ef8-a72e-c787cec8e9d6", "value": 118376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765393999, "uuid": "e78dc7a7-8178-4ba0-934d-ef5fc16163f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765393999, "uuid": "ef9934af-6406-4b84-baac-1dbe11a56f3f", "value": "Labelloperc80.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d21d649-d620-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765409601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409601, "uuid": "248af1b8-7fc1-476c-9c50-85b266a7b483", "comment": "Malware payload", "value": "e006c15669cce2b0ceb565082a13d67a", "object_relation": "md5", "Tag": [ { "name": "github-purenetworkk", "colour": "#29DE45", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409601, "uuid": "f0501816-86e9-4f64-a69a-8ae3a91294be", "comment": "Malware payload", "value": "95d2b36787b5a0c53b73884d30972151e5ccc438640e666952a12a33b559e832", "object_relation": "sha256", "Tag": [ { "name": "github-purenetworkk", "colour": "#29DE45", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409601, "uuid": "f1cbe7e7-d2b6-4be5-a3d9-2ea8d3e1de0e", "comment": "Malware payload", "value": "37534fbafa98aa9f9283f7de619387d30afca151", "object_relation": "sha1", "Tag": [ { "name": "github-purenetworkk", "colour": "#29DE45", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409601, "uuid": "5598f8c9-044f-4080-b514-5af954773688", "comment": "Malware payload", "value": "ab5642b648ce917f84dacbc0c670c76ed1d5ffd11b49c40a10565e452dd765bea969762dce073bb224fd0a3e20fb4b5d", "object_relation": "sha3-384", "Tag": [ { "name": "github-purenetworkk", "colour": "#29DE45", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765409601, "uuid": "3e6e9927-48ab-4b91-912a-56efee62253b", "value": "T1FCD19C69CA3F783C53D00F09CE36261D1F95A5FA3A394C952B4133F156341ABA9E63B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765409601, "uuid": "020f13cc-578e-4c1f-8666-53baa531ad2a", "value": "192:Y5zanUspW22vML109DQ2E5P22NrDPqDuakn:Y5mfYvYmQPnUiakn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765409601, "uuid": "ad3a012e-8654-4b01-829e-d3b580f5f15e", "value": 6668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765409601, "uuid": "d2af0b11-13c3-49c8-bb82-f127a6cf9d69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765409601, "uuid": "792fde87-73cf-4efd-aba2-b456658de697", "value": "cHAh3J-8F62AF-tmJqoo.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d556c5d8-d563-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765328520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328520, "uuid": "ddbef38c-a28e-4466-91e2-c7950f22ea73", "comment": "Malware payload (Mirai)", "value": "0460c0d5fb57a84bba87fb73591396c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328520, "uuid": "7197de20-6c43-474c-9050-86ce468092aa", "comment": "Malware payload (Mirai)", "value": "95d5e5ca4f47b3d93bcff47d77fa99dbdabd13f8fa02464c51bf58c2df549017", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328520, "uuid": "deb48a26-f28f-4df6-af27-e7b754887481", "comment": "Malware payload (Mirai)", "value": "bb898e277c59a535920de1f0d86323b5a841d3ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328520, "uuid": "ae92e664-f5ca-4838-a074-d7d0c69d989a", "comment": "Malware payload (Mirai)", "value": "14f3f3132ec18c476c65620ff7ceafe7ab8bba0d2e429190bcb6414f2e3b1ec69add6bf7cb1b6b9316f024cdac50898e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328520, "uuid": "23477f21-1b61-44bd-b38f-6b20e3a0bad5", "value": "T129D35B0673180E17C5E349B02A3F17E483FEE5D121F4BA89691F9B6A4672E771482FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328520, "uuid": "e8dbe80b-914e-4551-837d-e48bb2e82457", "value": "3072:oWGIf1/UwfhJdU80rMtbYUaDGMsMA9TKDt:oWxN/UUDGQbYUaiMsMApKDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765328520, "uuid": "947d99c7-a8fd-4d7b-ac3d-a69008198978", "value": 134840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765328520, "uuid": "80f2b79b-a146-42bf-86e1-5827b338ae6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328520, "uuid": "293a17c6-361c-4948-a9f3-46016e3d5f28", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6721c43a-d600-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765395766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395766, "uuid": "87aafc62-9c78-426e-be89-af7142ce2510", "comment": "Malware payload", "value": "f0dea236f190a0082e8123b36e5ca1fd", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395766, "uuid": "e46e0bc5-a0dc-45a7-9ee7-b42af1f7da56", "comment": "Malware payload", "value": "960e726e629927c71e9d140e85834ba22a2cb7804fa77fc7c5ae35740477180f", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395766, "uuid": "b780fa14-413c-4cf9-b026-5202d30ff308", "comment": "Malware payload", "value": "c0476d77a5fd3c9b601ceab0d2400a23854f31bf", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395766, "uuid": "6d530ce1-328b-40c6-8938-71d5df781035", "comment": "Malware payload", "value": "1b6388e8157e8c2ff876407829b2a3bc8423a06f1345323a458a35a88b602fa957376f0fb485297b68984d5d933a9c3b", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395766, "uuid": "e35e41ca-5575-44aa-b121-dea38fe17f98", "value": "T1F6E73355EB9CA208E286CFF7B549672C3666C909D720FB1EE9752800CD4A6FA5F0F143", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395766, "uuid": "42aa633e-222e-4833-8dac-631ecee60066", "value": "1572864:CzU7mS3oe7jj+34Hy3IQTQHRtbE4NtNs8aMm3mQq:MU7ke7jHS3sxKksNrWQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765395766, "uuid": "8e396f3d-73e3-4fc8-ab24-cb828d89d9df", "value": 68467321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765395766, "uuid": "77cc2c00-0105-40fa-a183-279e3cfc96be", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395766, "uuid": "21c40c53-8ad7-42a9-b4b2-742e2aa43de2", "value": "#Pa$$w0rD__2025--0pe\u0274_Set-Up!.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f18cee-d623-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765411018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411018, "uuid": "b73d5299-b998-40c8-b97c-523598e42839", "comment": "Malware payload", "value": "1fe5961cd0af2533ca371f623349a96b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411018, "uuid": "ee669ef4-b740-469d-8497-344b0e6e2b16", "comment": "Malware payload", "value": "96ba10e2d7637d5018cb2987217452c0f2f5310e76781e6fc3cef5e06e31517f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411018, "uuid": "30ab0f02-756c-4a4d-a91c-bcd88bd728a1", "comment": "Malware payload", "value": "ecb6207042e31efa8b528aed377eef6dd006d9f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411018, "uuid": "d0492ea0-94b2-4dff-8f91-f23244ba65f3", "comment": "Malware payload", "value": "e15c3d5c54ead0e3f5a284ed26088958e7ff4c2574e2b882cafe0d6435f4c20255257f3a69c6a1353d4d6d9026c07236", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411018, "uuid": "eefe0113-fc62-4dea-b2cd-20375468d59f", "value": "T1B6258D56F2B334BDC067C030839BD7626936F87551212D7B21C4EB392EB2E641B1AF66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411018, "uuid": "2bc27da3-9fd6-4cd9-a88f-b51471dc7a42", "value": "24576:lQuzT3S0xBWArUiix2EmMzqDyRs5XtCe:akT3JBWArUz2EmI2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765411018, "uuid": "99ac82c3-aa4a-4a67-9b34-468f0042445a", "value": 1009616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765411018, "uuid": "7c575d4d-b64e-47d9-b01d-55fa9ff69df4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411018, "uuid": "6dfc9ac9-bdbc-4580-8714-b6e382bd2af7", "value": "x64_bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d6533f-d5f9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765392677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765392677, "uuid": "e68ce590-eb9b-4f5c-9e1f-a589bf81856c", "comment": "Malware payload (Mirai)", "value": "40249e583b32b47b11b4fe35ddc9f5d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765392677, "uuid": "3bc238f4-f529-45bb-bd86-fbae0e7f95c2", "comment": "Malware payload (Mirai)", "value": "96f06a1eec583f831b41aa88fbe8b4086279e9f64e398d47e902b019e296af9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765392677, "uuid": "985feb5e-d4ef-4551-af88-8dec113a806a", "comment": "Malware payload (Mirai)", "value": "921627290887807557bfbb64f025ceae0ce669b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765392677, "uuid": "725c3b03-9ca3-40d3-9f7a-712ec01d6820", "comment": "Malware payload (Mirai)", "value": "1aad2b2c7bcde5916de685d16c6dc91fd2e0a9e1b15e51c6ced1c1b79245fc6e8cf2083aff154c4edc79d5dbf7467cc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765392677, "uuid": "5382fc34-1e9c-42be-b714-d3c727b8280e", "value": "T1AB933A55FD819A12C6C112B7FB6E028D372313A8E2EE3203AD256F2173CB95B0E7B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765392677, "uuid": "31facaac-96af-473a-8c98-b3819ba775c2", "value": "1536:adi6OB+dNP+rl4EFi53vRVAs+HdwoeNAV77W1Q/l1vvMBc:adTOB+dN0i5fRVAsedwo37qax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765392677, "uuid": "8d8d30dd-3ec2-4393-acc2-7ffde2c8f581", "value": 91948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765392677, "uuid": "1fc7c013-eacc-4b13-b54f-9a2021cbd57e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765392677, "uuid": "d6075c9a-852e-4ae3-81c5-f44c839ee3d1", "value": "Labelloperc80.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cc09620-d5b9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765365147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765365147, "uuid": "cc48acb8-bcfb-4e42-b7ee-1164e3534220", "comment": "Malware payload", "value": "a678d751041c4767dbd7391226d24db0", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765365147, "uuid": "69ce4468-ea46-4592-b00c-9fc32d22bce1", "comment": "Malware payload", "value": "96f0824bde001fd1f7b28a58c68fac114f76e24857c5603906095644bd2d671e", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765365147, "uuid": "035f88a4-4271-4338-a417-2696ef05a39a", "comment": "Malware payload", "value": "ea6248ccb977ee604691e0c800a37d4fd20571a2", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765365147, "uuid": "4b97e5ea-f2af-4bff-a360-c8ac8abd2153", "comment": "Malware payload", "value": "87fbc36f88335ce714124b66c1ff095816d9fcb16b27c4ec509e2b0603365fadf8ab911521a38eb3ce3495e2e4226c78", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765365147, "uuid": "338575cd-360b-4103-836b-6c31ba597429", "value": "T1F62833842551D44FE2AD477E09E1DA2DEA9262FB9F6A9003CBB024C10F233DD7EB1759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765365147, "uuid": "87524e97-715d-43d9-b469-943e02382b81", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765365147, "uuid": "369bc992-ba22-4dd0-baf1-6fcc7b829ae4", "value": "1572864:CEWA0WKceibapIhRFr7fN0G94THEZQiI2TsacZehmqZ8sEu6X48ZTThk8ok4tEm:CEWbDceibJjz9wHE8fcp187ZRfh4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765365147, "uuid": "85e463a6-6e65-4abb-87c3-119ff1e2efe9", "value": 93371304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765365147, "uuid": "d81e88d7-1898-4de7-8574-162860c9898a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765365147, "uuid": "756fdb2c-2d21-4de0-a79c-f91a9f843849", "value": "HackerDoomsday.beta.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8619beb-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkCloud)", "timestamp": 1765345249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345249, "uuid": "34e36bc4-948c-43d8-a188-4d4cf1e1c7c3", "comment": "Malware payload (DarkCloud)", "value": "40992991002f786cb60c26628b1c43da", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345249, "uuid": "04c69940-a8bf-4212-b2a1-ac4fd143d005", "comment": "Malware payload (DarkCloud)", "value": "96ffb93ccc5265198ecba5de0bda1a02720381b1ce4c807998f2450696baa2aa", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345249, "uuid": "8c895575-605c-4936-bbb0-680e632ae645", "comment": "Malware payload (DarkCloud)", "value": "db707c40ea6d3294d716c4277b8fe5c7d342c587", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345249, "uuid": "dcdf39b8-0e6a-437a-a405-a267a6823636", "comment": "Malware payload (DarkCloud)", "value": "ce709023d9655ee55acdebdf36cd290d7fbbb7525b8772341376574f74ac459ae005333ff7cde60387cb25aee09cb8e6", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345249, "uuid": "e8b794c8-4c5d-47e3-a8d9-feb43b87c1e0", "value": "T12F7512FC5EABEE83D7F9D22A3CB69A3191279B2C232BD14F413B05DB118996D5DE1004", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345249, "uuid": "f1b782a9-ca4d-4d20-9880-772437afed81", "value": "768:lMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMB:1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345249, "uuid": "7dc01c22-d4cc-4f3c-af92-9e429329fe65", "value": 1652705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345249, "uuid": "c8885c56-d474-481e-b1d1-23b92afc3bf4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345249, "uuid": "d6055d0c-89f1-4d6e-9e4b-d838e9b6f7e4", "value": "scan11062020.doc.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca36cdd0-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1765345252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345252, "uuid": "0f8d3638-a92a-47ea-b4c1-e6c64f88964a", "comment": "Malware payload (MassLogger)", "value": "a7bf8c3d79f84f164c7fd586df0311a0", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345252, "uuid": "2d51b7fc-efe1-4be1-b849-1fa502f03e79", "comment": "Malware payload (MassLogger)", "value": "996dc4dc82537cf5ec2fd334070a72ff4840a2394ea7f3ad722155337d988062", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345252, "uuid": "3d179da9-a43d-4ac9-bd8e-73559b8cb689", "comment": "Malware payload (MassLogger)", "value": "faf871a949b984854263324946eb69656ce71275", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345252, "uuid": "387ad790-80df-4f9f-aa0d-119fa13039eb", "comment": "Malware payload (MassLogger)", "value": "0a950a6b291774baa37e18f0caa6b9286e7aecafd61f024ec97e308755e5333c06f103c51135e12a488ee355b9a0194c", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345252, "uuid": "28a6d169-1d3f-4b07-af48-78c4784f7429", "value": "T1A255F25D4061ADC2A004FEF0F541AFA7CCDB5798122746121FE168AD6322D83FFAB6E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345252, "uuid": "bc95db97-90db-4178-9ad9-b38b2a9f5775", "value": "24576:VmVYSmZDjwX0D9eg9X8wfDJfnBKIyMyt6LtLUaGtt+p:e2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345252, "uuid": "fb271fde-07d6-494f-81c2-c0f67c5593d1", "value": 1303532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345252, "uuid": "d985da54-84cd-420a-afb5-0a7603573074", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345252, "uuid": "8f494b0e-d7d0-4ed8-80e1-8f2aea1db5d1", "value": "EKSTRE - 1244.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba9af88-d5ef-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765388419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388419, "uuid": "364e4fe4-db11-4313-9190-4f53eab30c76", "comment": "Malware payload (MaksRAT)", "value": "7c0fe347f87c91ac6679d57706946819", "object_relation": "md5", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388419, "uuid": "7be3292f-666b-48df-8eff-d497a79f8267", "comment": "Malware payload (MaksRAT)", "value": "99ff2c6d97f1f34acf6af073ab7d97202d5329d1dc1c65ca72f72b8a1cdf7c9d", "object_relation": "sha256", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388419, "uuid": "f7f80649-7174-455c-bf00-77e699a087ca", "comment": "Malware payload (MaksRAT)", "value": "2aaa327704ad4880dfdd5cfeeb8c72bb6d7c3cc9", "object_relation": "sha1", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388419, "uuid": "d8b27620-41bd-4bca-a70b-06c19b974399", "comment": "Malware payload (MaksRAT)", "value": "9f6789c285e4396320f359b01ec01365cb1a6d8a809e3f1d1acb49228fd0aeec058571b7832ee2788287968602653c39", "object_relation": "sha3-384", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388419, "uuid": "c409097e-e3f2-4155-8341-f78cbbcb6496", "value": "T16AE2E155BD9AF68AC2D74831610D8563ADED2B3B37B8E54F07B4A0606C314A4CB81ED7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388419, "uuid": "a2789a89-abdb-468a-8e73-114aeefb9671", "value": "768:wmSCaymhEuo0Pk/69fhys5FlnlAlq1/kzICBQ:wbjfXMts5Fln6l2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765388419, "uuid": "01374fce-e168-4438-b2c8-12d3e1c89d4d", "value": 31701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765388419, "uuid": "afd313cb-07da-41a8-b25a-6e37aed8dc2d", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388419, "uuid": "4c63932f-6f04-456d-9c73-061e8a45ac2b", "value": "99ff2c6d97f1f34acf6af073ab7d97202d5329d1dc1c65ca72f72b8a1cdf7c9d.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6de924-d5bd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765367163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765367163, "uuid": "dd9c69e8-8b0f-41e4-a0f7-0d36f35c113d", "comment": "Malware payload (Mirai)", "value": "32450a70bc0c080d773e6191fe3a589e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765367163, "uuid": "14f69b45-bad8-4d07-955f-a7e289aa71ac", "comment": "Malware payload (Mirai)", "value": "9b8020883de80c73cdb74172e7f51d74f3dc120b8160e26d13982e6bab610d48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765367163, "uuid": "b03f6b00-3cf9-499e-b9b8-82433b978d64", "comment": "Malware payload (Mirai)", "value": "be5781c647699121ebcfb934c9683b1017dffe3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765367163, "uuid": "3238c97d-904a-4090-99f7-1d7f0d637277", "comment": "Malware payload (Mirai)", "value": "ea1278f13248af3d7f80c1bb07df2ee4615db28ede391ece12ae32c7972e3eac3fdb447de84125ca5fe8cf579a91dd1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765367163, "uuid": "22da21c4-1aa0-45e0-b5b1-71cdcdc52fb9", "value": "T19E8302F60AABD695D23EE0330C3E6D871D38F1DA9AB1D522518E64075CB27A2B6174D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765367163, "uuid": "d8136bfa-067e-472e-a896-ed61513ab1aa", "value": "1536:Sg6mn1asDJsLG2ao8G2Vt9x5L6zKbv8QVC1elyrNaH2MzDk7Gavfnouy8GyB:36m1a3d09rx5LIqQpU2EsGMPoutl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765367163, "uuid": "406ab8f2-5f5d-41c7-a56c-7e8a8b4a474d", "value": 85080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765367163, "uuid": "db63bb9d-d112-4b1c-9b13-663b5957453f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765367163, "uuid": "ac46fb9f-f29e-402e-b94e-219bc0c832be", "value": "ecco.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e62b94-d605-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765397965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397965, "uuid": "4c5deda7-5260-4b36-9c3e-3ef53ec7b4e1", "comment": "Malware payload (Mirai)", "value": "07e3dfb52de9b9f83757ae49b9bd47a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397965, "uuid": "d37359a4-f430-414e-9e3b-4da0a75ed3ec", "comment": "Malware payload (Mirai)", "value": "9b88fad94aa891e919aa4928f43d77a616444bb2c7ccd3e0dcb1a17eb83a2729", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397965, "uuid": "3465f2b0-ac71-4c88-8661-ebd0839a8553", "comment": "Malware payload (Mirai)", "value": "bbb86d9307eb770b58b22eaa3f985815fffd0972", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397965, "uuid": "35025fdd-2a6f-43d0-af9b-e71c0b3562eb", "comment": "Malware payload (Mirai)", "value": "2f6115e84228214c610661e675f2f68771e3e2cd3e016620b2eec28c94cfcf19c38dd03c14aac5c608024c0b76143071", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397965, "uuid": "c290651c-570b-4058-b689-0e78d384f38b", "value": "T145835B0375C080FCC899C17557AFB536C873B07E1239B15A67D8EE167E8DE502E6AAC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397965, "uuid": "3a03bb03-97c3-4cb5-a3e8-7354d67076fc", "value": "1536:lOXfVM30j/FkcfTfoExJg3/Y71GS3ih5pRz+IVhYEcY6XN0:kXWEj/RfTfoA661GS381z+IVhGtXN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397965, "uuid": "58d51272-844c-4591-be13-bb5ddce4c1af", "value": 85728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397965, "uuid": "a6a7b6ca-3cac-4cbe-936d-b298e15f6831", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397965, "uuid": "4e2d6263-d7aa-43cc-93cc-9761495608eb", "value": "Labelloperc80.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c412339-d598-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1765351080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351080, "uuid": "28297527-42c9-464c-b0ac-a8b28af235c7", "comment": "Malware payload (PhantomStealer)", "value": "4b5b17aad8614dc218b1ef5e1bbf3c70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351080, "uuid": "b9f19f0f-c02a-4d26-8b0c-fa861d795756", "comment": "Malware payload (PhantomStealer)", "value": "9cc5cdea4142d9a4bc45760ae691a929b9a0566091e2e63c9dcb774ad5a903f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351080, "uuid": "ffe7b737-be72-4139-a9e2-1d76bf646e78", "comment": "Malware payload (PhantomStealer)", "value": "727a9152c74dc935d4a38c58a3748f3cb0792924", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351080, "uuid": "c1dbb8ce-bc53-40f2-b1fb-6cd08a5f2ab8", "comment": "Malware payload (PhantomStealer)", "value": "fdb39abd1c3ad63eb6981fc75c7f27968f28c864569e28682164591e7b6f95ad75a48c474641eb8333ba78b533da2d83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351080, "uuid": "e04944ca-e327-47e8-b425-aa4795e748c7", "value": "T1E0B5F1027381C062FFAB92734B56F6115ABD79260123AA1F13A81DBEFD705B1463E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351080, "uuid": "24118e53-ba7a-401a-939d-c5d6b0963a8a", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351080, "uuid": "3ff5ba60-05cb-4b41-bf4e-4fca788ae362", "value": "49152:jPVtZLZeJbInQRa6d7H2aAfJcDKFaa3NDmg27RnWGj:zFYbInQBH5AfLFn9D527BWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765351080, "uuid": "d4c4b673-df58-42b4-ba26-ad3af24e82f1", "value": 2293760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765351080, "uuid": "34a4380d-eaa8-41ae-9de7-cbaa6af7c875", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351080, "uuid": "057ccd6f-c4a9-4356-9991-ccdc9b0960df", "value": "SQ2025_9668_NO_2025_9713_QB05250400_0328-PR_002619.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab16b17-d5f7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765391880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391880, "uuid": "0e56745e-99c2-46c7-9093-9f14b6e45a82", "comment": "Malware payload", "value": "975256d096f25caa45cdd0dd5eed8fc9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391880, "uuid": "18315917-ad5a-4861-8c77-61defa25e29f", "comment": "Malware payload", "value": "9d7e3e0db26fa6b2c41e0f4947564a42e1621515366cc8bedeefd58368d699aa", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391880, "uuid": "2c5375fa-bea7-4ec6-af13-a14880f4da63", "comment": "Malware payload", "value": "b34ee1136ed3ae326e09b732a04dba1831cbade1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391880, "uuid": "5d550860-ad8a-49be-823d-702291b47523", "comment": "Malware payload", "value": "1ffa7cfb4b7b17f869764b877c999b717639cc84ffc497b86cab37180ec17a5a361915651df11bc3f0f9dae1daf3a441", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765391880, "uuid": "2fd255db-ab1c-4da9-bd3b-a04d4ce79a47", "value": "T1E8F533643BC76C44DC76CA9453DD975E5F4127DC16CE02B842828A2DF74369CBCE8A8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765391880, "uuid": "b59a99a4-8422-4349-b7a9-713f63e3b458", "value": "49152:jQXaP3e+ejo0wiJltG6azbpDXfajg45rgERLalYKGE04izwwUmom0930qSQ0k6qE:jH3e1J0Df345UyLaHGZ7UZh0qSQb6qKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765391880, "uuid": "83feec47-d089-4c2b-8143-efb640fb0e18", "value": 3434835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765391880, "uuid": "46a4944d-3c7a-428f-87aa-669babf4fa38", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765391880, "uuid": "d8dada7f-2ff2-400a-adcb-8e093d1866a1", "value": "Tunnelling_Certification_Course.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a380e1-d5ff-11f0-a129-42010a9c0007", "comment": "Malware payload (NanoCore)", "timestamp": 1765395306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395306, "uuid": "8b8dc0e3-564c-4fd7-b578-3a16610d275c", "comment": "Malware payload (NanoCore)", "value": "f1f0e5a5991abd1516a384f26189a7ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395306, "uuid": "eb6d4b7f-0a89-4c49-bc64-289fe1458f2b", "comment": "Malware payload (NanoCore)", "value": "9d896e56913f4f9acf566032bd3b725d65a4bed226221fd8ccc64e158d263266", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395306, "uuid": "346131cb-6bf8-4af1-87c9-fbe01ef971bd", "comment": "Malware payload (NanoCore)", "value": "1c36fe3d660b9d22c70bc083c46759242396abb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395306, "uuid": "eec7f06f-4b71-40a1-86b8-fdb08a896e6d", "comment": "Malware payload (NanoCore)", "value": "1e9857e9de65d01139ed1f0c1a42b38ed9b7ec3a266c691dd1a0a395f145d5d47a5a89810c989b7ef7b28d1a89abad17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395306, "uuid": "be3a8d2a-2817-45a0-8ed5-a2665bfc6c1b", "value": "T1C314CF1537A88A2FE2DE8679712202138379C2E3E8D3F3DE68D455B75B667E00A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395306, "uuid": "50cbd340-6566-4c70-aa84-39b781149c10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395306, "uuid": "d60d0f0c-8f16-4f3c-9dc2-f407ef5885f1", "value": "6144:QLV6Bta6dtJmakIM584Q4cpvMPFGDqMiQz5R7/3s:QLV6Btpmkn4QRFBqMv9R7vs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765395306, "uuid": "8a7732b7-3791-4a88-aaa7-a54411f01f51", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765395306, "uuid": "930f7602-2df6-45e9-be0f-333b1e290ccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395306, "uuid": "2e4ddc04-e053-4fef-9398-96f88fd098bd", "value": "airvpn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58796d39-d5b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1765361811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765361811, "uuid": "32da026d-e896-4069-bb60-5438889905c6", "comment": "Malware payload (Formbook)", "value": "55c77b3807bc7ad34146698ebed07462", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765361811, "uuid": "51b1e5b6-c1cd-4118-a4bb-a62ab862596e", "comment": "Malware payload (Formbook)", "value": "9e3448b29c55aa5f0fc081bfff05ed59ad5e7ed136161cf632d3ef43a4c4b553", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765361811, "uuid": "1dd7389f-a117-42f1-9157-570ec63c5fa3", "comment": "Malware payload (Formbook)", "value": "027b301e9356fc5b820edd43d469558b74d3b544", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765361811, "uuid": "d07c282b-3cf3-4eb4-b070-373f469ac9f6", "comment": "Malware payload (Formbook)", "value": "d83da93be4c0149994c6d948c123d03721e008449a5d34c839910aed342e3be1dbd3bb73abebb39b84579dd7a3e4c43b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765361811, "uuid": "d35ca630-01b3-4737-9c2f-5e86514edc9e", "value": "T10175336D53914911FC9CD29C908E9C0A1CF1E86A4CF803A6535C898C8AEBDB73F5977B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765361811, "uuid": "b9a89d80-645a-40cf-8159-624e887a78cd", "value": "24576:vBMlqgJ651uPU0LN1Y0fgjYv3cxqKNh9J41Zf+4swG5mIP9yJ1/3+LIrw5n0hBp8:vcR8CUGEab3cP39611+FP9yJUqIM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765361811, "uuid": "fd77afd7-6a96-4072-a31c-94b7d51d9157", "value": 1550053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765361811, "uuid": "816fd826-7fc2-45e3-a067-5f1d6cd6a8d8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765361811, "uuid": "96254009-4c3c-4b7f-861b-c28e7a57ee93", "value": "RFQ- PR Ref 34838 ITR6967.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09619900-d61e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765408494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408494, "uuid": "fe37204c-ae62-4977-8eaf-a78acfcd6178", "comment": "Malware payload", "value": "3f5d3afb30717d73622e3e12a155b276", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408494, "uuid": "80e36835-f312-4a2c-a0b1-9310b875101a", "comment": "Malware payload", "value": "9f68956032187858dc71a1361ab655023aff1fc15c13aae0b58920777259290b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408494, "uuid": "51c72897-df34-4115-abd2-6b3f594bd6a4", "comment": "Malware payload", "value": "80edbf7e66538319ecd04d157787360a26d810a3", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408494, "uuid": "4cb6996c-d6ac-4c49-82d9-c02fa368a3d3", "comment": "Malware payload", "value": "48653f56e1a51275757809c14dfe0360b63165f42cc35933187974c94a6b1f54183c394f81795f412a4157af4a8898d7", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408494, "uuid": "8fc1a10f-8325-4b27-ba1b-d0ec41cb778e", "value": "T10D54012D19F10FAECFE45F483C692C8B031192C622B7119EFA5BDC416BEE68A157B05C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408494, "uuid": "9ff1f5ed-abdc-43ce-958c-12bc76053bd4", "value": "6144:T/f4r21W+uaZdpgniS3RjoPYM6mcMlZcLlx/J8Ty+xr:T4aPuiPFS3RjoPVAt+Hr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765408494, "uuid": "837a4f51-6b1e-4094-a304-016499a97813", "value": 300642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765408494, "uuid": "fa509113-deac-4d6f-a1cf-8b5e047476d6", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408494, "uuid": "03b4057f-4352-4f47-9508-368a01daeaff", "value": "Presumed.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b264dd9e-d587-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765343923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765343923, "uuid": "de694330-a450-43e4-aeb9-da1654652ba2", "comment": "Malware payload", "value": "0d6af682e66c2226a295aa3e9cfbe957", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765343923, "uuid": "c041637b-0287-4d4e-a895-75d1dcad6e78", "comment": "Malware payload", "value": "a0bf7a1b9651a41c33723e160901a7b27a8a871190334e4036dd8c996ad8670a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765343923, "uuid": "f7c86bb7-30e8-4270-896a-90fa91df5a07", "comment": "Malware payload", "value": "1cf6f31377475ea89bd0fe0b52a8dc4d8e5cad3c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765343923, "uuid": "c79a19e4-da0c-4b26-be4d-214caf9c3e99", "comment": "Malware payload", "value": "b84f6398f21bffce87b5049bcc81bbd920aab030d7e93e091c39c5eb18ff8720952e7b67b59a7eb832790bd41b1f49d9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765343923, "uuid": "f6b9cb67-a0e5-45a1-a034-f57593598bec", "value": "T1FEE502BB58B2A9576A504663E60F2C1E339F19E53A14D302E95190AC7F3B1D38FA1733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765343923, "uuid": "40aab1a9-5117-4483-b096-5f905176e859", "value": "49152:dOc2yD4lTPxnQ1oL80/qGnYSO6HnFCbMTJ1VNr9eOnmxBuW79H74TpJEq:doyEFPxnQ+L7qqzOMVbetBuW79HU8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765343923, "uuid": "aabcefaa-7061-4b7e-b3fb-83672475c637", "value": 3097521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765343923, "uuid": "87bf6627-6908-433b-8717-b477db6ffa19", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765343923, "uuid": "c7ff8d00-7871-493f-b6a4-1bc1345d55fa", "value": "REM 2526 B101.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e41738-d5b6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765364176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364176, "uuid": "0f8e4b94-436d-4ac9-97ac-fce0520243ec", "comment": "Malware payload", "value": "e798e0a0be3b76628dba6be397f2caaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZetaRAT", "colour": "#C6A431", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364176, "uuid": "c2fbb79a-d72f-42be-9ab2-539d595cab3a", "comment": "Malware payload", "value": "a103d477621b4e43d13e601ba6a0390b9d95671c792f981c32b0cfffec39d878", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZetaRAT", "colour": "#C6A431", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364176, "uuid": "15b2297e-62df-4cf1-ab13-5da8cc4ef4a5", "comment": "Malware payload", "value": "fd5fbc714939dd48e4b5f38308915ad346d5763e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZetaRAT", "colour": "#C6A431", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364176, "uuid": "e52ef095-2824-43fb-8648-01c72ee9b096", "comment": "Malware payload", "value": "0e7dcbb4913f175f75e8a33fa88a6c5de2299fe98e1adfb5f469d508a00cc1eabe7a49fc7646076e28556ce0d81672e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZetaRAT", "colour": "#C6A431", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364176, "uuid": "613719be-db5a-458e-b85e-7bc54b447f8b", "value": "T121966B07E8A144E9C0AAD1718A779253BB31BC481B3127D72BA0F7382F76BD06E79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364176, "uuid": "cd95f91c-7558-48e5-aca7-32a6440d0f83", "value": "7c91a9903b1d46d1619133196a51d94a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364176, "uuid": "bd28e896-4620-4d60-84d5-02fa640d45e2", "value": "98304:VdCCJHn6LK5esLO174gmOtauEP8KKbHJ:VUy6+5ef1sgIVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765364176, "uuid": "a03c236d-6869-40f8-8a13-338130b47897", "value": 9161728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765364176, "uuid": "ee5202dc-329b-49d1-bd9c-5ee213b2aa5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364176, "uuid": "32a4f045-5c67-48e8-8bd9-3c52cd1efc6d", "value": "zetarat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d760246-d5a0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765354491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354491, "uuid": "1dcc0a57-8036-4e20-a14a-654493bd4929", "comment": "Malware payload", "value": "d9e00054bb02d3830a79aa4843aecbbf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354491, "uuid": "0de571e6-7075-4766-8a00-0266b7bf324f", "comment": "Malware payload", "value": "a112042b0af82cbf3dcde4d0764b9e4f5392d1df1db6d8bdd7bb8f1160ed1f9c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354491, "uuid": "2452cdc9-8e5b-4bbf-9848-7295226d641a", "comment": "Malware payload", "value": "075e287e26db2d6d6b51fd92153b82455678c8ef", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354491, "uuid": "581d9b09-7073-4da2-b18b-38d5e9e27508", "comment": "Malware payload", "value": "0165cc1f04c787cece4eee44903a61e490d4afbbc6ff1112d013764d74b2300b277bc9675211291df0263c50bc2984e1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354491, "uuid": "2c9aabcf-7f70-426c-a12f-8ff98d3975c8", "value": "T116A1E8CA395033338D949D3DF2F58D1F2092D0C086364FA8AA5974FD76ABD44FA50EA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354491, "uuid": "5f07a16f-5f24-435c-99f5-60ecad076d0c", "value": "96:1xAN8R9Rc2ogXjPwxARRVgqkMXy1SYXXofpfP:pTXjPwxARRyLMXyHXXofpfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765354491, "uuid": "e766758c-27cd-4a73-b283-c6b1a845be7c", "value": 4758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765354491, "uuid": "74bcbe8b-9efc-426c-9a65-0f69a0e2b9fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354491, "uuid": "8ad298d2-81db-4287-a4b7-7d122cada357", "value": "dvr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201ceba6-d5b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Sliver)", "timestamp": 1765363864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363864, "uuid": "1b302f1b-5840-4c97-9fb9-769e66aa4ee4", "comment": "Malware payload (Sliver)", "value": "c5b6234baedca236c278effaf331caee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363864, "uuid": "accf1342-4853-4222-ae25-0d988c75655a", "comment": "Malware payload (Sliver)", "value": "a316f54c1e2d594757554fcdb4b66d6fdd399eaea0328491fccab16b701ef033", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363864, "uuid": "629d2e80-4866-4d1b-97d3-e7009df4660b", "comment": "Malware payload (Sliver)", "value": "e390e153ad554f496228f2ed8ef17f58f20bcae9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363864, "uuid": "be623cbe-5487-4909-9fc5-3955d81c97ed", "comment": "Malware payload (Sliver)", "value": "e0f2c66fc429eadf952e06b969bf07cb7f7a2afbd967ee5cda8c50b8f1017159a23fddd90dcd37fc396e894d49cf2cff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363864, "uuid": "62500377-d845-4f3b-8bbf-796b90833ce4", "value": "T102F60903F8D510D4C4E9D2B489214261B971786C1BB973DB2BA1F7B42B32BF05E7AB91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363864, "uuid": "dcf9602d-2e1d-4b2f-b5c2-71634469fb28", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363864, "uuid": "b505c496-357b-464b-bda8-9d55fdbfcf22", "value": "98304:B3J8oS0JT8SuCPyAJ+PM4ArivHGYECmb3E:hJXSQOQUkLivYCg3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765363864, "uuid": "260c3e28-217f-4b09-8fa8-4849bbef33f1", "value": 15668224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765363864, "uuid": "8c330cc4-64f7-43dd-acaa-5573d7f0f46e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363864, "uuid": "8a96b599-e660-4bc4-b96c-f8100b66a4b3", "value": "oootl_ru.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48642606-d5ef-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765388413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388413, "uuid": "5b3342d2-8b9b-48e0-86c8-384ccc988421", "comment": "Malware payload (MaksRAT)", "value": "7cb709bed8b704adc655d7ff03ca35d3", "object_relation": "md5", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388413, "uuid": "db3e2ba2-97ce-4699-86c7-ad03e06df0b0", "comment": "Malware payload (MaksRAT)", "value": "a39a1019f6664cf2b1160158ac52c1ea3a726fb4983f368b851511d82dae77dc", "object_relation": "sha256", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388413, "uuid": "57cdcd3d-2e4e-440a-bf1a-a6044840c463", "comment": "Malware payload (MaksRAT)", "value": "d82b4b0f61075c9294980fcf66354bfda643b62d", "object_relation": "sha1", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388413, "uuid": "be89993d-22e9-4a42-ada4-143aff2dec3f", "comment": "Malware payload (MaksRAT)", "value": "873376010ea4f6001e8e3ff9d8add5c53c51956143a9f5f44bea1ec7477542bd7dbec19a3ec08394ffaa0c64dd9b2cc1", "object_relation": "sha3-384", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388413, "uuid": "1415bad5-9299-48e5-88ad-29d945b1c0d1", "value": "T1A1F2F04C05705855E16361F86DE0B763920AD6F63A79F086026EB0FDA704CABD79BF1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388413, "uuid": "78e66673-449b-41f0-bee6-de11c36c5f56", "value": "768:g2GELkzQdFdPxx8p6fauQG6W4ixcPFiG7OdkTAi3NcilqzQ0NP4:gh9Y+6f9F4hFDXTX3Nvqk0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765388413, "uuid": "ab5e6cd4-3fa3-416b-a6f2-351fbfd491c7", "value": 35793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765388413, "uuid": "43b72693-31ef-486f-8357-3006f150317d", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388413, "uuid": "6cf60a99-21e4-438a-a393-ede7377da412", "value": "a39a1019f6664cf2b1160158ac52c1ea3a726fb4983f368b851511d82dae77dc.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff7cae3-d5a3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765355892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765355892, "uuid": "4bb50940-72f1-4384-b585-0afa4fab74d2", "comment": "Malware payload", "value": "5e9b0df289e0e9f3b45c260f41a1b273", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765355892, "uuid": "6c524f8b-1efb-4a56-be06-fef71f0cfacc", "comment": "Malware payload", "value": "a3afe77a546d43e2cbfb2475d08c67faa8c5fad832cd58c069dfd4b476b7031c", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765355892, "uuid": "285dd5a2-c369-43ed-9a0c-f275f0cb14f2", "comment": "Malware payload", "value": "a61080a94f56982978724c899af0555f33ef5fd1", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765355892, "uuid": "93b09f1f-17a9-4ca4-b541-58fe3aa25fa1", "comment": "Malware payload", "value": "6c97a71790b38434a02f6642d85e290a94486f96f12bd683a74a2bbf265125efaf6c8c4b88db87bf461450304893322a", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765355892, "uuid": "024a7b14-2d85-43b6-bb7e-007bae223497", "value": "T168C24CD727880BE9979C4CEA411439579CFEC5673C292288F9D246DFFC3AA1C7429A70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765355892, "uuid": "a15f075f-4f9f-42a0-8ef8-27c85280ba91", "value": "384:c/U977W95Aly0Mz+QR3jHp5QnwROO9rccrF8xhel8apYPtlHaMuP/QZwDni:4+oeaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765355892, "uuid": "5261cf3b-281e-4301-a5f6-5497747bf724", "value": 28132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765355892, "uuid": "b8444698-bc14-4f4c-ae2a-acffeff39a5a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765355892, "uuid": "935eb017-203d-4377-876b-4e88e533f837", "value": "loader_f_b_obf_fin.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d4ac4b-d588-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1765344110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344110, "uuid": "6a1d6281-1c8b-4f11-baf8-fb3514347053", "comment": "Malware payload (Vidar)", "value": "5eb0a68ad0322f002da4ace4f5a01cfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344110, "uuid": "0ce512cd-756f-45e8-ae2f-dfb882d7fd1d", "comment": "Malware payload (Vidar)", "value": "a3bd8e023714bd799fb7d0502f6863b802fe091df367035c24550e2526b5c59d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344110, "uuid": "ae8b75a7-d59c-4ae3-8a61-de401ac85697", "comment": "Malware payload (Vidar)", "value": "801de362717abd7c986279cc5f9fab9c16e2bc27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344110, "uuid": "27c23b5b-b3b1-4bd5-896f-a2bf8469bd66", "comment": "Malware payload (Vidar)", "value": "49bccccfc45586220ad0a270e3f2c7a1be905f6167dff09bc70561596c75b7d41102e744ace2880f79538f6ce80f559c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344110, "uuid": "921396c4-b8f4-47ac-8ab0-861a00fabf9c", "value": "T107864B92BA958529C9AFF23890506261B7307C5943303BE76FD81AE94D3ABC4173FF19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344110, "uuid": "0540c0e7-d6da-4b50-8565-8ef12e984077", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344110, "uuid": "158faf06-c631-4a67-a01b-483fba64c86b", "value": "49152:xMaxh3xcIZVRr2xB2vtmqNNRuRbDQWGXKBoRfzURSK1oy:jxh3Mf2/NXMbDQWuPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765344110, "uuid": "223a186b-d6d9-401a-9bc9-56a0ed17febe", "value": 8140416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765344110, "uuid": "8fc9244a-241f-4dec-aade-f7d522842630", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344110, "uuid": "83ba0066-3bed-4adb-a904-9085fde86095", "value": "a3bd8e023714bd799fb7d0502f6863b802fe091df367035c24550e2526b5c59d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d81111b-d61a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765407024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407024, "uuid": "3794fa60-dfe7-4d5b-937e-3ef53be7fcce", "comment": "Malware payload (Mirai)", "value": "1d9d0d62d9a7e28b615b649cbac336e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407024, "uuid": "452ca34c-d002-4e9a-b002-824423eca655", "comment": "Malware payload (Mirai)", "value": "a3f8af335753ff65ff59f1aa8750300d3fbf930687989fb2e244f2fe604f07d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407024, "uuid": "b096290e-312a-43d2-9a64-38837ce5fcd0", "comment": "Malware payload (Mirai)", "value": "c21347b0b70db83aff1974b827da6d0298644a5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407024, "uuid": "bb1a94f8-8ee0-40a5-b791-d1b20738020c", "comment": "Malware payload (Mirai)", "value": "bf71f574d7e07cc574146744c31f876f2bf45347cca5f1a9b65380d2e4c817977d9373fd0bc6e4e9f2026ff01bd8c5bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407024, "uuid": "cfe10605-6df3-4f79-a9a1-f38f74c67593", "value": "T120733B127A792D17C5C4B8BE22E74374B2E5130A36ACC62E7D720E9EFF105046617AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407024, "uuid": "bbee6ce7-3e44-4474-b981-b480a807240b", "value": "1536:gQFp1M5S8XrS+4YiMk+GlZ0iEVW1BH2/2K8iIEqZ8e+lzH7LhJ:g01HKiBXMQJCe+lzHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765407024, "uuid": "ab1452b9-45ad-46ad-92af-10332b77d1c4", "value": 74632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765407024, "uuid": "72bc4de1-564d-42ab-b5c2-89da9cb6faf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407024, "uuid": "5cc967fc-a085-444c-9f1d-a7fc9eb97db3", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf1ef55f-d5b6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765364131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364131, "uuid": "21e45387-d298-4925-a35f-575e654cdb57", "comment": "Malware payload (Mirai)", "value": "cba41f1ab60338b1456d774429a68439", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364131, "uuid": "1eb8aceb-f222-4496-ada3-ee1654c7051f", "comment": "Malware payload (Mirai)", "value": "a43e7cc68d7207ffa403fa33347aab9e1c5f6789b631e07663e88bf20e9c3bc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364131, "uuid": "918acedf-8290-4850-9da7-f5ad8138fbeb", "comment": "Malware payload (Mirai)", "value": "085f6ef9defae730586e8bf2df83574493a7ee3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364131, "uuid": "cbdeae17-26db-4067-9dc6-5d841db43350", "comment": "Malware payload (Mirai)", "value": "50585717e2da180588b6143b559cae91215caa2b189e05f07719bb641a1d4a2b223ad060526680096af5a5ec4927af2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364131, "uuid": "ce7d6eba-39bf-4d91-8e9b-b16754a0c8d7", "value": "T10474B60E6E328F7EF7A8873547F78A20975933D213E1D584E1ACD6150E6064E742FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364131, "uuid": "a1774a92-3956-40ee-b027-0a1f9ddd3195", "value": "6144:gQQPblZZ4cLmy6ENhIQVxLAg2eVjcpS/jbMW6DKyEFX3kBsMT:g54ULAdCfhWENk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765364131, "uuid": "e1eaddd0-a05c-4677-8a96-67fa5c72f8e4", "value": 344780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765364131, "uuid": "ef949feb-ffe2-4f63-af32-baf6db9f67e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364131, "uuid": "bb3b1d0d-7175-4b09-a4e2-2917e856b896", "value": "ecco.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd713d2-d61e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765408662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408662, "uuid": "21e225aa-d762-4afe-9217-6ebd89599b69", "comment": "Malware payload", "value": "be9102dfe92f641d22d9517254b75b1e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408662, "uuid": "2ad47cfb-bba2-4f19-a029-7408d15f6f59", "comment": "Malware payload", "value": "a5705ab2d31af4cdb4e1ea13735f2b31d394f98550162fba3ca9287ec5f8e221", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408662, "uuid": "93968040-3f61-4ca8-83b9-b673ad9e72d1", "comment": "Malware payload", "value": "5f8b7ac4e796aa6405791a45359b29dff3dfeb43", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408662, "uuid": "070e679c-4a2c-4509-9267-0f56488511ab", "comment": "Malware payload", "value": "b9b6e72b77f3a5457b9cbbbe6c6120c4521a7f6186c6a2b88aa08796ea69ba95ca2dbd591dd91c598f75cabd7a488dd5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408662, "uuid": "57ab26a6-532a-4a7f-bbc0-7952ffca3521", "value": "T1DD3104AB55007C74FDC9A062BA038A5AE53216EB68578CB5EC49F7346D4CDB87830E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408662, "uuid": "2fa62713-33c6-450f-ac6c-b26d7c56b37e", "value": "48:2PqdpqdaquqHq/qNpqNaqeq3qf6qfkpqfkaqfDqfWq5pf1ZkWkWYWMW4Wp:p81Ux1lWkWYWMW4Wp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765408662, "uuid": "1c929c50-5e16-4aa5-8124-54c8afd29b13", "value": 1784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765408662, "uuid": "7b92305d-74ca-4f31-b604-5a9f245a1b5a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408662, "uuid": "b6945676-68e7-4959-915b-d2eed5a02a43", "value": "t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b62d736-d5e9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765385922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765385922, "uuid": "6dc84d45-9030-43ad-8c76-2ee4601118ef", "comment": "Malware payload (Mirai)", "value": "3350f0254b005017a24147b9e645e6a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765385922, "uuid": "a0bc4586-7cfb-4d92-b3cb-f0666c309e50", "comment": "Malware payload (Mirai)", "value": "a57857c73a03f52fd9dffb237f1ab4f1f9b01badcbad44708e05b49b6f0e1dc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765385922, "uuid": "caf0a716-c642-43cd-a61f-71862932b242", "comment": "Malware payload (Mirai)", "value": "508af79a2805526909192d7893a3d18afa2aa24c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765385922, "uuid": "f39c04d9-8c9d-4e2d-a2e8-fbf769653a2a", "comment": "Malware payload (Mirai)", "value": "1ab3c8ce294872049d610d608755f8b73f6c7d56b03aaa7ce53ea80856967494b61b41bc903cfc0c19f85b829fc24f03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765385922, "uuid": "56ffb4b9-4a8a-4bdc-b305-dc6be604cbe2", "value": "T1D9B35B17B29084FCC48AC2744A9E757B9971FA7D0139B2AF17C0FF223DADE226A1D550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765385922, "uuid": "5c855f9c-188e-42a2-81c4-6ea45453fbd2", "value": "3072:BgeP0V4/0UgNd6ecdu1L1pehHoX1cagRy+JY2FIs8yK:BgeP0V4/0rMCL8CPgn6Js8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765385922, "uuid": "4ff89722-fcc4-4ef0-ab59-9daeb60c01ee", "value": 109648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765385922, "uuid": "f21ab9e9-8c13-449c-a413-39d0ad56404c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765385922, "uuid": "db96ba79-0e96-4fbe-992c-a3d0ea90ad7a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3087e50b-d60c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765400829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765400829, "uuid": "7ced4453-39f8-4ecd-a465-ce0f5d96ede9", "comment": "Malware payload", "value": "fa7b695798b759b1334030bda04fff3e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "crackingcity-com", "colour": "#4352FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765400829, "uuid": "e2ad3ea1-7cb5-450d-bc90-9a0d6d060766", "comment": "Malware payload", "value": "a67109836839f25002d6a6e56666d6f94f7aafbd9a57c344b03b7ce55c69a32e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "crackingcity-com", "colour": "#4352FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765400829, "uuid": "c9463ce6-9a37-45d4-9099-9d57056bb332", "comment": "Malware payload", "value": "2fe5cfeda2e29c3f240f2e86156afa58776eae35", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "crackingcity-com", "colour": "#4352FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765400829, "uuid": "46a45634-75e4-41ff-9b44-03f794d8d7bd", "comment": "Malware payload", "value": "0cf0e6d5566ea7ae4962729ca8758a09d5726c9c15ee3af6efbbf40d7cdb122c0080a0a1483e7ea434db78498ff4627c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "crackingcity-com", "colour": "#4352FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765400829, "uuid": "c48ad571-473f-4c48-b2e2-5ad7a55b550e", "value": "T109269D66E2B401E4C9BBC13CC94AC903E7F178194374EBDB12A446691F236D5AE3EF64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765400829, "uuid": "a941818a-4577-461f-b089-f010587a959d", "value": "72b6ec48223e4d450dd235275dfa42a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765400829, "uuid": "308f949a-fe5c-470b-82b6-6bc85ce2b760", "value": "98304:1v5vFtZb+i/AAOWPsZCL2dAslrR7OkFaJBvHvY9gg9N2b8GToyogu:1B7Z0aJBvvgN+80c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765400829, "uuid": "062cfa6f-b8c9-484f-91f6-e1f3a8994610", "value": 4848128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765400829, "uuid": "d4d571d4-86e0-4860-818c-d44ea863d6f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765400829, "uuid": "0aef8d52-6716-4909-9499-0f16fb4dc640", "value": "dlIhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453b6d99-d5ef-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765388408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388408, "uuid": "a3147c6c-5d30-4b9e-a511-eb87fe438df6", "comment": "Malware payload (MaksRAT)", "value": "07c24ec10ce2d8110765554e4a69604b", "object_relation": "md5", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388408, "uuid": "97769e2a-5b48-4d53-88d1-8f637a8cd48a", "comment": "Malware payload (MaksRAT)", "value": "a67a20fb679e238d1cc32ae865fae871d07da8d3a256bc8b31b9ac939ef9cef2", "object_relation": "sha256", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388408, "uuid": "656fc7fb-4dd6-4c4d-a435-993115c02585", "comment": "Malware payload (MaksRAT)", "value": "fd34b3f52830f01e592900ca9a4da21481e346bb", "object_relation": "sha1", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388408, "uuid": "0d7217df-5384-45ef-9a08-ae80c32a738f", "comment": "Malware payload (MaksRAT)", "value": "ca4a9fc9ea721d0c13c793b50d3b343430e96d4ababc25920e81b45978779a8f616f650c60f0fea6dfcf2b6f9a5a9fc9", "object_relation": "sha3-384", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388408, "uuid": "1fc83946-1b84-406f-84dd-96df27464d81", "value": "T1E9F2E1E9369A8285DC15323DF877DA5380BDB48D06D4FE72B6C2234234F715E58A39E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388408, "uuid": "c5211a74-de6a-4f24-a5ba-adb99109a8a4", "value": "768:mvrDXyaVdVPkj8Z6LFy6sAGPGFuCU5zC+RYatUJPzTx:UXyaFk1LA658fRYatU5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765388408, "uuid": "a2912f47-356a-44a5-958e-d8e9f18ebb71", "value": 35089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765388408, "uuid": "e1420a24-f858-4fa7-a4e8-95c25b2bf0e4", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388408, "uuid": "a2596c45-0f5c-48ea-bcf6-a7270018b9d0", "value": "a67a20fb679e238d1cc32ae865fae871d07da8d3a256bc8b31b9ac939ef9cef2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4bd3dd7-d5bc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765366771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765366771, "uuid": "67a3d300-5304-42bf-925b-8ce84190c4de", "comment": "Malware payload (Mirai)", "value": "2169179705c0166c6282c6e7701b74d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765366771, "uuid": "1898df68-99dd-4073-bbf3-5d77af97fb3e", "comment": "Malware payload (Mirai)", "value": "a7902c832e838c2241aea7865b3d750172aa827818a06312b57e4de0b50d45d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765366771, "uuid": "d4182bf2-42e1-474d-8695-49597fcc0a0b", "comment": "Malware payload (Mirai)", "value": "decc5c0e5860034deb1a39ee1a26fa1e47cd859e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765366771, "uuid": "450d6a9f-91da-4b07-968f-356ddf840d2c", "comment": "Malware payload (Mirai)", "value": "680de7c6d23f50c33122784a7df14b5315cc058c36409672d7ea22ee5f5616be9c9f78feaf39669eda6d792edb934c47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765366771, "uuid": "d7b8e110-2bf5-4c04-a236-947988a7b685", "value": "T1589312674C66DF77C447F2B615C76A20D8ED6AB6D82C813F08F63AFAA93160472011B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765366771, "uuid": "e97fb9e9-8451-4ec9-829c-e5e4df2323dc", "value": "1536:rj5orCOv/mf8JxWEF7+LeWc1jR/DbR/ZHuf/prBNCCueYcc228UeXYa2b9L/Z:rjqrdvPbF7+Lzc1N//Hu5GTGUejerZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765366771, "uuid": "c57cde81-b406-40dd-b464-1715f8d7618f", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765366771, "uuid": "f29dfd13-917d-4ca8-8dcd-340e1e03e533", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765366771, "uuid": "57533d9b-6869-427b-8284-db14eb466277", "value": "ecco.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a839d2ac-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1765345195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345195, "uuid": "1ada7385-3d0b-4f92-bfd7-66fffc537e97", "comment": "Malware payload (PhantomStealer)", "value": "36a77ffb53e10851f46e8eb24ed473f6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345195, "uuid": "63125c41-9eb4-4eb3-a72d-81ea54a58139", "comment": "Malware payload (PhantomStealer)", "value": "a827d2abbed1221393dac1fc489d0bb8dbc891b74963a9205b7e239f86263959", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345195, "uuid": "e37f6339-4fdb-407e-8b68-cab83c171dbd", "comment": "Malware payload (PhantomStealer)", "value": "0a348e877a3e54b9641f660d47c96e3810966a14", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345195, "uuid": "e83799aa-5a50-4559-92b1-d0dc29676b32", "comment": "Malware payload (PhantomStealer)", "value": "d1c87b0f59e420a78f8576ca9951771461833c4761b6d69287871ea6bd852aed8a16a08e5fc10aea844ba1c1cfe93e0b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345195, "uuid": "770b3030-3d57-40ec-bc6d-127edfd233a6", "value": "T12FA35345A2C0B8A9238B1F76B72FB0E5F93F0C9D7594485BC111FC90A5B5706DAE1E32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345195, "uuid": "cc58f733-6dc6-43fa-854f-a169c2e36edc", "value": "1536:M9dKgoXHbCVWDCVxCeAW/tmVcA5cBtogLfj81F0aN3uqT6Qv4Bj:MTZorsWPqFmUrj81Ft+qT6Qv4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345195, "uuid": "de2d687a-63ed-424f-954e-5e2c9aff6bcb", "value": 101690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345195, "uuid": "0f52b798-044a-4609-bf23-a2aa39399240", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345195, "uuid": "27ecf193-b5b5-4f9d-b93a-3e713ad46ee0", "value": "digital tax receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66aa030-d587-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765343930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765343930, "uuid": "9b989870-0cfc-45a2-930d-a188465c6816", "comment": "Malware payload (XWorm)", "value": "00f959e7cd0a01062c16fa73d58e4450", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765343930, "uuid": "4c2386c7-2a10-4291-9451-479b10518405", "comment": "Malware payload (XWorm)", "value": "a91b51442765b4f6373d4c34d9f4b94c10ec8cc11074463f4811bbf88f25e8cf", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765343930, "uuid": "ea3b5932-9d5f-4a91-ada3-80f72a9dfb72", "comment": "Malware payload (XWorm)", "value": "f88a5706701e565985bd6762ea06644886741cf1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765343930, "uuid": "0114ff29-0dbe-4437-8286-c10911694c3e", "comment": "Malware payload (XWorm)", "value": "4ceddcedd2644b08cc9385a69c5c5b0c73aa356d2bf75749393a9d7c2849635a4d7097b3dc78fe9924acebc5ff158d9b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765343930, "uuid": "6225d885-57fc-475c-b546-66009b49bd4e", "value": "T158E512BA48F2A857AA504623FB0F2C1A339B19D53B24D346EA51515C7F3B1D38EA1733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765343930, "uuid": "26809e52-fc7a-40f9-9a78-7861c7ce6a9e", "value": "49152:cOc2yD4lTPsGRM/VyRxZB/kM0B+yxXZ9XS9OgvTEUQWVBjgD7wdf5S0Ut:coyEFPf8VyRxZ53K+2X/icgvTBQW/8PT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765343930, "uuid": "33aa74d1-4e4a-4940-898c-a16719e7a5fd", "value": 3031883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765343930, "uuid": "4ebc54ed-1b4d-4257-9a42-1c43cf4fc472", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765343930, "uuid": "c80ce61f-b3cc-466c-9b24-a3c939370364", "value": "Data Sheet - EMCCD..xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "887909d1-d584-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765342565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765342565, "uuid": "874f003b-dc12-470f-952a-1e854adc9a3b", "comment": "Malware payload (Mirai)", "value": "c7960101bd8ace45fffd505e67d24a44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765342565, "uuid": "98516a2b-2769-4098-9e93-da325bb3c712", "comment": "Malware payload (Mirai)", "value": "a95c2797f19501a22ebb32cb33c2c56bdd1b49fc4b4d65e5d2b0bd8c5081b299", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765342565, "uuid": "5d24e7aa-4a26-448f-a349-f6308c9ff1b9", "comment": "Malware payload (Mirai)", "value": "8003c9a1414e813f828b0b63df1eeffb9c1cefec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765342565, "uuid": "fd2962b1-54fa-4188-919c-e9f3c99e6b75", "comment": "Malware payload (Mirai)", "value": "7b03b16d23ca8f20afd7ede831dfd11c90f0b8dbd182e63f0da3350a80933cf1e084ed7a29ed17168cb26cf208b5a121", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765342565, "uuid": "b0b5d671-6746-416a-8a7b-5d40f0f7dfce", "value": "T1B9D32A06B30C0947D2633EF43B3B27E1D3DFDA8121E4E644791EAA8992B2D325586DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765342565, "uuid": "c1b1b06e-68f6-4d90-85a6-49aca58c40d3", "value": "1536:l67x0M7wbly+TYF8fMZkaD1w83ten6qfvAFZ0ySvbpy3iG+v6:cxdhR2CkaK8CAF9+v6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765342565, "uuid": "a10031a7-447a-4f21-977e-8958ef391b65", "value": 135384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765342565, "uuid": "55d20503-c46d-47a0-85d9-85aba4f42d8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765342565, "uuid": "543c858c-2270-4591-acbf-d9093e25d1e4", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f8b073-d5eb-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1765386929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765386929, "uuid": "4dc8eb85-2800-45f8-8b61-c63225eb31fb", "comment": "Malware payload (ValleyRAT)", "value": "04b7b3a7c3f3acb40efd2b3881c1e357", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765386929, "uuid": "ac1883ac-373f-43f1-b4a9-6fdc16ef586c", "comment": "Malware payload (ValleyRAT)", "value": "a994f6712f32b1a1dbccb54c7ca9f79ac7d0f89cde34348a77b9817e8fcdd8fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765386929, "uuid": "c16a876f-260e-4bcf-92f3-0a7bbcba02ee", "comment": "Malware payload (ValleyRAT)", "value": "5b23dc1579b0dcf2611d27447048c3f9208db1b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765386929, "uuid": "7eec0c06-2002-4aef-b038-a3241962e576", "comment": "Malware payload (ValleyRAT)", "value": "2a39a713c3fd94f335c3887ab1e9493e11de802336104f9d4a8c24a6223211fc77bcbe396a821f80f36491746a2e57a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765386929, "uuid": "6580a53f-fb0e-471f-a7ab-75b7f6beebd7", "value": "T1F4C38C1175C0C472D472193408B4DBB15A7DF9702E785EABA39C127A8F642D06A3EEFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765386929, "uuid": "72ec50c9-34a1-4e3a-bca7-2c7174e02642", "value": "9d95b171a5e94e58b35b49e6cd6d2202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765386929, "uuid": "9d85bba8-493e-4065-b165-d758af5f74d2", "value": "3072:WtfCg4vkt3kbSyTQwna4aDYRppVotpIHZyvxaTgVpuu:eCgXt3ETpAs4IHZyMcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765386929, "uuid": "7be9e3f1-1db4-4b2c-a358-94b678335e7f", "value": 118272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765386929, "uuid": "81694fec-5ce8-4b44-8437-ca37a599a33d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765386929, "uuid": "1631ed4a-735c-45f4-aac8-35de0b49625b", "value": "04b7b3a7c3f3acb40efd2b3881c1e357.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4358887-d5ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765395439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395439, "uuid": "adce01a9-b634-48af-9dfe-0631c4bed3ba", "comment": "Malware payload", "value": "10dd2274c1a49afaa790abeb9750fcc3", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395439, "uuid": "ca493b5a-b522-4867-a2e0-b9afe64e0cf0", "comment": "Malware payload", "value": "a9f7f1273ddfc19d2aa0fa93caff67e9210b12b12ee655d14465a7c5137b0d67", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395439, "uuid": "6f57c8d1-84d4-40a9-b682-66d80b50ac6b", "comment": "Malware payload", "value": "5f37d2eb840e253407ee45c015b2625c2fbf1086", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395439, "uuid": "4eaef010-f576-4fce-84de-93592ee49e30", "comment": "Malware payload", "value": "deaf8c8b9896315f2134be40c1060dcba6098e9520fa6b394c243efaad556cf3db33ecc2d0274240d8cf2cba5a76447d", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395439, "uuid": "f7ee4f51-67b7-4ac9-9bfb-7878f075c428", "value": "T1E5D6334865E105FAEEF38179AEE229A6E16574738372C5DF0FA443618E635D04C3E32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395439, "uuid": "fd013695-74d5-4443-ad9a-d45f75b4b29b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395439, "uuid": "4beca874-089f-4dc3-acb0-3eeee0f94374", "value": "393216:3rGUH5yg/Zyx+YpE7jFBNRjc26TXMCHWUj3cuI3/PjuUw1:3rGkakYpE7jlW26TXMb8MH/rA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765395439, "uuid": "eacff43b-4d31-409e-a875-0499ef586509", "value": 12633293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765395439, "uuid": "7e1c44f9-b97d-484a-afc5-521f058ec6e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395439, "uuid": "a60b1bad-cc34-462b-b7cd-97005ad9f54e", "value": "cra\ud835\udc50\ud835\udc58_\ud835\udc29\ud835\udc5f\ud835\udc28\ud835\udc1duc\ud835\udc2d_v5\ud835\udfd89\ud835\udfe1_d\ud835\udc52\ud835\udc59_x3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0bd4e2a-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1765345209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345209, "uuid": "4f0853bc-d3e8-4790-9d6b-05f079e81571", "comment": "Malware payload (SnakeKeylogger)", "value": "23e239d6e24ef6251963d4379d033e7f", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345209, "uuid": "365e8232-b4a4-4cd8-af4c-5a3508e32266", "comment": "Malware payload (SnakeKeylogger)", "value": "aa21cebe51ab2140ae325fcbff77b183aa865409e9f0c0119adb94ff6fb39b28", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345209, "uuid": "5b14634b-0408-48a9-8375-6b5185491409", "comment": "Malware payload (SnakeKeylogger)", "value": "f3adfd2961185adb3a823a01d525be97ea7f6c14", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345209, "uuid": "404f626f-1902-4673-bbf1-29f93ca19d9b", "comment": "Malware payload (SnakeKeylogger)", "value": "b3632c5f37d07cc287c6b42fd9fa482495585ad3a71b6dc0a59d2233ae0304acca98be357ca993ff71caaa5a259d61a2", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345209, "uuid": "99478439-9450-4efa-8055-91a344a85daf", "value": "T1E9959D4D94706DC26014FEB0F541AFA7CCDB539416274A121FE5A4AA6322C83FFAB7E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345209, "uuid": "e459efe0-552f-4818-a6f7-b34d3b2c834a", "value": "24576:doInVTqFWqHg77xWMz4z4gWQ/ID6II220:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345209, "uuid": "c3df95f1-e415-49d0-a918-390d07263a56", "value": 1917904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345209, "uuid": "b6af46a1-bced-4819-847a-2abc4c9a59a0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345209, "uuid": "ffd7766b-a0b5-4f64-8c22-2896fc345400", "value": "New Order 1025.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e566179c-d5cd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765374074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374074, "uuid": "b8a1618e-106b-4ad4-8bf7-f5f52ee072e2", "comment": "Malware payload", "value": "93723de23d36eb54a72a1b1d3dec114a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374074, "uuid": "94fe13bd-f302-4391-8c1a-a69458964ed9", "comment": "Malware payload", "value": "aaaa6f11a25e03ed15efb244322808b170a2a897439ddec89cd756efa8620e77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374074, "uuid": "dcf485d6-d460-4c21-b6c4-5909dfd1357e", "comment": "Malware payload", "value": "bc31684dbda1b47618717d01073db54304a453a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374074, "uuid": "1ef00cad-7f94-42a9-a5f0-dc1e0f9f883b", "comment": "Malware payload", "value": "20681b7117c2773f748a1fdd7256a912755c1fce9d2829560a3be9ca41aa6c89cc1c1f0e09818c11f49fc21d62d4da61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374074, "uuid": "cea834c3-a335-4d38-8d86-e03a7913265a", "value": "T116862847F89041E8C0EED174CA669263BA707C895B3063D72B50F7B82F72BD46A7A354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374074, "uuid": "063475f4-c744-4cbb-8861-47d7dda2d5b5", "value": "49152:sRm6tkO15VlRArb/TivO90d7HjmAFd4A64nsfJIyMVmbfugZjs38LVBiz6LbtPXH:glRJXp8L/KyZcCb7kEew+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765374074, "uuid": "48d39b18-7359-4965-8c54-66ca5aef570d", "value": 7864320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765374074, "uuid": "1d72105d-2658-489f-9cda-dcc985aec5e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374074, "uuid": "42e3b1c2-6ede-42a9-abc9-0a160f82d160", "value": "memfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a661341c-d5e9-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1765385994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765385994, "uuid": "04ea444d-40d0-4456-a79f-57b81c737f4b", "comment": "Malware payload (Vidar)", "value": "933e4e0357da0967cd5747c02d0fea54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765385994, "uuid": "0976c30e-d7c7-4abc-9e5a-27008b51cc53", "comment": "Malware payload (Vidar)", "value": "aad223e288b2216791f11d632800ea9e251490aeac6c003d5bd995697f4c13cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765385994, "uuid": "23e7dde1-07e2-4000-ae07-13e592cd3303", "comment": "Malware payload (Vidar)", "value": "826fd4739c6539f97c90ebaf62a199d88020cb8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765385994, "uuid": "6a8743e1-f43d-471c-a0d5-41cedaa42733", "comment": "Malware payload (Vidar)", "value": "e043359907cd247761cb21e6d076dfaf83df55a236bbdeca235b96eeedaab58b6c235286addb5559495db79fe783f993", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765385994, "uuid": "1e8697b4-02e4-4aeb-9a9c-74b0ba2903e0", "value": "T111964B82B981152AC56BF234ACB162557731BC0843323BD76FEB16650DEABC4273FB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765385994, "uuid": "88e73ac8-7efb-40ac-b416-301d700611a7", "value": "11816731f87952ce23da086b67eb30cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765385994, "uuid": "0286b4c9-0797-4eb9-8f39-60fada73981f", "value": "49152:hoftODk793Wejtp6WA5cK1MQnwiZZ02bsVie1anRlvbD8yvSEIeqkOapwCIZ1kTq:Gt93nAiQnVZZ81MvbD3XJq0f4f1Q7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765385994, "uuid": "7dae63da-d1a7-41e3-ba2a-7e7dc4158f01", "value": 8776680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765385994, "uuid": "3a040d83-a1d8-42a3-a658-fe702b55951e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765385994, "uuid": "cd2872b2-66be-4657-8af6-b8ad0ae0df38", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24886e58-d5b6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765363872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363872, "uuid": "0b558da4-3270-4bc4-bc54-416b33721d78", "comment": "Malware payload", "value": "64f44343cae6ef3d171ed84eaccd2946", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363872, "uuid": "72fb0709-5f11-44e4-b9ca-1eadbf31bd32", "comment": "Malware payload", "value": "ab7f92c9cc6db44d36a640b15552f31a7e6bb581bb767184b67fff6183bef0b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363872, "uuid": "b04674c0-155b-41a2-958d-47445c4b80cc", "comment": "Malware payload", "value": "4747a0a0059751ce3db284e29f8414d9150c5ffe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363872, "uuid": "2c037ba2-0169-49a0-ab00-8f0e814cf387", "comment": "Malware payload", "value": "2f5a23550b7eb2a71f07972987e98eae9c41ddf420e95b60a9d967be68f49e712c5421bab65bc8dfa61a01dee26444d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363872, "uuid": "3fd372ff-881b-4351-bcd0-2bd1194efd97", "value": "T1BDA308C6FAD6ADA3DA09063E89EB8319223CF6D807C34B038D3876351A575D06ED7647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363872, "uuid": "f87813a7-8b43-4291-ac63-5ceeb4ce09b2", "value": "f979f550090fc406ee739ff27d81c9ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363872, "uuid": "b11b53f2-25c0-4ef1-99d6-6c6dd4320798", "value": "1536:on+SeBQniHQniY5kOJbBivePs1PMsEmG3LSbqtyB8keD:o+yjLtyBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765363872, "uuid": "35b04c43-d45c-415f-835c-44ef14d890d0", "value": 103677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765363872, "uuid": "01af05ac-4d75-4c4b-bfab-939a4af631d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363872, "uuid": "07b0b1da-b765-4324-9513-97f04c56b2c1", "value": "reverse2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7ee029-d602-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765396661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765396661, "uuid": "3324996f-5069-4cf0-ae46-d1fa53469eb6", "comment": "Malware payload", "value": "9852d0985822d1a96c6cd19881c0d58e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765396661, "uuid": "85cd4bf6-4da1-45f0-abb8-a66224b63892", "comment": "Malware payload", "value": "abde7361fa3ae8efe51ac0eb227265b3a7cc3ed2842b88be21aea7ed965c80f1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765396661, "uuid": "36c2e45c-879c-4d7c-9143-209c5604d8b5", "comment": "Malware payload", "value": "289c1af8091cf1eed08cbfa0937a877465870be5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765396661, "uuid": "febc1419-9b4d-4857-9c48-df21b6f38970", "comment": "Malware payload", "value": "413e4a54f28224738e37a94ce85322b0291f81ca129d53a0819f1586c5b1a826da7d69a5eafef6dc607ec066fa0c9aee", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765396661, "uuid": "2548101e-a20a-425b-a5b6-a29179747cef", "value": "T10D727322ADC75C9683D3EBA3E5F3D31CBDB884DC800B99C5B5B8C2821461E691789F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765396661, "uuid": "f9752b16-e9c5-4418-b785-ef5e5ec91a5c", "value": "192:wtRvV0EAlqBsh1GBtUqjh/6dIRAqZTa6t3tj2IP:wtRvV0EAsBshu/h/hRVZGBIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765396661, "uuid": "dc3d1ab5-5186-4d3c-a239-0cca4a378beb", "value": 17206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765396661, "uuid": "901bdd38-3258-4530-a767-cfe5952442a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765396661, "uuid": "b1459eaf-e5b8-47bc-b914-d9f55959aeab", "value": "HollyPriest.docx.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6219352-d604-11f0-a129-42010a9c0007", "comment": "Malware payload (EternalRocks)", "timestamp": 1765397617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397617, "uuid": "0ac2e2a4-29f3-4433-b53d-fb1742389055", "comment": "Malware payload (EternalRocks)", "value": "5e0463e90e1b2925662d69b79dd704a5", "object_relation": "md5", "Tag": [ { "name": "78-40-193-126", "colour": "#23F4EA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397617, "uuid": "41bf27c1-6e64-434e-85d3-a8ef3ba950ed", "comment": "Malware payload (EternalRocks)", "value": "ac4529e1023ef359eaa2e23c5a4927eb822afe4b4e72860e53748a8e03d009fc", "object_relation": "sha256", "Tag": [ { "name": "78-40-193-126", "colour": "#23F4EA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397617, "uuid": "513a656c-4054-4230-a178-73e6337095da", "comment": "Malware payload (EternalRocks)", "value": "5504d36449910615ff096fca21e16b79c2221e7c", "object_relation": "sha1", "Tag": [ { "name": "78-40-193-126", "colour": "#23F4EA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397617, "uuid": "a8baecb0-aba9-4568-8c89-cf60b178eb39", "comment": "Malware payload (EternalRocks)", "value": "efd7e713772ac7d5b4b111d67e8eb2e4e9f074ca6a39df9755b51b12f15a8b2d2b4dc991cf00da29a61e487d9cc91d0e", "object_relation": "sha3-384", "Tag": [ { "name": "78-40-193-126", "colour": "#23F4EA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397617, "uuid": "6e097c4b-64d5-4be7-9c63-bfd807b043c6", "value": "T1AFA67C10A4C86607FD7ADFBC999E72500F7AB5952901BB398F4149DD2ED2B98C8039F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397617, "uuid": "cc7400ff-2ea3-4c8e-8495-2581457a54c9", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397617, "uuid": "47d22f32-f061-42ba-8462-1d17f654429a", "value": "196608:i7ujFHwSGAOZRCQL+pKity5qG25/dbUkya2a23Db2DQ6r:DwSGAFQL+pT3l422a63l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397617, "uuid": "2869643d-db3c-43ec-b707-369e3879470d", "value": 9682944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397617, "uuid": "9cee2792-1aa1-40ff-ab30-49e46ae3e99e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397617, "uuid": "2ee81175-b1e8-4632-8b60-cbed74bf09a9", "value": "CrashRpt1403.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde269a0-d5dd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765380879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380879, "uuid": "9214729b-0069-46de-a7cc-02f08f737ec1", "comment": "Malware payload", "value": "0121102d58985c1eae3e9185df79c4f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380879, "uuid": "d44abea1-0272-4d64-882c-cdb414dae859", "comment": "Malware payload", "value": "ac53dac8dc08bf943e91e5953eb418569895ce3d501e83742341bfff1fb554bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380879, "uuid": "b1a3f8b5-ced9-412d-9221-5ed03e13e434", "comment": "Malware payload", "value": "17ba2a466151f914e9c2cb21da7fe2c2f48910e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380879, "uuid": "b181418a-3e2e-474e-93ba-eeac7c8371b5", "comment": "Malware payload", "value": "86c3aa1c2fca3a2903b228242ec704668b62ef8b5aa985c40ffbd603d821319e320d883779bc2377287c90f69f7a0961", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380879, "uuid": "7507ef98-1a34-4e19-be67-300787adf02d", "value": "T157F533B94427383A7CD171E9E429E2E9E187DE375B84F42A7143D71E04FB3B862B5206", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380879, "uuid": "7723b2f3-6333-4b04-9e39-65e137904b5f", "value": "98304:7YeXFLrI5YhE2T+PIgp4but0lxFq5CUsIXQyK:9NrhE2TSHnt0EvTQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765380879, "uuid": "173457dd-8304-409a-af09-3a49a60e225c", "value": 3457752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765380879, "uuid": "89b285d5-1878-41f6-aee3-b73ca5fc4ce1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380879, "uuid": "d5f3fbc5-14cf-47b7-80ce-3b15c6a20959", "value": "tcp_linux_amd64_b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a701d2a-d5ab-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765359157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765359157, "uuid": "75aaf22b-6153-4ad1-9c20-1d1e4d342fdb", "comment": "Malware payload (AgentTesla)", "value": "75c147ad081934ce55fafa58db347f5b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765359157, "uuid": "6230fc66-a9f7-41a9-ab3e-14a790e1ee40", "comment": "Malware payload (AgentTesla)", "value": "acf098d8c20fe81ae8e1375c1097b543f9bf8235d1d20821a7f3893fbcc99a26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765359157, "uuid": "13936584-8be9-439b-b529-e21aed9fcf04", "comment": "Malware payload (AgentTesla)", "value": "20ab7da1ab2384cf501c4816c5343885d589d6d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765359157, "uuid": "f92a81f3-8828-4c1e-8d9a-f341fa936bca", "comment": "Malware payload (AgentTesla)", "value": "26f62c72b1808ffd8efb18325a834f356b45a11394ad1c2d8ffa6db37aae3aa215fac9017afa84d0e7821feb30b47e44", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765359157, "uuid": "4e0b3a60-820e-483d-899b-3831f50a028a", "value": "T14A45F163B46892F6C3B86132F107E63F2A0B9E7566518541B3F17F8E36B2AB51710B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765359157, "uuid": "fef7a5a8-f44e-40a8-8ca4-5468b814c08d", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765359157, "uuid": "5d90d1d4-08c2-4d42-9685-ece258b2bf14", "value": "24576:cyPTx3gmgEBwc7pucewlPgqUDkI2nvCzz8L:ceQxEB9Hew1UN2n6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765359157, "uuid": "cbe904df-ded1-4eed-8074-56b47e0f653b", "value": 1179544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765359157, "uuid": "885b4ea8-4cb3-4d75-8aa1-568466c33606", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765359157, "uuid": "72442011-1ecb-4649-8906-12996ca84337", "value": "Proforma invoice 12102025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7d8a6c-d5a0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765354493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354493, "uuid": "6d6bc346-ad61-4856-a951-8074bb6ee37c", "comment": "Malware payload", "value": "3d9765d3fa3d19eb2468a5f8fec07b41", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354493, "uuid": "4095f84f-052b-4f8d-9251-7de42af9e65e", "comment": "Malware payload", "value": "ad526e02e9b18763752093505bfa940c698b2f7e8b5281c2980b9bdbfacfd9d4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354493, "uuid": "d6a3c405-974e-41cf-b4d3-e265232c3f1d", "comment": "Malware payload", "value": "74414cdc46531b93a81b864f4960e5c1ec87c43c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354493, "uuid": "0ab45f5f-c793-4d01-b0c1-bcc0df5330bc", "comment": "Malware payload", "value": "8b14cc7bbdf7d225b56aec59c1f3f08d2a350ccd281e823800ca2dc024ebfabecdd6cc3bb54d7b82a773bdac2dc15e6d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354493, "uuid": "e70801b3-d3fe-41dc-8b33-d2d748853c68", "value": "T131912BCE355077338D26DE2EF3758A1B6082C19102724FA8665970F8FAFBD4AF560D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354493, "uuid": "dbdb425c-b3ec-4f0f-ae2a-12fb84ee5530", "value": "96:1x1NypDumcMLKkWhpFiVbmCgEX0mTbA7CZQ5dQbFv:s32hfiVbmxEXb3SuQDQbFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765354493, "uuid": "2c447077-4f4a-4853-b713-d94a79f1e478", "value": 4610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765354493, "uuid": "94a87a24-1bc6-4a8c-a551-85af602ad307", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354493, "uuid": "f5e0ed69-0069-474e-8776-42bd5dbea97c", "value": "cn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3e172e-d5ce-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765374250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374250, "uuid": "7ccd96c9-c33c-4261-82b6-8eedffcdcbc0", "comment": "Malware payload", "value": "fa79f9789bb330806f2d3c6a5fbf1bd4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374250, "uuid": "cc5b9ef7-2958-42be-a002-addba692dc4b", "comment": "Malware payload", "value": "adad54be1b08e170154310f79e242cfe0e14f979c518aad3a384e70379fbdb8a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374250, "uuid": "e106f615-b2aa-4935-a87e-b42f44df84e0", "comment": "Malware payload", "value": "c0fa27976a11e63aa04c0a9dc558e8fd791f8401", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374250, "uuid": "ae5ca298-4150-4447-b7e1-2a8280b42ed4", "comment": "Malware payload", "value": "b19c1ff1941173e4ce9c76ed525665e1d695ef3b4caf8394772ec8f3e9f9c85761ecf52edcd6b9c5382a769e12c8df3f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374250, "uuid": "1c39bc59-644a-41ec-bb23-2228cb150a0f", "value": "T1BD8412DA5E10E16CDA0AB4BF635BF440AF112C32CC596C6F365792A297CE46DCDEE081", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374250, "uuid": "180abc0f-eebd-4e5b-84e9-42883c3986a5", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374250, "uuid": "ce296809-b839-4fbb-950b-edecfc2aa496", "value": "12288:TUIUKq8js4ZXLwgtqV4gSth2YTUyOxh2O0:4CgAQ+ZGY0qR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765374250, "uuid": "dd8a2647-dfaa-44ec-b535-2d6168af1c1d", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765374250, "uuid": "8ac6e6d3-5fe9-4166-952b-ce304964bdba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374250, "uuid": "7aa6185f-4488-4c45-bb73-3b8c5357961e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12828eb2-d598-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350957, "uuid": "aa2eac38-b495-4df8-95b1-293e8648847a", "comment": "Malware payload (MaksRAT)", "value": "0c2839aeb0ac4c9701be66af96eb20fc", "object_relation": "md5", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350957, "uuid": "0f9fd58f-03fb-42c0-a674-3f4714aa0821", "comment": "Malware payload (MaksRAT)", "value": "ae1625bc18b02ea725e895ffd8817f757813d847d5772f3b73433a9c58e19e18", "object_relation": "sha256", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350957, "uuid": "a9095396-c1ba-40b2-bed5-af424fa67875", "comment": "Malware payload (MaksRAT)", "value": "0a4da3bc8706a13a2fb6a4a4f5cc80cfd6c6eefa", "object_relation": "sha1", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350957, "uuid": "6520524d-f44b-4208-961e-c04834b9a9b7", "comment": "Malware payload (MaksRAT)", "value": "9762809c0ad0156bcbf699828a686e2ff01c73f8488356141ca0867a000e352629d576fb954ab5547d500465dc3f7754", "object_relation": "sha3-384", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350957, "uuid": "40b41c9a-01c0-4a30-a331-afc9857a34db", "value": "T109F2F1767FA102C8D8E6FC3B6E52D3912A6C40523F24C24F037308596D2DEC5AD67B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350957, "uuid": "896aeec1-14d2-423b-a2d8-caddb28d91cf", "value": "768:3FBJ0Zp5fmZp3u5nn1JT/vV82D3iC2EPDXnR/8wepTMTG2Rfn5oG8:3FBOzx8U1J7vVfDyCtPrRUwepTG15oG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350957, "uuid": "44deff67-6b5b-4652-952a-839c1f48f3c5", "value": 34292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350957, "uuid": "0ea8cefa-3e95-4978-998e-407febb2caf3", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350957, "uuid": "16adff88-4bf5-4518-a0cf-d249319818fa", "value": "ae1625bc18b02ea725e895ffd8817f757813d847d5772f3b73433a9c58e19e18.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3bda11-d5ef-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765388394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388394, "uuid": "9d1f1847-5e1a-467c-9b48-dd06acb2c2ae", "comment": "Malware payload (MaksRAT)", "value": "a3150f86506df50f767aa4d40d496271", "object_relation": "md5", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388394, "uuid": "e779d212-fc20-4496-8f7a-aab21da11190", "comment": "Malware payload (MaksRAT)", "value": "ae2376c7225557f36473b4912226cd1bf4ae086408d31f1a115e0a79a0a9ec2a", "object_relation": "sha256", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388394, "uuid": "3b84a8a1-6a05-4ef2-a86a-16c5a2d56752", "comment": "Malware payload (MaksRAT)", "value": "29ac950998e8de08dcf457cd592c282cf229313f", "object_relation": "sha1", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388394, "uuid": "f06347c9-cfa2-4992-b88c-c18c28f73dc0", "comment": "Malware payload (MaksRAT)", "value": "421133fc81fcd84dea407888cea68b261df849e67c9da961f039946bb03f6c0ef461c6d21adba646c6c9edda6cd72498", "object_relation": "sha3-384", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388394, "uuid": "775c84ea-e804-4918-9b79-e5ed9710f5e7", "value": "T147E2F190E6F9EB68F44F06FB694818CE15504614739BE24FCCF14B688F5BBC228A47D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388394, "uuid": "0238c150-3dbe-4cd4-a17d-75a544d8a147", "value": "768:TCEfuMqJ+oeUhoO0NHOUB8uyfR0gCC/nK5X7FAOe:TCEUf3hm58lRV/KX7FA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765388394, "uuid": "43a9e447-bbde-4502-80f7-4d838c1d1671", "value": 31736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765388394, "uuid": "b34820dc-80ca-4929-beab-dde3ac4ed8b1", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388394, "uuid": "67ef3789-5b65-4f98-9928-d30f48caa909", "value": "ae2376c7225557f36473b4912226cd1bf4ae086408d31f1a115e0a79a0a9ec2a.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01caef52-d5c7-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765371115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371115, "uuid": "610e49fd-fda9-4a52-ba19-b74268495df2", "comment": "Malware payload (RemcosRAT)", "value": "f68f2b075044a59e457afd5a5d21e50f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371115, "uuid": "47e2573a-2f60-435a-a213-619fd0609263", "comment": "Malware payload (RemcosRAT)", "value": "ae57a915875b269ad2b9d14cb419441c7b28643851d50d454d1be27b76f22d92", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371115, "uuid": "6e6fdf6a-1d9d-4c43-a966-636f57c1525d", "comment": "Malware payload (RemcosRAT)", "value": "a62d41079aa837575affe5fd579e4ba691b55e06", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371115, "uuid": "bf5aba47-ce5d-4e01-a0b9-d7a4a066c83f", "comment": "Malware payload (RemcosRAT)", "value": "ca7a67daf89e35d6dbda909583fda9903817554c52335c091d70769359a65a7e65d516102151d6fbd120c9964ac2cb1f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371115, "uuid": "7ccf663b-4878-4f98-8bd3-b597e3c34a13", "value": "T13AD3614163C1B854238B6FBB372FF4D6F95B09AA7428094BC205FC81A574B06EAF5D39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371115, "uuid": "b54739b7-1c09-44b4-81cb-acc1ca80b321", "value": "1536:9/EPxGCWg/w9NqN93KcJZgIpamTNqWOsgSpw/aBK5mLcU/+UWR+h/X3maNBAmzeM:xioN6ZgIa2ySpwiNmU5LN5e/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765371115, "uuid": "51614eb8-b5bd-4bd9-84c4-3aaf3ede96b3", "value": 139747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765371115, "uuid": "a45e85a9-67f9-4440-bfc1-de065a4a7e30", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371115, "uuid": "947a569f-b78c-42d6-992a-4858a063685e", "value": "booking.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d8ad25-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765345191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345191, "uuid": "c254c49b-a011-4525-82d6-ceca46f2c596", "comment": "Malware payload (RemcosRAT)", "value": "cc34dcda405682e94cd22697e276fe9f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345191, "uuid": "6ac67317-8e92-41b7-a50b-ae6149e33937", "comment": "Malware payload (RemcosRAT)", "value": "ae6d49b96a03312feadfd3f8bfb8e58dae26faef21b46f57c1b5dcd29aa22787", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345191, "uuid": "1f65c10b-41c4-4ee7-b2f3-624f0440f710", "comment": "Malware payload (RemcosRAT)", "value": "1ee1aeeab99df7e1962c57a215a9893932f5a4b5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345191, "uuid": "d1aab24c-0bc2-48e9-8b00-8ecd3fe2898e", "comment": "Malware payload (RemcosRAT)", "value": "2830b4f1ce1e33c8ad09aeeaceefd69ba55be61c465e43ac6888bbc40d0252cb82f5c5506d2f99fa8fff7168b01573f5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345191, "uuid": "cb9581bc-198e-44ba-8b4c-508f57f11bdc", "value": "T193D43A20DD2416B94F071BA9FD541E61CAFC960A552A90F1F6DE070E61029FCE3FE6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345191, "uuid": "231330ee-2aa9-4a65-bf34-11610a8c0b78", "value": "12288:sKvKIKlJRuKlJ9KlJg+IeKlJg+vKlJg+IOKlJg+I5KVKlJg+IWKlJ3KlJg+IHKln:sKvKIKlnuKlfKlxIeKlxvKlxIOKlxI55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345191, "uuid": "3d7534bc-e6da-478a-919f-76cf6b8c473a", "value": 598300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345191, "uuid": "aeeebd88-63c5-4556-944e-25504b9bae14", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345191, "uuid": "da6c4384-e895-4265-9fc3-64930d72ecaf", "value": "Pago de factura.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4d8769-d5dd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765380873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380873, "uuid": "1c45edd9-183c-4d39-8daa-c25a4bd81191", "comment": "Malware payload", "value": "4f9120dee7baf9c35e05f3ed1d1a0a3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380873, "uuid": "d49eb0d3-c208-4d6f-a939-99abcedd06ab", "comment": "Malware payload", "value": "aeb56ccbea0087edfa975abd24677b7243fee858e260ba676993b6e4b0fc7658", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380873, "uuid": "21e400b6-d617-4345-ab07-80ae49034f28", "comment": "Malware payload", "value": "95b7ebab113e538166ded572f2000ba7201c59cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380873, "uuid": "47263468-8ed1-4015-b26a-862441b6bc3a", "comment": "Malware payload", "value": "57a44967f34787905929475d731584f30c3650d1c44beb58c33f3d57f6b5b6c6e62305dbe32f40c4e0f0eb4df486f03f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380873, "uuid": "99e19f32-f342-4b70-9c46-4117e31e349b", "value": "T1AD654C47F9A204EDD8BDCC34831EF173E629B849852676272BD85F102F66B10AF1DB91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380873, "uuid": "e46561f1-5678-4496-b916-04642a9ad514", "value": "24576:vphknd88+NbqC5bhhqg9qCbc7FrMTB6kd5eQVHBKzQL2q7xf:xhkd8dN2khhqg9NA7pMTzDeQVHFL28J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765380873, "uuid": "dd62194b-552c-4e35-b05f-8b9428521e26", "value": 1505928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765380873, "uuid": "980f3d8b-bef2-409b-8ffe-7daf1d94cf62", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380873, "uuid": "6d52f548-c972-4423-8082-b468751509e7", "value": "stream", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde9ae12-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765345231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345231, "uuid": "c6eff116-f054-483f-ace6-51a40bca47af", "comment": "Malware payload", "value": "0bab1402ea6aa92760d09d56090c539f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345231, "uuid": "26732cc4-9bee-4f41-b3ca-d8edcae208f4", "comment": "Malware payload", "value": "aede0147d70af4b3c767bdb17459ccd82daf4296af11fbf8c0c9376e248630cf", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345231, "uuid": "115561a6-6df2-4c94-8586-486d1e47207b", "comment": "Malware payload", "value": "100380549242f6414f768eca44df408517308aca", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345231, "uuid": "7ad2e488-8763-4808-88e4-f1efb6b7f00c", "comment": "Malware payload", "value": "c73eceeac514761238c00947ccbd6015b68450b422b81673462be77696f88f34cb92a72622fc7499ecbd0b3538893d04", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345231, "uuid": "f445f6d4-ad72-4de5-89b4-8f835e97feef", "value": "T134250256CA0100387D18A6BEDBA1E03BDE33BB44385388EE6F60779F1F758941599E1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345231, "uuid": "6bf33fc9-c972-4ce0-968c-c784af3ec76a", "value": "768:VbmjPj7l8IJhSmpQwTcVLFvVuOz3wfJbULrrF6:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345231, "uuid": "f767f7bb-958e-406d-8d93-d8e144165873", "value": 988125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345231, "uuid": "37a3236f-ffd7-450d-84ba-9635e5b3ba3a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345231, "uuid": "9cbcba47-c952-4b56-8daf-550f5b027b7c", "value": "Scanned_Copy_AC3948583.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fee0225-d586-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765343221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765343221, "uuid": "cf6ca3b7-ba54-4cf7-a97b-da5164672114", "comment": "Malware payload (RemcosRAT)", "value": "5540f8ce0531b155fb89e4500d0656f6", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765343221, "uuid": "97ea0ab4-9691-4b47-9612-70d8f9079511", "comment": "Malware payload (RemcosRAT)", "value": "af624a6f2bfceaacff6bc589279529b37b280287d4230e5d46c6f07aa03b8af8", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765343221, "uuid": "e3218eef-9b8b-4866-a12f-caf7f4607542", "comment": "Malware payload (RemcosRAT)", "value": "b9da134fb8b5f96e1dcbf492f5a262bee73e254c", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765343221, "uuid": "330b1816-9c0c-4584-a516-66691c42fb5e", "comment": "Malware payload (RemcosRAT)", "value": "36815120dd5cb6a239d30bd4c5a7cc8af1f0e2a4bfad8b679b60aeaa016cd9ffb568c2bcd369bb41eaf46e0fb81910cf", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765343221, "uuid": "573bef3c-4258-456d-b8b8-66f842a927a0", "value": "T156844B20EE3406790F471BADFD990B62CAFD8609462650F1F6DE070E61065ECE3FE669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765343221, "uuid": "a4d145fe-4533-4781-8197-d3ed93c4fb69", "value": "6144:82A6xro4KDWe5g8Bcmc02mf/TfiDZP4yLSiLB9WDUtIME62QoEE5iUXyFOEEgzrF:r4D9nBq0f2X9WgKU2Xyg04w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765343221, "uuid": "88f3bf77-1acf-4526-bbb3-128224f6579e", "value": 387123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765343221, "uuid": "1cce0205-4190-4488-aaac-445c7bba0c2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765343221, "uuid": "6992783d-eb48-497c-868b-370f96ecd657", "value": "PO-056979-Supply-025-LINC.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65b7c31-d5fb-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1765393752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765393752, "uuid": "ed09adce-a181-436e-b72c-fb17608ba7b6", "comment": "Malware payload (NetSupport)", "value": "7255bb55572bb9e0db22fabd63cd4043", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765393752, "uuid": "09a0a88c-a76b-442f-80bf-c8726c4742ee", "comment": "Malware payload (NetSupport)", "value": "b0383b31ab663412a3a50e9a19032942a4819320055577f583b0831760a8cf12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765393752, "uuid": "428579d2-5d1c-4fc6-9a42-cac37338775d", "comment": "Malware payload (NetSupport)", "value": "c59ce8b46b62de783e4321a1dd50bd13d9606866", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765393752, "uuid": "fede6f83-5d39-45d5-86c7-8b21d6d6d10b", "comment": "Malware payload (NetSupport)", "value": "680e214cca52f43f1b31a76e051d47373e81f010fc9bce7b77847624f80f9c8d8bc06bac2acbb32e8af8d0f16bdf406b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765393752, "uuid": "f279dae2-da4d-4d00-9a77-606e1d759dba", "value": "T19C5633F81655A83FEFC3167F22701F23C2A4930672E8255A62A3FB195D7AB41FC89345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765393752, "uuid": "0675edd9-5db0-4445-b9b1-1a666e06733d", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765393752, "uuid": "8aaaf223-eeb2-4661-89c4-2abfa77087e5", "value": "98304:3SOeaDdwT+s/6eqc3QF6sgsUyNopEgD/gp3IFVVnUKRSBKtQlspBA8iol:3XeJRAUxsUyNo1DlVVnVRSQtEs7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765393752, "uuid": "91b5d0a1-0dda-4e6d-93cc-f150156e1d5e", "value": 6152184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765393752, "uuid": "3eab2110-8554-4f8f-bec0-086ab43046f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765393752, "uuid": "75966d28-6323-45ec-bbd7-fb02e7783252", "value": "RateConfirmation134G2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef733b7-d598-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350951, "uuid": "62cca0d0-55cb-46de-b5a8-406f6d6b4337", "comment": "Malware payload (MaksRAT)", "value": "a41a0e62a207694c24402df3db99c5d6", "object_relation": "md5", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350951, "uuid": "ae1fdfb1-6bb8-48bd-8589-c81469eed48d", "comment": "Malware payload (MaksRAT)", "value": "b08b006462173db1fe844ee04c4a6cc7c817fa8de311112b52885812f8cf7436", "object_relation": "sha256", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350951, "uuid": "2b20db34-8490-41c8-a17c-09767fe024d3", "comment": "Malware payload (MaksRAT)", "value": "4a1e031d2cfdf8d1b9d48d22b044e145a6180636", "object_relation": "sha1", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350951, "uuid": "b8cf659f-28f5-4399-bc52-fa6b3ab0a316", "comment": "Malware payload (MaksRAT)", "value": "7b0298f423bc2a68f5ec33bfb654cfa666a9554642c16710e098cbf9585b01f4edb3f3a4489d8eebe10ea7d373559491", "object_relation": "sha3-384", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350951, "uuid": "85489bb6-438b-4fa6-9ad5-ace763edc315", "value": "T1F1F2F25CFFEEE92CC037A8F41495564619FC6850FA2DF3024D7876628F3049523E9A8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350951, "uuid": "0c49726f-8cbd-4673-8586-bf5e30b40b06", "value": "768:gCqjf2FgMg/mXlAQ7BlzL6ekLtLymIzfFZbYLwq37qJuVFXztn1Br:SyDqQV56LUdUeoXztDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350951, "uuid": "4dd5d3c4-1ad2-4a96-a9d7-9f4293039f25", "value": 35063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350951, "uuid": "26c79631-f44b-43cf-a9ad-2fb5738e9792", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350951, "uuid": "1f180aaa-e669-44ca-b300-eda4776b571b", "value": "b08b006462173db1fe844ee04c4a6cc7c817fa8de311112b52885812f8cf7436.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2eee13-d605-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765397919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397919, "uuid": "4f0ad220-c8df-4635-80d0-21f8ed89a1b3", "comment": "Malware payload (Mirai)", "value": "1f5bef8711fcc0a527eced8eb9e37b41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397919, "uuid": "83524c9b-31e2-492b-9991-0d62d7d82e0a", "comment": "Malware payload (Mirai)", "value": "b1e74339f6432874ce49cf0533a98090ab37f52122da418019152d5e8d7a5b6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397919, "uuid": "83a03756-8865-426e-a18b-0d86ccee0853", "comment": "Malware payload (Mirai)", "value": "0ad7de27ff95b324eb999acf66e6c709198c39b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397919, "uuid": "705c8637-e34d-4aca-94e3-19b087abfe89", "comment": "Malware payload (Mirai)", "value": "4240a63a00c909d030c655fbf151b0dee1be79507aa85360bc814b56f07b1f8ceb8f88bda17e9c3452bc619c1c94d3d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397919, "uuid": "ac23e8ff-bce7-42ea-8471-8d4c2a496b92", "value": "T144631230B637D006B3A028BD4CB55F625D691C3E6DDFB513A8B97B4306D20C66B78880", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397919, "uuid": "ce293811-eb47-4587-88c5-d4856240a796", "value": "1536:qV3jGsQTZ3xFKWgIUg38DeBLkQJerdtx2RNw0L/WLqdFiMmWnOt3Wz:6nEFjgxDeBLbGtx2RNrLc4hm/sz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397919, "uuid": "20e9eb5d-3f1b-4bcd-a486-bea927a90a8a", "value": 66904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397919, "uuid": "ef9d39e6-59ea-4f72-be34-d41fb35e89c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397919, "uuid": "21d6b569-50c4-4cf0-92aa-4fa8af2067dd", "value": "Labelloperc80.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da697629-d612-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765403691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765403691, "uuid": "c1e7db9f-d6df-440d-af98-7772a237e38b", "comment": "Malware payload", "value": "bebf3d938acab853635647e1faecc467", "object_relation": "md5", "Tag": [ { "name": "NEW", "colour": "#21A90D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wannacry-lookalike", "colour": "#DA84A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765403691, "uuid": "65c0481a-258e-4bfe-8459-e23bbf2a7160", "comment": "Malware payload", "value": "b236c1ec57b3f11adcc563cd324d4a3bfe0338cd4352e604d3af7cb07184b5c5", "object_relation": "sha256", "Tag": [ { "name": "NEW", "colour": "#21A90D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wannacry-lookalike", "colour": "#DA84A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765403691, "uuid": "e49f77e0-7ab7-4ebf-8ff9-32c30d2853af", "comment": "Malware payload", "value": "d2410998c002f5b1f445975fdd9a1ab376fd8537", "object_relation": "sha1", "Tag": [ { "name": "NEW", "colour": "#21A90D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wannacry-lookalike", "colour": "#DA84A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765403691, "uuid": "929f61f6-2054-4576-ae73-f8bf644ffa58", "comment": "Malware payload", "value": "b7ba6bd5e68d86e951fd7cc87db042c6d5202f9bc2a7d2434f0c9f64ab7c5656032b2fd9d2afeb80b23626914dfdab8e", "object_relation": "sha3-384", "Tag": [ { "name": "NEW", "colour": "#21A90D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wannacry-lookalike", "colour": "#DA84A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765403691, "uuid": "cd69fc09-2b06-4c28-a3f6-fd744e5d8d25", "value": "T1E0F15452FE278E210E73EB1550A7CD2DD654616B0031407F3B5CED881F3ABAA83D99E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765403691, "uuid": "3eff2f7a-b869-4f22-8a11-14653009b6f5", "value": "192:olwqK/i/MN/qzd/WD8zc+RDecQywOBIWTwqiV:olr/TxbaNOBdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765403691, "uuid": "289b9d26-767e-4dfb-ac3a-d7f0753c188b", "value": 7813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765403691, "uuid": "dd2c2fc7-ee25-440a-88c3-42555c17cb21", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765403691, "uuid": "3554c9cc-0fa8-41f7-8d19-e547a3e01969", "value": "update.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d850dc-d596-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765350078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350078, "uuid": "830c96be-3a7f-42e2-b783-49ed426d4782", "comment": "Malware payload", "value": "42eac47551a7e8a6f3e8d11546283b17", "object_relation": "md5", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350078, "uuid": "347d6c27-2efc-4084-abd3-36e444304f18", "comment": "Malware payload", "value": "b33e7d66707cb8fd345a38281953067e541c69baefaded5a8bb2bd265b8c1f0f", "object_relation": "sha256", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350078, "uuid": "9c3f7494-cb1a-44d2-b212-26ee1a890750", "comment": "Malware payload", "value": "7a1885145ad38132a5f68d0ae27dc65115dc3cac", "object_relation": "sha1", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350078, "uuid": "35f84e31-3267-4a6e-975f-4b235bd9f1bf", "comment": "Malware payload", "value": "df5193b6453b64dbd981a55d68bc88234860a05fa179ae11c8103700e628ca01807b7fb48fe82a3b6800b6cfb52dc6e8", "object_relation": "sha3-384", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350078, "uuid": "83533357-e6b2-41ee-be72-69d1a2093ce3", "value": "T157E2F100F9C0844AD93681B7279BC5234A97504587A9933E2DE935BB21BED28AFB3C71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350078, "uuid": "6543a8da-6d26-4485-8555-efc178a232ad", "value": "768:dAe7JdBUYQMfHDJXHZj3Eb7UZso1QolYiW/jJolAP9N2:dAepUYrfdXd0o+QYT/jXPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350078, "uuid": "d92f3491-cf4d-426b-9136-76c89579c258", "value": 32452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350078, "uuid": "bbec86aa-fc70-45c0-8ecd-d4405fbc4c24", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350078, "uuid": "d40b3f0b-30da-4ea2-9136-626e154d93a8", "value": "b33e7d66707cb8fd345a38281953067e541c69baefaded5a8bb2bd265b8c1f0f.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0818dc5a-d5a5-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1765356523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765356523, "uuid": "12bf89e4-576f-47cb-8af2-e29d540aa93e", "comment": "Malware payload (a310Logger)", "value": "4b042757b1a0960c84a794f0f0249579", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765356523, "uuid": "d9bf72e0-e7ac-4393-bf3d-d2744425ee9f", "comment": "Malware payload (a310Logger)", "value": "b3ac500b1139b89de3108cb6e5473ee618e235325a2909b2fb3d7b32c706c6ab", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765356523, "uuid": "395a8dd6-d721-4a46-bf9b-b635c0083415", "comment": "Malware payload (a310Logger)", "value": "686b0bfdba8980d7b3b34ffe04c61d98d8ab1b38", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765356523, "uuid": "09de3365-f51f-4615-af57-d4747c7a85ed", "comment": "Malware payload (a310Logger)", "value": "2bf95756c288cad36d6f0d3ac050673e0a7ce937127f5d1b629c2a275ad6c1388f97f5834cbe6196a838f438a566f275", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765356523, "uuid": "741de7a2-dfc3-44d5-a6f0-ff2081ec19e4", "value": "T1020533C7FCCAD1EF7D8F45357F608909A6CD1539209402C00DE52AD3EA21BE6F5BA2A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765356523, "uuid": "436c2c21-3a73-4c75-b7b5-0ad5ac382ae1", "value": "24576:WkjQap4rCw9rfwJLF0aOCfWKTHmchhwikYQT:dZYKepN27iT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765356523, "uuid": "962c9ab6-40f7-47f7-9d56-35dff2c771d3", "value": 811704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765356523, "uuid": "28c70464-d5e9-4c0b-a59e-65d807e73e66", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765356523, "uuid": "7268cc1f-0196-40f8-adcc-66ca2ee80fd0", "value": "Purchase_Order_DG25-1208.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e3c6db-d563-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765328514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328514, "uuid": "afdf349d-8a20-4ab3-85b8-123fa2670886", "comment": "Malware payload (Mirai)", "value": "0731db9d75ec47b9357f6463a2bdbf97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328514, "uuid": "77bb8ee1-6228-4a7f-b655-cbb7b7efa62b", "comment": "Malware payload (Mirai)", "value": "b3b6ee90365faad33eae6054869db4776268b24ce81f022588ec8e009607c13a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328514, "uuid": "8e4ff7ee-1fd9-4707-a6da-97c36fbcd9e5", "comment": "Malware payload (Mirai)", "value": "55acc5555599f6cc4d82ca1f829acecc152b56c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328514, "uuid": "451d50bb-b7a6-4a3d-8f69-30205dcf7c70", "comment": "Malware payload (Mirai)", "value": "51d4dca92cbc8737fc2b84aca4a2692dfcfcd9ff656dc75dbea9295d1b86f8fbbe58e8501311a0c687797d59495429dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328514, "uuid": "022b5ee6-b19b-4e12-9763-1ffbc2588e18", "value": "T122A36BC8E6D3E5F5EC530530203AB7379E72E6BA5238EA92C7A85A321D15702C517B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328514, "uuid": "440ba22c-38ad-4178-b97a-71ce78a1a8fc", "value": "3072:Odp74tD3SWkTb+Ty4m0sKAPTX471vNZgni1QQ:Od54F3xkTJ70HYGN2i2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765328514, "uuid": "805dabcf-f2cd-4cea-9649-b2afd8c454c6", "value": 99440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765328514, "uuid": "108c78cd-5180-4398-9e6e-506a15a5eb2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328514, "uuid": "7a63904c-6b34-4909-9fda-d2440da9f283", "value": "colonna.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1903b454-d5a1-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765354833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354833, "uuid": "8666d53a-640e-4b49-a508-3370cfafcb59", "comment": "Malware payload (AgentTesla)", "value": "585a55402f14a308401b0abc1fb2bd52", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354833, "uuid": "5ce58148-6de4-4d5a-8426-6ea15932b0f3", "comment": "Malware payload (AgentTesla)", "value": "b3e709b75da60b1314b709e64f62ddd1ed610a77cd7b5d4add893156c4176308", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354833, "uuid": "ec9717ac-76cd-432b-99c1-b33e2dfe35b1", "comment": "Malware payload (AgentTesla)", "value": "c2ec6b62c674518002b47f59a9c15fb4033574b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354833, "uuid": "c83194ae-0c99-43c6-8cf0-8cb19edbd60f", "comment": "Malware payload (AgentTesla)", "value": "9bb072c0f85a9d48c6589728e9de696b13f42c8cc1ec57d1aaa6911bdeeff045d6007f81d3f976494e3e40c0cf54a9e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354833, "uuid": "ae5bfa68-3e97-45a3-9e01-b34320947434", "value": "T12745BF027391C062FFAB92334B5AF6115BBC79260123E62F13981DB9BD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354833, "uuid": "308b7872-1b9f-4a2c-bb7a-467e84e3582a", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354833, "uuid": "aeee4a57-b1ba-482f-aa2d-d4376251ed17", "value": "24576:W5EmXFtKaL4/oFe5T9yyXYfP1ijXda6BXuuqJEXVLqGX:WPVt/LZeJbInQRa6NuuMgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765354833, "uuid": "f7b44934-8cff-416b-bbad-8ddd53b66926", "value": 1248768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765354833, "uuid": "0c3914d6-c8a9-4219-90ea-ed8a9d2c7e81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354833, "uuid": "35371460-4a82-4cb7-8077-3bf47709f279", "value": "519745023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f049ca-d583-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765342319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765342319, "uuid": "0b944221-f030-4dea-9e6e-6e1def38d9d5", "comment": "Malware payload (Mirai)", "value": "11d1f44d7b9f5df47573868820b615ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765342319, "uuid": "1499cdef-1f71-4ab2-96b8-e08914fd31e2", "comment": "Malware payload (Mirai)", "value": "b43ecba320c82b4854cd5117b5a80a482ccc3ac742b26bd316409d0a283d7462", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765342319, "uuid": "9e3443a2-d470-4780-b191-3c1f358860d7", "comment": "Malware payload (Mirai)", "value": "f816a9d426fe9f8d9fb0b2e55ba84c7c5d28e4fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765342319, "uuid": "223d87e5-e624-464d-a01a-c1924b84bc00", "comment": "Malware payload (Mirai)", "value": "8dd40ab7ff069b5e04990577933b1cd0dbdda2f8fc62692a972a45dfd41abd672652a0787ef218dbdd2c1f3076405346", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765342319, "uuid": "a325c0c7-da58-4cab-a957-206db6805465", "value": "T158631985BCD29667C6E02739BA6E628D332177E4D3EB7227CE210B10368955F0C77E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765342319, "uuid": "7b2ee2f9-a900-47f1-94cd-5b6564857077", "value": "1536:jQ/wg9QAbmAJSmclo5JBDh4OjPM++jxJ/pc87:M/wgOwPM+O9J7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765342319, "uuid": "939cfe78-0fd7-4310-82e2-8052629b4692", "value": 73376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765342319, "uuid": "38b59d31-54fe-42e4-a922-d470a770ad69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765342319, "uuid": "791591e4-5050-4f7b-b758-63d457579cd1", "value": "colonna.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b17ac55-d5cf-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765374566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374566, "uuid": "50d06ab3-52e0-40f3-b533-737c38caee52", "comment": "Malware payload", "value": "813b69e1ffeb70cdd5a63a8103a896d3", "object_relation": "md5", "Tag": [ { "name": "164-215-103-230", "colour": "#791D7E", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374566, "uuid": "0e0ff0fa-4325-4190-844c-b2c6d982e66c", "comment": "Malware payload", "value": "b4c4e5e3d334ca1dc4f64435656f0aa011c8651cd4343707d0397ee9dc6c41e5", "object_relation": "sha256", "Tag": [ { "name": "164-215-103-230", "colour": "#791D7E", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374566, "uuid": "82d333e5-aa91-47d9-80e1-b925377c4b21", "comment": "Malware payload", "value": "6cadcdb2c2cd1425a44fe08e00c4cfcff9498ee0", "object_relation": "sha1", "Tag": [ { "name": "164-215-103-230", "colour": "#791D7E", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374566, "uuid": "3c7b8c67-2753-4229-a7f2-6d5da2a3ae0e", "comment": "Malware payload", "value": "121583c575d837ef3ab98ca3e73b11d0e5ede21f09d47b2e030c66a0b77f4a9b6b2b6bff70ba2c9b170b6e87036e3f6f", "object_relation": "sha3-384", "Tag": [ { "name": "164-215-103-230", "colour": "#791D7E", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374566, "uuid": "fa13af34-e8a1-4369-8d79-66e82e7c73fc", "value": "T1DAF533641BE7495DCE1786A522EDAB21F7A133CD13FB2279CEC7C82A540274878D16CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374566, "uuid": "cb271c29-20c5-4701-9fb2-d76b5174f1e5", "value": "98304:gnMcCalkiEvx5aK3+5C5rUJpQU0sdQEeiY:6Mfv5MC5rbFViY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765374566, "uuid": "c8ebc214-7d88-4044-89c4-a82d90f92455", "value": 3433016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765374566, "uuid": "75bf33fe-c3f1-4d73-892f-8cb8c7b66074", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374566, "uuid": "7324c4f9-c0d0-4402-9d10-39fa2990b69b", "value": "813b69e1ffeb70cdd5a63a8103a896d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599cb621-d5f6-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1765391449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391449, "uuid": "d96384f0-0228-4961-a26d-2e606256b637", "comment": "Malware payload (CoinMiner)", "value": "c23a9e2cbac26cb5b5433797b026e96d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391449, "uuid": "787f8ecb-739c-4d13-a545-7e31c620db1f", "comment": "Malware payload (CoinMiner)", "value": "b4f42e2d8be3ccd05179f4ed0f21019da4f47b87cee2d08f0acd1e90429a376c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391449, "uuid": "ad750561-7c5f-4b12-8887-072637eaaf81", "comment": "Malware payload (CoinMiner)", "value": "7d88a98659aeabfc6111610189a9f2fad6fd4ae0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391449, "uuid": "72df06ba-2453-4603-bf73-5e1b77d12b32", "comment": "Malware payload (CoinMiner)", "value": "b53ab7cf86eb969f5a560c73a984d708e781ab19f53a00a20ec8df3f5231c112c169bb36686562e06c83164345ef9ce3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765391449, "uuid": "1e9a48bc-4d6c-4e48-9268-3965393a067d", "value": "T16E086C4262EB04C4F9F7DA759AE66617C673BC162F3095CF221C17291F336E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765391449, "uuid": "6904276f-72d2-4e41-acdb-83ac6280d95c", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765391449, "uuid": "d25a8346-89ae-4c40-8a80-928023be7bac", "value": "393216:+TI3xpBpYeoGmZcpmjz5GZd93ULfBPLoIJBsIyNOnS0B4AycWMCY6+Y3xjtFRYVP:+YrO/sJY2ByOjR5rs3wbvEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765391449, "uuid": "96233cc3-582a-4c11-bbd8-0125c3be56e6", "value": 82353333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765391449, "uuid": "c8c90fc5-df05-48f5-b012-4dc5768aecb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765391449, "uuid": "3c738376-6e02-4355-a51b-1531ae9c8d21", "value": "EasyLaunch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66f7a57-d5a5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765356869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765356869, "uuid": "01e76e7a-59c5-46f1-85a1-3622cb801b07", "comment": "Malware payload", "value": "08bc206ac48ce1c934d2a1c4ce1b8a6b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765356869, "uuid": "65762623-4f31-4f71-94d2-f27599a56ee5", "comment": "Malware payload", "value": "b50e44a397ee745408f2c2bec56099fb9d28ddb69b8c5382e493a73355ada67a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765356869, "uuid": "216c1c44-2ac1-4b26-9773-3438576db8e9", "comment": "Malware payload", "value": "5692e80945ed2e76ee865c3ddf2f72ff9bfe9f1f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765356869, "uuid": "d42f41ed-d1bd-44ba-8a8b-80a3c6a67517", "comment": "Malware payload", "value": "e813b6f9e55f48e2c654d971e4cdd57667e0c03357f2047935f6e94f5c00cf66876ee6d260908962717d07cb54abc09d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765356869, "uuid": "dacd8bdf-d09c-4a77-82ea-97f66089b2e3", "value": "T190360227A34E273EF06A56374972E970553FBE21691A8CE387E40E4CCE294601D7FE46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765356869, "uuid": "55e1764f-bb67-47ce-8519-75b31b41b849", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765356869, "uuid": "cd9d6d4d-51e0-409a-9c22-5995fd128488", "value": "98304:aDb51R4UR/Q7ouvx34TmrR9N2b9JtAGX+vUtBIUTUxAav/eCi:aDbWUW7ouvxRR9cb/tl+vU7CAki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765356869, "uuid": "326eed3d-b8f3-4bdb-be6d-4013f5704b5b", "value": 5042648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765356869, "uuid": "df6c4529-8992-494f-86df-f63641f29bba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765356869, "uuid": "b4e9ed73-3202-4a48-9ac0-5733b70c17e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29efb3cf-d61c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765407689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407689, "uuid": "0069b360-dcf4-44ac-9d2a-738978ff7c19", "comment": "Malware payload", "value": "969dc1413c1b82a6281f9db6e1a8bc60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407689, "uuid": "68731297-1c98-450d-85c1-14bb28ac657b", "comment": "Malware payload", "value": "b61ee518ba44e1fdc1689a56a8d765f10af2f9ddece7da07f8765ddd8ca41673", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407689, "uuid": "94a515e6-24c9-4c50-ab47-aaa06e1a4138", "comment": "Malware payload", "value": "504b4f346205bc285b3def28ca897d36654f5223", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407689, "uuid": "453cb4ab-e8d8-4810-b4a3-04c3e08734a7", "comment": "Malware payload", "value": "f48c84953b7b90f6ff4d6860b853bd4d4cadde2b8370601eaa9d96b379a09ab25c0580475c1e644b900eb09b095e633a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407689, "uuid": "7d59f3c2-b5d6-4cac-a3e5-99316c68aba9", "value": "T11D073318AB5014EEFCD7D03B695141D3B7F271242BA1DADB0B7812AC3F979E12A3E494", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407689, "uuid": "17cd8184-d624-421d-bca6-7086e72e2e16", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407689, "uuid": "0a0c0310-b13f-465c-90c6-4244e0304f8a", "value": "393216:TqGp/uSfdjcMo173sB1rnpDw1FIv7msbHHJyLA:TqMTdjcMo14B1FDc6isDJAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765407689, "uuid": "7f5bf1ad-87db-4386-972d-d558e1338867", "value": 18277832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765407689, "uuid": "545c319a-dd77-49a4-9ddf-1f3cfcebf2b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407689, "uuid": "4e6db69f-7988-4fa8-9edc-f45c9d00f83a", "value": "osv32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84281325-d622-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765410418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765410418, "uuid": "1c1cb308-bec1-4b25-ad6f-972835aa5e5f", "comment": "Malware payload (Mirai)", "value": "f9dab4bccf119bbe9846d38800c0b33d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765410418, "uuid": "1dbdcbb3-7c5f-4b96-bc24-495c3b4fa52b", "comment": "Malware payload (Mirai)", "value": "b64d07514425bfe1f64c7db4fee1a5944868e6e1ef92ba054d18ee68c597db6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765410418, "uuid": "4a55d129-c148-46a1-a0c5-f7f4557a8ae7", "comment": "Malware payload (Mirai)", "value": "ff731c121e46fbcd6690b50ed2ae5762e8ca35c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765410418, "uuid": "ab9011a4-930a-474b-9f8e-9bbdfdf314b1", "comment": "Malware payload (Mirai)", "value": "082d4fd934f39256fa70dd368111999ec47fde100c51c0d0deb1bcb14ac8fcba5dd73ea705307c2134d9edad71557eb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765410418, "uuid": "8929aad5-bd4f-4120-b25c-ea90b97ab4bd", "value": "T11EE47D99FE4E3D42D2CBE33CDF4AC7A1622B71E1D31352623E81425CD5DAAE8CAE1511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765410418, "uuid": "a552b6b5-ff0d-46a5-853f-d891befdc704", "value": "12288:y010+Bb4wwKoCK6WtBjSXit6WjgM3ySspR/Js5GPLFIT38Ab:y010+BbDwK5GSXdWjgyspR/Ls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765410418, "uuid": "a78f6906-2ef8-4768-946f-6cb949979769", "value": 690496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765410418, "uuid": "8e20a4d4-f285-4438-a90c-ae9dcb8a7598", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765410418, "uuid": "54fd5a88-8c6f-4303-8ab1-50a4b7a8d54e", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3c6839-d598-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350943, "uuid": "b94920d6-da36-4b83-9dc6-87f15f28b854", "comment": "Malware payload (MaksRAT)", "value": "68baa41151863b247f61486b37054e06", "object_relation": "md5", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350943, "uuid": "4fe2cb3b-dc50-4bca-ad33-22f027c7653f", "comment": "Malware payload (MaksRAT)", "value": "b66501e37f8ac4fff2022661019049897c14b5b2be812aafe7915b6ff14589ac", "object_relation": "sha256", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350943, "uuid": "4fb1685f-b8bc-4cde-876f-24f76c7c6712", "comment": "Malware payload (MaksRAT)", "value": "0a23acad49b06f2a201bd3bdcfae82376bcb46bb", "object_relation": "sha1", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350943, "uuid": "87e6d6d6-cc1f-4a95-a9cd-e843a68b2920", "comment": "Malware payload (MaksRAT)", "value": "5ccabd7fa00ec6512ba7fe00d7073b6920470723da2e31c16d8ca37e24e542de96af7cf925799971c9a7c2f9bbfc57fb", "object_relation": "sha3-384", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350943, "uuid": "983bc080-8c95-457f-99b5-089e9dea9a7d", "value": "T1C992D17E0CD24D71F80BA570A96336221D7810DD0E1BC2ED25856E4FAF213659FA3D5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350943, "uuid": "d05281ba-9f73-4401-8f9b-37fac4ee9a3c", "value": "384:4iv1D2Y3Gu5PgY5tuH9TxNeBuRaC2nlus+Y0FAArHPe:4ivJWulgUtuHxxNeQal5+/BHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350943, "uuid": "0434cfa6-592e-45ad-86aa-2c8694850c96", "value": 19837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350943, "uuid": "168a12d6-0493-483c-8945-b4b99f1d3656", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350943, "uuid": "ccff0cf9-2bb3-416a-9663-1227e50b4fc1", "value": "b66501e37f8ac4fff2022661019049897c14b5b2be812aafe7915b6ff14589ac.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5b774f-d5a7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765357546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357546, "uuid": "ef65ff36-b4ac-47d9-bf2b-5f295b0d7796", "comment": "Malware payload", "value": "8d33f4e216f08ce9a436e318f70fb91a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357546, "uuid": "ff0b1670-afcc-489d-8320-ce793a049175", "comment": "Malware payload", "value": "b730efdc6ca5eedb50c734e63079497b235c3a2ef6f466392402ca2997ba3b22", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357546, "uuid": "82d21eaf-9be6-481e-be34-551786f2190c", "comment": "Malware payload", "value": "062495037aed68aebe8d0063686abd000e1b2e0b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357546, "uuid": "e384ccd1-6d64-4834-9c22-d17612de58a5", "comment": "Malware payload", "value": "460e33601bca938d26750dc8ad050e83dd9cf6a5813a934ad7989a866f53492dfcf35216b10198bd3b50aa7d5a8090d5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357546, "uuid": "3718b202-cfb9-404a-b1da-5ff051ca50a6", "value": "T172283386F318E91BD0F34631C23602A7B2691D24C783D66F6519B23C59B3AD84762FE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357546, "uuid": "1a117e34-f82f-40d6-9a4e-370c20794ba2", "value": "1572864:T4y82O9sasrli34kHWiogL6Y2k4Rx6CJodXHewgLsaxx9KgrxGiViwQqM7Hce/14:HnO9Mr0kcL6Y2kE1JodusaxbKgt3Viwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765357546, "uuid": "c60c9f35-97ad-48b2-bec2-961f6e200621", "value": 99617915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765357546, "uuid": "730c9253-f66d-4f81-b746-eddc7b0ff342", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357546, "uuid": "5c6c26af-7cc0-44eb-b0fe-18a7c787649e", "value": "new-bee-china-RELEASE-6004.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9407e4a-d594-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765349545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765349545, "uuid": "36bc6004-e5a6-4985-8b18-9589227b92b8", "comment": "Malware payload", "value": "e733e940efdeed1873b3eebb15ad8270", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765349545, "uuid": "3b8e4ec1-2015-476e-bdbb-1c958d93ba0a", "comment": "Malware payload", "value": "b914aa78c6df6464010e69c94c69dfc54184c6aa37c1114754c0019f16c50d8b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765349545, "uuid": "7c41ff0a-f6c0-46a3-b457-65fbe334c5fe", "comment": "Malware payload", "value": "70abe8150c8757a3c330538c5d89bece371988d4", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765349545, "uuid": "7c16334f-ccc9-4207-b746-d9a956a38b8a", "comment": "Malware payload", "value": "0f0fd9afb93101a2a138a0fa258bd3b083858ebeb30b82b86a04c8e9491f5a1d40bcdb62019566057bd5c427fcb8854d", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765349545, "uuid": "c2814dd4-6ca8-4bd2-bc7c-9eda97182649", "value": "T13F9340855D8B506C9B9F34654A1FCC07EADE9207025CC8D07ECE9E867F219B4B2BDAD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765349545, "uuid": "e95e4982-42e1-4b5c-871c-e39746db1dd4", "value": "1536:jAecBFOYDLoJ+dRTLa2p2t2pyTCfqyix0LUe7kbMtNRmvhVuEITpED+4:gBFOYDLoETLa2p2t2pyTSs0LUe7k9VLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765349545, "uuid": "b87a4b92-8419-4626-a802-5d8a4b85f57d", "value": 90172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765349545, "uuid": "e98af508-193a-44f3-affa-6b5c08e32faf", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765349545, "uuid": "4db901f9-8fc8-408f-8f0e-ef7974f3bf9f", "value": "Edge_Images_Sydney_9857.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9183b1-d601-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765396421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765396421, "uuid": "7fa97cd7-95c2-4343-ad4f-cc399aa3763b", "comment": "Malware payload (Mirai)", "value": "1122bdf05f4d74acc273116e25bd7159", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765396421, "uuid": "0cc97a4c-dce4-4ac1-92f1-e9b1f315e2af", "comment": "Malware payload (Mirai)", "value": "b9d3b71c76e6817123d63ca9a144e63d9046cdcab4fb303bdafda3ef9285229d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765396421, "uuid": "3d22b51d-420b-4063-b9f3-efdf8cef3e27", "comment": "Malware payload (Mirai)", "value": "29755208b2d63a6d79f66bac63a5797f09e56a27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765396421, "uuid": "0e186a5e-4eb6-45e0-84fb-e825ee8bb121", "comment": "Malware payload (Mirai)", "value": "b8e70ac2fdaf77fd113bc2a4927a9d5f005361a32e8d49815e042665bb027a3ab13d3bb15fe22c82bbce2daca040288f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765396421, "uuid": "2bc932fb-7abc-4e6f-a2e5-d75de48f1aee", "value": "T1D913F124910844CAF6C782716BAC03722F74AF56644BAC0A9245F2577CB74BD6DD3EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765396421, "uuid": "08fbe799-60ea-4e4f-8199-ce8006cd23ce", "value": "768:I7ZthGPzqKogiiFpKPiO/2BnVC2H2Ad5L5fQghGqPpNNsj7cEuJgGlzDpbuR1Jj:I7bhGWXiDKx/eVC2H2WLJQghG6NNKczO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765396421, "uuid": "84c9eba0-5ffa-4561-9b0e-b3aaee82af89", "value": 43184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765396421, "uuid": "27bfca32-0b03-4534-be8e-0e9effd52fd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765396421, "uuid": "13a97fd0-8ed7-4bf4-9141-69bdba11ad7a", "value": "Labelloperc80.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06944819-d598-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350937, "uuid": "69a727b8-1832-4eb4-9d97-833408205be5", "comment": "Malware payload (MaksRAT)", "value": "8f7e0e120c7f6b22b701079683da10e6", "object_relation": "md5", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350937, "uuid": "378ef1a6-e347-46cf-9ac6-5fa582f25d37", "comment": "Malware payload (MaksRAT)", "value": "ba79bd093b566a303cb26f272f16a6661a66c77bc645ac66680cf9a8d58d5b57", "object_relation": "sha256", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350937, "uuid": "47d886af-c6c4-428e-971e-9ba998455a85", "comment": "Malware payload (MaksRAT)", "value": "366519d70ec39a3772213515291271175d3a14bf", "object_relation": "sha1", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350937, "uuid": "e9577752-a9f0-45fe-aa43-1d073f2c3c0c", "comment": "Malware payload (MaksRAT)", "value": "ab76e3387b41af42719fb94cb0001ed69053851e8b6cef4b1095791bfe865d58ba1118d8738e7b8908a9536f1f909dfb", "object_relation": "sha3-384", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350937, "uuid": "d96ff00b-f1bb-43de-9128-bfb07375e28b", "value": "T1BCF2F1513C385B15D6BB93B78283F243097274A40852299B8AFF9B5D75498818FE3FEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350937, "uuid": "617d7c85-5677-4173-ba0e-05a46cb1abee", "value": "768:QwOboC5w315KEGPb/lW31QPsG7yQ9krL2JVNMV0dS:Qp0C5w315XGjN+Qn6rCVMydS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350937, "uuid": "4db690bf-1c0f-435e-9021-779e88d8efb2", "value": 34467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350937, "uuid": "1fac20ba-69de-40be-9ff2-64f60353a5bd", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350937, "uuid": "3be6768d-6133-42dd-be3a-1291c655f584", "value": "ba79bd093b566a303cb26f272f16a6661a66c77bc645ac66680cf9a8d58d5b57.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16efba3f-d5a1-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765354829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354829, "uuid": "7624111b-7c47-45fe-835f-e7de2243c942", "comment": "Malware payload (AgentTesla)", "value": "d3d6b9beb470de717a68ef4506e2f9a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354829, "uuid": "00d01a1c-3bd5-4efa-b626-07915b7a90f9", "comment": "Malware payload (AgentTesla)", "value": "bb729ddcc6abc05fd0d9c53f6d359662d88a3530e35a17c1e0a95e1871dc647b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354829, "uuid": "44cb08a9-5ea5-4e9b-8c9c-c73ab6be9aba", "comment": "Malware payload (AgentTesla)", "value": "ef792036e3d6a28e0a4c74d6f13151f697721057", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354829, "uuid": "c71c3dbc-ae10-491a-962b-183334881cab", "comment": "Malware payload (AgentTesla)", "value": "0776fe6c00d2524e6174a8a369c52acdb7d4dcb0d49eb5a473f3bd74dc96300bfb9c3b45adde970711e9c23858c7b156", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354829, "uuid": "2d6bba9b-e5ab-4652-82d1-02ad6a319c29", "value": "T170E43359531A11F017E0FC0E15B1A2C05E09C1E3E8DDCAFB64937B1D8ADF941B9EAA63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354829, "uuid": "8fd267bc-3a66-4006-a9bb-4e20ea8381c9", "value": "12288:DVENjuIOGBONMwlIxX5zuOAP4LsdZhZoiyaLsVqGFkA1Y0EaK8Cazbin24zl0L+:DVEVkeFZujgLwhDvscukA20nK8bioy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765354829, "uuid": "7a9a14d6-960a-4aea-ba47-4ad3add4c444", "value": 721007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765354829, "uuid": "a87f9dea-3cfc-4cb8-82bb-962e432ffd50", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354829, "uuid": "c3bbc4c0-4e1f-4fef-8af9-892133b05f8b", "value": "519745023.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a01a6aa-d5ef-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765388389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388389, "uuid": "71ff4977-60cc-4504-a278-2a4b90c18536", "comment": "Malware payload (MaksRAT)", "value": "4a03bb8f94c35f9fd593ac29a1f7fa98", "object_relation": "md5", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388389, "uuid": "c6364368-9d99-4ef5-b5e1-a1bbdf46cbde", "comment": "Malware payload (MaksRAT)", "value": "bb94f92b77e81cb98621c95cf3ca5a6d14cb7f90de59e6267f1e973430de1232", "object_relation": "sha256", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388389, "uuid": "345c9715-66d0-4957-9f89-a011ddb64c96", "comment": "Malware payload (MaksRAT)", "value": "3384685dd4d40e1db7a799971b24f1a89c707e45", "object_relation": "sha1", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765388389, "uuid": "356275f2-7612-46db-87ef-fce386800352", "comment": "Malware payload (MaksRAT)", "value": "35912b6cf09a8a306d6ecb0895586a5a1823c5c48a2b83e1b0e63e26580da515bfc1d277b7e335129f046801b01bce90", "object_relation": "sha3-384", "Tag": [ { "name": "donutaftersleep-shop", "colour": "#26ED4C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388389, "uuid": "eb869d25-eeef-4827-b55d-cef80da8324f", "value": "T111E2E1B48FF9DE54D2A885B8C90DE1C226D1F088E86EFEB7BDA1100C193CB965D23175", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388389, "uuid": "3e0c1653-2570-45f3-a245-8ccf06ccd3ab", "value": "768:hXR+Zo6PxZFqIyZQYS06TT0zZpGLCqoEFeGUgFGec:hXRgP151AG4y3Gec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765388389, "uuid": "e4ff2a30-a15b-43e1-9f34-836a6919c109", "value": 32805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765388389, "uuid": "802c60f6-1a02-4ed3-b85c-19756c469329", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765388389, "uuid": "0a330bfe-a938-49a5-8ea9-05413f4028ea", "value": "bb94f92b77e81cb98621c95cf3ca5a6d14cb7f90de59e6267f1e973430de1232.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b5793c-d5b6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765363850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363850, "uuid": "3836e111-64af-49db-9ed3-ca044ef050dd", "comment": "Malware payload", "value": "c8fa8566a0b184fe4ef9248c60c9b62b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363850, "uuid": "0202bbc2-ad76-45e9-a552-f06226202703", "comment": "Malware payload", "value": "bd238e9dec52dfddcd538c7a4ac0607433c34fff5e81b71397507d4eff12d317", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363850, "uuid": "a0e2b65a-eb50-4363-81f8-6b4cac112c47", "comment": "Malware payload", "value": "c101e66eebe92b060e1db04a15b66de3ddef1f63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363850, "uuid": "bf99067e-95fa-4be6-9830-ee41929e475a", "comment": "Malware payload", "value": "1a3864d53e7bead4d05396479645db9c95ddde9fc2e064871d6e90abf38e869e043e66adcbc42b35a836677a145e2ea1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363850, "uuid": "cb47fe74-a99a-48ef-8fc4-2b8297a6ef2d", "value": "T1C6445C85BBC5ACEBC6050636C9AF436D7738F6D117879B170D28B2341E27AE0BD87606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363850, "uuid": "0b859fad-2f32-41e6-9c28-c20549e6b5bd", "value": "a625994c22b4499bb3c23ba424ef62fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363850, "uuid": "fdc986e7-d430-47d6-9eec-eda7a09e6727", "value": "3072:yMVqwc4Qc4HakM0VkAjQLT/voXHEWEP2GzwsipkNde5RXgxa2qp:ygc4MM3LT/voROO5RXKqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765363850, "uuid": "02372a89-abf2-4058-8494-1a4ed114f9a5", "value": 256650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765363850, "uuid": "04baaba0-c08a-4af9-826a-c63f1c9dadfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363850, "uuid": "e34d81d4-3468-4a18-9c02-cccd22048c07", "value": "backupagnt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0fecfd1-d59e-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765353773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765353773, "uuid": "174bb9e3-38b8-4332-ab5f-22975cd4df38", "comment": "Malware payload (AgentTesla)", "value": "0574b4b761b85e39173a304f606394de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765353773, "uuid": "2889fdd3-2cd2-4f59-9f40-fb51e168314a", "comment": "Malware payload (AgentTesla)", "value": "bdbc75ab154f31dee291571674100e90dd525bc16286a8adb0ae8c3004d233e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765353773, "uuid": "69f2c20e-9da9-4909-a53d-c388e9ce4176", "comment": "Malware payload (AgentTesla)", "value": "64ea59cfd978974f12c0f7e4285c3c31de8e3a5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765353773, "uuid": "607c291e-ccb5-443f-959f-76fb6b67dbce", "comment": "Malware payload (AgentTesla)", "value": "f611fd5deb572c005a2e31b737a801a1c8fbbf846c8e0b90a2c15c4ff9d1f29882af8939b5cf7f7b323a691b6d8f28d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765353773, "uuid": "014ed396-f31d-4353-8524-95926bfb3c0a", "value": "T13B35334394D4134DC1111AB4C1FBA35A4793CB6AE7CB64D86C9DA33BD426BC9EEC2E90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765353773, "uuid": "2d5e8f25-4ec0-4f1f-be6a-1b10056a9d20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765353773, "uuid": "b13a8b21-671f-4148-a7b9-678ccb58bd85", "value": "24576:u8lsBoCOwl7IUoWooTU/GaPq3vBp2LAMger:ubOwJGr7q3JLNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765353773, "uuid": "86d8ba9a-2d09-43d7-bba3-c978d4155c6d", "value": 1113600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765353773, "uuid": "7c595499-6920-4ad3-be20-068a333e8fc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765353773, "uuid": "d110c97a-b2d8-4248-a4b7-18bdb0f8f5cc", "value": "5107428300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda5adc3-d571-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1765334547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765334547, "uuid": "76c12531-d81b-4b3e-b2b4-73236b31e2eb", "comment": "Malware payload (AsyncRAT)", "value": "bf161578ad45af605dd3aad7bd1b5cd5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765334547, "uuid": "90624704-3e77-48bf-933e-de1cbee44b5c", "comment": "Malware payload (AsyncRAT)", "value": "bf9c08ee1c58899f4734654f212c88f884006b4cb72f1fc959beee10613980a7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765334547, "uuid": "2589e536-c9c6-411b-8213-b2f9058a46a4", "comment": "Malware payload (AsyncRAT)", "value": "578a65b9427df689730d9274b04749b7eb62e167", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765334547, "uuid": "3b70f2d0-152f-483f-8ae7-42e0005759ea", "comment": "Malware payload (AsyncRAT)", "value": "ec6afbc01398d838dcda01ef2d5ad42ffcd42c25b6d20ac2b4cf608c3148f800f1bfddf419e323a3910fba42a3bf6f20", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765334547, "uuid": "459fa86e-7f6d-4fbe-b9d7-92f78590328f", "value": "T157232B003BED812BF27E4F78A8F26145867AB6633603D64E1CC451975623FC59A42BFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765334547, "uuid": "80b8983e-6f14-4018-ab18-6cbd5e9eb56d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765334547, "uuid": "86043143-bb75-4c32-832d-2b77e1dcbf25", "value": "768:buuN1TFQ3nFWUFy+/mo2qD2psFH9aSc43PIgPzjbBgXei1IE29HHoGBDZxJ:buuN1TFcJ2HpaaX+3buXn1IE29nPdxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765334547, "uuid": "bb3fb18e-82d6-4a44-94bf-01505f1b23d2", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765334547, "uuid": "e1ee5fb7-18bb-476a-93c5-54f9103a8414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765334547, "uuid": "266261b1-316d-45bb-af1a-5fed48c03775", "value": "microsoftdefender.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed03c5a4-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350464, "uuid": "da8bfafb-6627-434c-a3af-b6e607665080", "comment": "Malware payload (MaksRAT)", "value": "8bf48fbc26eaef028fc94ab42ee7b7e8", "object_relation": "md5", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350464, "uuid": "2484468c-fc48-4a82-99a4-033dbc9b9217", "comment": "Malware payload (MaksRAT)", "value": "bfe55a03bf1eb6eb64605a9116fa36ed5b1c80c8e04319edc69544c41bf3f83a", "object_relation": "sha256", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350464, "uuid": "875fe119-b9f0-40db-b73d-3af54a8770da", "comment": "Malware payload (MaksRAT)", "value": "ea87c1581082edc4669c73e31fcd2f242f066e4f", "object_relation": "sha1", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350464, "uuid": "5f6c8c83-0bfe-4ef1-89e3-804e05b1c8c4", "comment": "Malware payload (MaksRAT)", "value": "c99ac8e1547037c3d57f3ce6ebfb81b9f904663bf564ed1dc13250126d20bfb8c9879bf7a57d9855e5a0439148ca9d6e", "object_relation": "sha3-384", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350464, "uuid": "ea38a23e-5196-4231-9503-6078d2dc2ea7", "value": "T156E2F1A9B2D483F8C14B26730F8569F461BDD1BECA5566CD34D4300C6CA0E720EAACDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350464, "uuid": "40c5ab42-dbb8-4266-8e05-4b877ec0e937", "value": "768:GmT8DiMxIpxsEifFiPQHTkpqO5Y7PB499GlJ120rfzNcbvf8ll:X4bxIpiEAiozA5C2GlT3rZcz8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350464, "uuid": "3433c42e-3a29-497a-b876-ce6bc82966af", "value": 34152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350464, "uuid": "1b4f33b9-af1f-45fc-be85-9cbd7b3f9a16", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350464, "uuid": "eed8aa47-17ad-461d-a708-7371319108b8", "value": "bfe55a03bf1eb6eb64605a9116fa36ed5b1c80c8e04319edc69544c41bf3f83a.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80e297b-d5bb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765366240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765366240, "uuid": "3211b0c3-80c3-40db-b583-c65cf8972600", "comment": "Malware payload (Mirai)", "value": "c75aeffdd823ed500ebea4b79bae1aae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765366240, "uuid": "fc8b03c2-326c-4f63-81e6-edfc6de129ad", "comment": "Malware payload (Mirai)", "value": "c0ebfe9c9e6485fe505f43a300990788422d29e2fea1a4de1a7fa8c3d46c3a99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765366240, "uuid": "b87cf4b2-b090-4247-8341-1702a6c6d6c1", "comment": "Malware payload (Mirai)", "value": "d05c3174df9bf4da3db68216227016cf0809e849", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765366240, "uuid": "3e7d06df-8ac5-4cd8-b11c-cb9ab4030a11", "comment": "Malware payload (Mirai)", "value": "2c984521b819d57f3b80e0fc080b2707d3bf74bf6f25829cb85468a3882d2df39967c5aeb686b5aa4542d85ca165814c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765366240, "uuid": "33e7f039-0371-4d58-a8c6-7a7d08999cd8", "value": "T13F156D5AFD0F3D4BC2D6E279DB8AC3F4B12BB094D21351A325C1024DE6C599D8F6298E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765366240, "uuid": "434d9cb9-0300-412f-af78-aca926d306f6", "value": "12288:N6gtrx2SRsaM6guSG8JVQuPzeqJFVEta5OAugfPlCxqdPz57UoaH:N/4G/guiZHumDfuqd97Uoa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765366240, "uuid": "a2c538ac-4b21-43cc-a56b-5c2649bd5044", "value": 933936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765366240, "uuid": "7f9bdda6-4e6a-448b-92df-a1c15d0ca13b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765366240, "uuid": "daf2e3f5-df6a-4d3e-b476-b6030d2f67e2", "value": "executor.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6696cc-d5ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765365710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765365710, "uuid": "1e85abc6-c0e8-432b-97ab-3e38e8cc74bf", "comment": "Malware payload (Mirai)", "value": "b484b2b6e6b68fa805830205d37d7358", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765365710, "uuid": "15cae0ab-7f6f-472b-be16-c77b97f86770", "comment": "Malware payload (Mirai)", "value": "c22439948b14dd0e82356816dfaa676425af65da8efe84158c0e00e0b275095c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765365710, "uuid": "2acba645-0235-4564-82fb-b1663516f84e", "comment": "Malware payload (Mirai)", "value": "2c6ee8aaa40dbfa08858e2c08b8df28b289a4258", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765365710, "uuid": "c640dee0-b05d-4874-afdd-c3556c0935ec", "comment": "Malware payload (Mirai)", "value": "885f42717e1cb186dbb962716f253e5c76acf95c32abf07ea2517db8d7e4efb2b575e3f3c5402dd74fa259b22c46e8b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765365710, "uuid": "392a4a81-a92c-4bda-b697-499c77d91c4a", "value": "T1A383021FE5A3D86E942E81B2E499574EE916A00F4024CE3FB4D95538B8BFD241BD8FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765365710, "uuid": "8913edb3-f926-46f7-beb0-33ea79778c9f", "value": "1536:ZpHqsZpmnGa4sF3VQxbQ7inCs69VZa22nXloOQIGNOykoC5oJlfzhKURKuBxaXy3:ZZjZfhsFlQ5np6Nt2XuOUNOaJl7UFuBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765365710, "uuid": "2f29c7dc-9c90-42fa-b612-337fc40e07cc", "value": 85028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765365710, "uuid": "326d0612-4276-4bcd-9cb5-c85721b6bf71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765365710, "uuid": "a43fcb60-5371-4e38-ad17-04f837f99516", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1183e389-d5ec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765387033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387033, "uuid": "3c400677-2533-489c-b2e6-f4d74b5de098", "comment": "Malware payload (Mirai)", "value": "daebfc487fbe03ef59adde0f2b7b6a9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387033, "uuid": "bd39a98b-e45a-4e10-b1a1-f6d52d99f692", "comment": "Malware payload (Mirai)", "value": "c31fcc01f0f596380a39690803dc56937cf44e444e9343a6acc0bb9ea400ad96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387033, "uuid": "928d4097-0ff3-4265-8d66-29515a788be2", "comment": "Malware payload (Mirai)", "value": "0c6fd349cd4de42400ed262dba7526a341699b48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387033, "uuid": "cd15d390-0d30-498b-b52c-eb748fd20e28", "comment": "Malware payload (Mirai)", "value": "2881cdd02fc8485a4d451233d2a7de64bc8d159427c76dc2373442ab48169ac11fc6778e8423af5256aca952a8145801", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387033, "uuid": "1908183b-b4b1-48e8-ad82-72096bcfdbf7", "value": "T1A5344B45FA418A13C4D117BAF9AF414A3332A795D3DB730699286FB43B837AF0D67602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387033, "uuid": "a7548549-c0c1-4ad3-a095-e98511cf6f7e", "value": "6144:W8tTPAQOBzabKacEK1dAnJd7eLfdfM/9hWfAU:W8RAJBzabKacE62JIp0/yJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765387033, "uuid": "34927d65-2bb1-41d6-a49d-d2e6a8d1dd73", "value": 231680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765387033, "uuid": "71ff5d79-fd6a-4374-a7fc-b75ecf7097db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387033, "uuid": "ae3e8f15-84c5-48e2-bf8a-7635d5157cf4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5ade01-d5a0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765354490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354490, "uuid": "677a413b-9d8c-4e9e-9cd7-ade13c208613", "comment": "Malware payload", "value": "5b304f8ff365773c61e5d904c560be94", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354490, "uuid": "710e105b-171e-4ad6-9ccd-f586c228be50", "comment": "Malware payload", "value": "c38b76a4094ace73c67168c1459c9559e2766fb7c44a06113ed0b93360afb93b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354490, "uuid": "7484b68f-3eba-4835-9e57-6c48dc4a6d6d", "comment": "Malware payload", "value": "649a3a81af3c470c0020d6818516af3ec461c2d2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354490, "uuid": "c7cdd5e1-4a16-47cb-8787-5c347448c54d", "comment": "Malware payload", "value": "80e615264ae78f0e4631323d76aecafefe75a5c21e9d07a60b8a1dd850db8bb2e36776a3b8dc87335e8f48b450ab47e3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354490, "uuid": "78f19be9-c510-4e91-9655-bb1ecdaf08fd", "value": "T1D0A1F5C93D6033B38EA49E3DF2F54A2B20C2E0D0A1354F94660970FD75ABD45F610EA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354490, "uuid": "f91ed8e6-ebdd-42ba-b58c-f31935ae814b", "value": "96:1x4v8jX5cpgXnRoLA7DdgVMXazXXlAfjfh:p7XnRoLA7DaVMXabXlAfjfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765354490, "uuid": "51906b4c-5e4a-4574-8e57-a4824967148e", "value": 4905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765354490, "uuid": "3a6138aa-6576-4469-b28a-50bc8cb269f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354490, "uuid": "7591e1ec-f788-4c57-bec2-bd7447a15e88", "value": "q", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62599c3f-d585-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765342930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765342930, "uuid": "0e5f1a20-75df-4f07-90bc-de646c0f742d", "comment": "Malware payload", "value": "ce9abc17fcd0791e50fd1790c8ee7331", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765342930, "uuid": "799ce341-942a-4658-86bc-4a62fb33bd38", "comment": "Malware payload", "value": "c4208dc7945ee1620eac5fe884d3663d801f6f59d7a0d2fd7e5a84d08e1be00a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765342930, "uuid": "7199b77e-f8ef-4e00-9385-3383c4c9c59a", "comment": "Malware payload", "value": "e4127c455906b4ca4a30eb9c235153ab8e03fd73", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765342930, "uuid": "2408a392-bd80-403f-a570-6a5ac6493d78", "comment": "Malware payload", "value": "92f19b27a22c3d8cb2695be1fec7d166138e6c771f41dbac65ae14486d32eea94e9bea1f0129de196fa1edcc46ef78fe", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765342930, "uuid": "e8b0b8a1-e889-44de-ab0e-b0b017b547f4", "value": "T1E5938499DDCB4464AB6F7025061F9D06AA9C8217022DC9D07ACEAF487F139B0B1FE7D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765342930, "uuid": "b37ecaa5-b32c-4743-90dc-c4b370786e3f", "value": "768:4+XgqjUqWvFbY+nmzV+p92CsNDt6XpHUm3XhhY1ik5CH1HRUv3UcOogNOc6upgIl:4+sFCtNDt6XpHtHn1g8hEqjl/ujSuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765342930, "uuid": "bf5fe900-8925-474e-b0d2-659290f1477e", "value": 89904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765342930, "uuid": "43c44913-cba4-4e19-ba3d-d34979c01d64", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765342930, "uuid": "964b0730-19f7-43d9-a951-f346bb37c952", "value": "Config_Primary_v1.7.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88a0b72-d623-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765411016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411016, "uuid": "90b9a24e-3662-4567-8a57-e6a0bc079c65", "comment": "Malware payload", "value": "6d6c3bfc3ab12c5cd54142f2489de625", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411016, "uuid": "f933baef-79d1-4371-9130-b89f64b30412", "comment": "Malware payload", "value": "c469489d40b0e7905c61998f135808f8776c978cc8aaaab1c0cfb91ec2380b84", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411016, "uuid": "8d3a9afc-5dfa-4cea-89a9-68652139e283", "comment": "Malware payload", "value": "d2b57821cc737265dd6309e9737bd56a6f6f2427", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411016, "uuid": "8c856e93-29be-4f03-941d-3011a91457dc", "comment": "Malware payload", "value": "89dd41e9e91dff59048248d49c3762fc99cf0c53f49a23742dae23407b4b8c1d8cf18aca20bbfc3cf98c9fc1d26acb22", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411016, "uuid": "fbcdc947-dafd-4135-99ed-4c2ae9127563", "value": "T16B3139CB21920D782CE5D97731AA482475E7A0C654CB6F856DED38FD588DE08F444EA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411016, "uuid": "0925c314-e364-4c6a-b6aa-891e75666611", "value": "48:v2mE2RHr25+M2Zr2J2SU2J2aE2+U2t2me72V2e:v2mE2RL2AM2Zr2J212J2aE2J2t2Z2V2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765411016, "uuid": "13d28064-259e-4aff-a5c2-9888f40d2b6f", "value": 1601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765411016, "uuid": "10ea5fa2-6887-43c2-a323-55cd26f2c51e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411016, "uuid": "bd37b5b3-695b-4162-a476-e00c7d33f6da", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b0976e0-d600-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765395612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395612, "uuid": "eced8797-ed69-4798-8a47-99af146787c9", "comment": "Malware payload (AgentTesla)", "value": "7656cef15342c9d9d20e85d1ec2c3d6e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395612, "uuid": "01460dc2-bcc3-4051-8b34-ea26bf9c9d7e", "comment": "Malware payload (AgentTesla)", "value": "c55cc3475b3d17bd08deb99faeac09bed2ea099145ad984c4b7b71e6e27b14eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395612, "uuid": "1b7e5ee9-7c77-484f-9f12-d04d6efffd4e", "comment": "Malware payload (AgentTesla)", "value": "a29a1b998bb9e29264aec16a56bedbcdac1dc030", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395612, "uuid": "6503803c-3a80-448b-b843-5d8f1d9c629b", "comment": "Malware payload (AgentTesla)", "value": "ffbbc2addb54eb6f67a5343f7c96c3f7c49b4aca04356bce740fde2ef8a283491cd6df71d8c49840c11ff4d4a2a41f02", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395612, "uuid": "bc7f6e0e-15dd-4e9c-b0a8-e563bb9f131c", "value": "T1E035F1A3F46891F6C6F86136F147E53F2E0A8EB526018541B3F13F5E36B29A95720B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395612, "uuid": "6bd41761-7fe2-41fa-a0ce-845a3c404a3b", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395612, "uuid": "9189ce90-3b81-4648-8a45-a3a5c65eafb5", "value": "12288:UItBqBRz1NqmstXGfqT2xYtGeEGyh/ugcIZ/TfEv/yjqzcAI7cJdDrR39oxIhNhS:hyZkt+YtGpjZbEnyWz3JdDr6knTRURbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765395612, "uuid": "191fdaaf-3191-4946-b958-a986181db4fb", "value": 1141936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765395612, "uuid": "a2d01287-f442-4e52-ab99-762bae6241c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395612, "uuid": "dbffd07a-d973-4f3f-918c-4d7b9040ba4d", "value": "new-order95959688968787.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0b7f43-d5ec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765387020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387020, "uuid": "4f50f69b-f5b9-4f60-9437-55b4ac1eb1a3", "comment": "Malware payload", "value": "bd950da2d98ba0ea91b9cd6dd0618792", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387020, "uuid": "e513d75b-ab06-494a-aa19-56cb1d8e9dd3", "comment": "Malware payload", "value": "c6487a6704f950209a9df106c28eb08e174462ebf5733fe5078dc8784ad0c33c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387020, "uuid": "bd2dea80-32cc-431d-a1ed-ae820df8f2ea", "comment": "Malware payload", "value": "5ac0e5635aeaa98616b19a70096cedf2b6f5027b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387020, "uuid": "4862b979-7e0d-46fe-92f6-23937cde670a", "comment": "Malware payload", "value": "52b41380b6ccd32363e2933d0bfd72c359c31748c051d39bfcaa7854549580fe1017eb8e025f571e402b42f868077738", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387020, "uuid": "3d63450d-9d2e-4575-8ea8-724b5c3e2a79", "value": "T156D533E41FC117F0EBD273ED232A5A21CAD50F92104425B1B2C95AD96B7BB37237934A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387020, "uuid": "2e453ed3-9dff-44df-99cf-a48b4d89c4f0", "value": "49152:GM/6zyU33rlPEvfJnowGOq7xeVqysEbkOmOrubzj6PDR:b693rlPef5GV7xeVqjEAnyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765387020, "uuid": "1ec192bf-aefd-4bc3-a802-1b50ef3ad860", "value": 2877372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765387020, "uuid": "e97d0643-b96f-4ab3-af04-5da5976f4501", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387020, "uuid": "1ab873ec-179f-4fff-be59-c6c0e140d18a", "value": "tcp_linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14dae0e8-d5ce-11f0-a129-42010a9c0007", "comment": "Malware payload (MuckStealer)", "timestamp": 1765374153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374153, "uuid": "c34d61aa-e833-4faa-b72e-c8e538ca1b7f", "comment": "Malware payload (MuckStealer)", "value": "a98654a97b89a3d30818b6a82c1fb0b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MuckStealer", "colour": "#B883E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374153, "uuid": "67239fac-062e-40f5-875f-6b18ce9604b6", "comment": "Malware payload (MuckStealer)", "value": "c797e8c290309034a76428bc8c9e79655e69d147125850ae1f9ce3ed35dc1017", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MuckStealer", "colour": "#B883E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374153, "uuid": "90193d73-86b0-4c67-9255-475ef47e4072", "comment": "Malware payload (MuckStealer)", "value": "5db638d8e9928765953ede853743a1ce9fdf728c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MuckStealer", "colour": "#B883E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374153, "uuid": "51afb6f8-63b6-4151-85aa-98ea4a398bff", "comment": "Malware payload (MuckStealer)", "value": "b912a9b90bf64a482d86f4330384dbe0e017e766ca21ba6fccd7b889a1448f613456928e436f28eeab622cf5371e53ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MuckStealer", "colour": "#B883E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374153, "uuid": "db3eea12-c28f-427e-aad8-29e81f2bb6f3", "value": "T1C7073328AF5004EEFCD7D13B295101D2B7F3B0A92B71DAEB1E6812A93F975E11D39184", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374153, "uuid": "5f8321ff-b01c-4d2e-961a-0b2e1bfad719", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374153, "uuid": "3e3502ae-7aaf-47f6-98ef-b76e21ea2c91", "value": "393216:NqGXayuSfdjcMo173sB1rnpDs1FIv7msbHHJyLA:NqmTdjcMo14B1FD46isDJAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765374153, "uuid": "2228c628-b687-4ac0-900a-337896dcef8d", "value": 18277576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765374153, "uuid": "334dd8ed-c8d0-458f-a109-45bb94d76b37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374153, "uuid": "32e50901-edfa-4ef8-8fc9-79b4410015b1", "value": "klv8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd4de2a-d5ec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765387298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387298, "uuid": "e2962043-a6da-4432-aa2d-652ef1917760", "comment": "Malware payload (Mirai)", "value": "352dcf7b5c4d4a49e6ddba8dd6816e68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387298, "uuid": "28232f19-e51a-419c-ac64-42b41076bfdf", "comment": "Malware payload (Mirai)", "value": "c7f7ccd1145ae14e5dc9000fd88a59bbc08f12d70f9ba34c3df631162dc54894", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387298, "uuid": "11130125-30e7-4188-a950-0a4251d3c5f2", "comment": "Malware payload (Mirai)", "value": "54d9710fe7d4c17bd82f1a8591b806f93a252452", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387298, "uuid": "9744aa36-be40-473e-9df7-0d0e57123907", "comment": "Malware payload (Mirai)", "value": "59fe0aaea20796d9f03d2a8bae5037a3bc5f910337bb6f09fa3412f87c1d3e266fd673e88db735bb5aa494730bd21412", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387298, "uuid": "bac3e33a-effc-4169-aa8f-0ef53eca64c5", "value": "T145D33A2275791E2BC4E4A87E22F74761F1F157DA25A8C90E7EB20D4FFF212206507AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387298, "uuid": "0f54e144-c845-4c49-a083-fa7feb2f966f", "value": "3072:nZUlV+Fawd99IVWFjKc7RgyHOFe30Hi09lshKwwh:ZUH+FD99IVWFtvOgEmhPwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765387298, "uuid": "77a7ebe4-71e3-4f7b-a91a-22547a5c078a", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765387298, "uuid": "7015e87a-eba9-4437-b457-e41099aaf3c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387298, "uuid": "8a6273d5-d886-410d-b424-291bb09b5642", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8461f1c-d588-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765344390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344390, "uuid": "57733404-4344-40b8-8b6b-f3646f67c513", "comment": "Malware payload", "value": "2dcf7660f507bec9c7fd70e22fd02e74", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344390, "uuid": "96491370-1cda-42fa-954b-8276a500e6fa", "comment": "Malware payload", "value": "c8554a563c365bc4bf79d2739cf4be17b26f504aefeb7c75a08c4787a45cf015", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344390, "uuid": "940d5abf-6869-4294-998d-988ba103a1c6", "comment": "Malware payload", "value": "8910f56a3ee7e9f8ea4df79e5c30965d99b38c80", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344390, "uuid": "98ce21d8-35fd-4938-aacc-bc09a4c64af6", "comment": "Malware payload", "value": "0f701a82b89795c0ad9d822eb4ccbe9f408691a2e499a4e59259b57c77e2fb2386b36c7de25b7c5f5d5576c5bba2ab44", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344390, "uuid": "aa181053-89c1-462e-966a-6a8d14606060", "value": "T1DD519D101EE71254F2778B7257F9B3624877F864D93C56E9004C86441733691E4B6F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344390, "uuid": "78f2c486-89ba-43aa-a86c-d1148a1043cd", "value": "24:8lw/BHYVKVWp+/CWWAt2VFv7kaHqaj5CChwwk8vvWitqMdd79dsrab7Z:825aC2V9AaKaj5CCh1kOvdcMdJ9AaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765344390, "uuid": "e91590ea-29f0-453c-8ac0-892174ff49bc", "value": 3022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765344390, "uuid": "52944ef9-5159-404f-8cb1-cf0f1af3ebf4", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344390, "uuid": "a8406c19-179a-4439-9ed7-8c45f7af8cb9", "value": "Example.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b146e9cc-d587-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765343921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765343921, "uuid": "427a0e78-fc15-40db-9374-1cb15b67792d", "comment": "Malware payload", "value": "1486abd16d92657ad2ca6ab95aec47be", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765343921, "uuid": "b23fe3bf-8fe9-468c-b9ee-e7d8efd7b2e9", "comment": "Malware payload", "value": "c88b08ee12c176e941f6761c91fdfaa4674b38ef830f5a94c1ddd9f8cdfed575", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765343921, "uuid": "295b1e70-aed7-4ed2-8dd4-efcb9aaa4d12", "comment": "Malware payload", "value": "fa6e272484b8ce08398aeabe1c384051feec924a", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765343921, "uuid": "d6391d34-cae0-4dc4-addd-7247ed955774", "comment": "Malware payload", "value": "329f188910ecda624a3acc20ec03bd70b694164f00cb9e57150302e5a7e436dffef69b53a28942b4ebc79f4b1efe0f11", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765343921, "uuid": "d73269cc-d5db-4f83-9bd9-d21cd0f9204b", "value": "T11DE502BB98B269836B904563E70F2C1A335B19D43B54D342EA41949C6F7B1D38F92B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765343921, "uuid": "3760941e-465a-4e70-82cb-b89b3e9d5a30", "value": "49152:GOc2yD4lTP1IWPRzLsdGAspFeOCNZO+BIbLrV3ZGXCcInioo37KwLE8sDxAei:GoyEFP1IEvskFKNIi6LJZEd33LtsDDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765343921, "uuid": "6ef0aa2f-eb9e-4a73-a505-f98769ff73c1", "value": 3044022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765343921, "uuid": "19d1235e-658b-4bb8-8a8b-2cf432403c82", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765343921, "uuid": "13eb5eb9-9610-4da3-a3e8-526c7c568a5b", "value": "Invoice No. AT-254614 dated November 30, 2025.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5564f58d-d604-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765397454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397454, "uuid": "620a5e16-833d-491d-ae8f-a0a15a907a5b", "comment": "Malware payload (Mirai)", "value": "f42f36b11777afa00b678c945f26d508", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397454, "uuid": "d6897d91-1579-48e8-8d55-075be6bf10d3", "comment": "Malware payload (Mirai)", "value": "c8e78b47bea8e92afdf0c5915e0e879dfbfa948609292b5c98f970589d3e57ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397454, "uuid": "ddaa31bf-8ead-4db3-9635-f74d79d0b757", "comment": "Malware payload (Mirai)", "value": "6dc62d43f671364b36ef94d39b4802186424b71b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397454, "uuid": "82ef6735-cee4-4f00-9baf-8fd0800981a8", "comment": "Malware payload (Mirai)", "value": "5b635a0c6751554bc7bc2ef5a1294f11264056d2f078ecbfb5f646db4af9873cafc7c29d2e0edf107c8de8349d0e0938", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397454, "uuid": "66716b79-1c69-459b-8e49-3e02a7e7dc79", "value": "T12C83BEB3C86A1D28D44844F0B0A4AF3597A3E012C5972FF69896C679D08BEDCF5467F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397454, "uuid": "dfa9c669-5d31-417d-aa62-77717130a50c", "value": "1536:eTJrnxmPf4Nqa5jDdQvHAK+BGsLL4SCCn823DCWp+:eBnx9NjDuH+fL4SC1WWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397454, "uuid": "7b2b1bd7-de83-42ae-8047-86d895adf043", "value": 81080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397454, "uuid": "b2a02ed4-6a3f-4f7f-9687-87b496f644f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397454, "uuid": "78262cf2-f48d-48ef-b774-eefef418b8a5", "value": "Labelloperc80.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8908b66e-d59b-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765352444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765352444, "uuid": "32bb182d-6a3d-4365-8bd6-2fd946ee0f8c", "comment": "Malware payload (AgentTesla)", "value": "7b0fd7cd4a17cdc01799de4412417d05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765352444, "uuid": "b3f3c41e-e25e-48ab-8dcb-537681b6eba3", "comment": "Malware payload (AgentTesla)", "value": "c8f042a07d0eea828c1fa43ac03f4519eda473447807d9b3dcd4b9d8f45745a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765352444, "uuid": "f6161421-8824-454b-b616-737eacfc871b", "comment": "Malware payload (AgentTesla)", "value": "18f03d42bdc1b954a517c4e47086a2069f2e4820", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765352444, "uuid": "8e262be0-7598-4e70-bdf4-7e6ca1630f5d", "comment": "Malware payload (AgentTesla)", "value": "a1ba06f3f3eb0ad465d6a8f53b67fb56cf18bb9ae01088a681dd4365c48337cd6187942a2887afaad93ba9f4ecc1d868", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765352444, "uuid": "2d6bb3c6-31fc-4180-8497-f6d76322f02b", "value": "T14945BE0273C1D062FFAB92334B56F6115BBC79660123A62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765352444, "uuid": "91640db3-997d-410a-be37-18fdf357b0ac", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765352444, "uuid": "fcf25c93-09c1-4d7c-99ea-258f8f52a9ad", "value": "24576:P5EmXFtKaL4/oFe5T9yyXYfP1ijXda28XquzxejFQJ8KY+H9:PPVt/LZeJbInQRa2+3z0jFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765352444, "uuid": "b7cd7c8d-353a-4c9c-a948-2e20d35c79fd", "value": 1249280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765352444, "uuid": "d368ce1e-7c03-4851-9c1b-3c616394d658", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765352444, "uuid": "a7d0217b-e03e-47d5-8fe3-429838303da4", "value": "P25SAL0977.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ed6189-d617-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765405535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765405535, "uuid": "1a37780e-9002-4d17-aa99-b9771983aa5c", "comment": "Malware payload", "value": "656f110aff8ebb24d40200bb6070c2ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765405535, "uuid": "37f5fb5c-bbc0-4c62-85d2-87a45b0a8d07", "comment": "Malware payload", "value": "c96e2c1035a72c1bef5ff5887998c54dd5ce758707c261977347107122963d1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765405535, "uuid": "f0dd985b-5ffe-4953-a8a9-8dca84a0dc0c", "comment": "Malware payload", "value": "8710b6f43dd4a32195f2b36805e883d491bfecb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765405535, "uuid": "3154e375-c83f-4f87-91a4-bd236de5d43a", "comment": "Malware payload", "value": "cff944d806c21d13a94296b6fdeb1225004be09daa7cb5dfabc7515c0d7f11568b20412d2f51b9c40c4aa94a690a14a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765405535, "uuid": "31916c83-6b44-4fcb-abfe-4ca63fa462cd", "value": "T1D9F25C48BB98C12FDA5F0E7D64A2066112719A620103DB8A7DCC65EFFFA77408A15FC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765405535, "uuid": "d9d43ea2-4ae8-43cc-84b1-5bfd8db73dd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765405535, "uuid": "1457844c-6dac-4ec7-ba3a-4cb305ba8b61", "value": "768:dmQZqx1lYcJnqnaFFzv1I52K3omDe0XbOfC11kqQm:d0lYov1I513omCMbO/qQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765405535, "uuid": "83b6302f-3c9d-4614-a7ec-1fe125a2bc06", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765405535, "uuid": "7065e595-fd0a-4065-91f8-b9e98d014372", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765405535, "uuid": "d9111e99-a418-4ef3-b204-274877307184", "value": "SecuriteInfo.com.Trojan.DownLoad4.18009.24750.24179", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "208b315a-d5a5-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1765356564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765356564, "uuid": "209d3986-ce1e-4fa3-8c63-cc82321b7c07", "comment": "Malware payload (Formbook)", "value": "6a9f7f3048336a2a808e8cc071bb99ff", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765356564, "uuid": "d25b70ee-7cb5-4465-8513-d00fdfe69044", "comment": "Malware payload (Formbook)", "value": "cb9b29844f69bbb116dca8b6cf826cfa67a37a26026dab16d97360a1f0cce729", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765356564, "uuid": "ad2dafc1-91ff-4538-9eb8-32521cda68ed", "comment": "Malware payload (Formbook)", "value": "67d404754b67977687317b624e1546d5f516623f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765356564, "uuid": "e6518cdc-09b9-4436-8aa7-8d4964e71746", "comment": "Malware payload (Formbook)", "value": "cdfc5ab054899f5aa77542c6625454e1765774cde51e0d798e0a900b851d1622c1ada7f1a103cf1828f05c290ae35929", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765356564, "uuid": "6b1744bf-9c80-4a82-8a53-091da20f948b", "value": "T180B4236677C05167CB8DB64EA0807E01964039E6F2C985DEE5B92176CFBBFA43D1CE40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765356564, "uuid": "c66c360c-74af-42ef-bfe8-494b53709b03", "value": "12288:xeJeIe+d6BSI/RauOoXXk1Qs00YmqB6ctbmmoSwOJiPmOxO7p4Q8EaB:gw1DfXKdYmG6AwWaOtKEaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765356564, "uuid": "a91ff83a-42c8-457e-b7d8-932a9b2d9aa0", "value": 517327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765356564, "uuid": "552f373e-33e1-4312-a336-94ba5c902464", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765356564, "uuid": "a09645c7-0740-4ebb-84fa-1794a2b1e6cc", "value": "Order Specifications 10-12-25.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12324015-d5e7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765384886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765384886, "uuid": "5220f833-3068-4ca3-a031-54b6d648de6e", "comment": "Malware payload", "value": "13829bbb59496db504584f42a1fc30af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765384886, "uuid": "b7f31143-ee04-46c8-a522-d049006298c5", "comment": "Malware payload", "value": "cbe82a601f0206f009448cf3f179160ffe53ebcf9ec503fe688a1fd39133ad1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765384886, "uuid": "855c3b38-b07c-48ab-a1ef-108c98dbdbca", "comment": "Malware payload", "value": "1b7d2ca4ca0fbbdcce58129aef9692866f408e05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765384886, "uuid": "b7a5545e-0957-40fd-9e72-d387b0fe78a9", "comment": "Malware payload", "value": "9d64b2a7b1f1af55c7d9fd11cca9205178cbd9692b1349ac6f2b78a051ae15f99715a595bccd9c77c5a7c85cd7ced0c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765384886, "uuid": "f7963356-2244-429e-ab9b-afb8df7d67bc", "value": "T108658F33B64B6D3EE4EA163AC977B214997F76516912CC2B97F00A4CDF2D0403E2A647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765384886, "uuid": "76b64ec1-8de5-4691-a9e3-78c19f6074c4", "value": "0738a49de222e79a7e681ae8bddce0d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765384886, "uuid": "bdd12654-b557-4492-93d9-372c6e802ae2", "value": "24576:bxBCcTsOV1x92TUJxeN8AerLJVmcl2AjBGbd3nJE359FdTbk:WcT32UAY1VmclVaTKvFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765384886, "uuid": "735a94ab-150c-4ecc-87da-fdf5adffbe7a", "value": 1530880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765384886, "uuid": "3fe5c44e-11d5-4c40-b9c9-a19207563eff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765384886, "uuid": "c9684548-6219-42d8-ab80-b74a86c985d1", "value": "SecuriteInfo.com.Trojan.KillProc2.38114.17304.2290", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0258181d-d598-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350929, "uuid": "33ba1ff2-3bba-4f9f-8acc-3a58a4e14fa2", "comment": "Malware payload (MaksRAT)", "value": "972f796f01a4e0fa0c735afc25183dd6", "object_relation": "md5", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350929, "uuid": "24d8037d-b374-46ec-bdd7-ad852e9ba8a1", "comment": "Malware payload (MaksRAT)", "value": "cc7c5b0337728643efabdeda2c5b1a3a4a97c07d67255ddc1b89890a1c40df76", "object_relation": "sha256", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350929, "uuid": "3199dc88-c62f-4cae-a20e-f221256792cc", "comment": "Malware payload (MaksRAT)", "value": "1698a9056add7c51f2743d4c69ed1b4651c01a42", "object_relation": "sha1", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350929, "uuid": "bfd4f83e-5fce-4f3f-b02a-37976609b182", "comment": "Malware payload (MaksRAT)", "value": "d0de02afa087fcb71163d2c17d86457d0fef2dcb538f29841a0ec8589aaa4786b7e7a25f7e0166f56f47b2624e28276f", "object_relation": "sha3-384", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350929, "uuid": "23fe6311-629c-4c9c-a5f3-086af0710fd6", "value": "T189B2E1A64F946450D577A77ACFA400DBEF9877A001FA413E7B14DC9A07CB94CE06108C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350929, "uuid": "a892e78c-ae82-4f6f-908a-65eaf701fa21", "value": "384:e/rScvFHgmm5g7EoliPRjgFu7P/agzvmwLR+CD3/4V64O1AseeOPt7C+Rl91QyE+:or5HZIFgaPCkXR+EaPO1AsejPmax/Eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350929, "uuid": "25c3b66c-49d1-4ce4-9a89-5b9890992476", "value": 24545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350929, "uuid": "50decc9a-544a-48ea-9ce8-20a9c9d3c5ef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350929, "uuid": "1ff750ce-8508-4226-91e2-052a70c10145", "value": "cc7c5b0337728643efabdeda2c5b1a3a4a97c07d67255ddc1b89890a1c40df76.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a149c61-d56e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765332984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332984, "uuid": "9ffe2e68-d9c9-45fa-b29f-a9db2f650e70", "comment": "Malware payload (Mirai)", "value": "914cf05c5425c9de8434dcfcee481e63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332984, "uuid": "0f4f1fba-0b38-4ea1-998d-2b77eb4a0b9a", "comment": "Malware payload (Mirai)", "value": "ccd050270e02672da2f60cd1dbe2fb313bfb0fa3a6a6c07c88834b750306b021", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332984, "uuid": "a5b15e13-cca4-4c5b-a1a9-739ab73cee5d", "comment": "Malware payload (Mirai)", "value": "f38907ae871ccbe9e8dcf1195cbb1be25d18acca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765332984, "uuid": "c747dd68-6769-45d8-888c-07ae6c7e2c60", "comment": "Malware payload (Mirai)", "value": "493543ea8bcf0ac1ae90672b6e97b7761d6c066e3732d88e4dd3634116cb35c9084e9867bf9d09fa8d71f23a74e468d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765332984, "uuid": "ad4a8d2a-d1c5-4772-a98b-40a688aff85e", "value": "T187D30945FD508F12CAC215BBFB5E428D7B2A1768D2EE72039D256F35378B85B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765332984, "uuid": "90cbf48e-8a53-4f52-9937-1cd467d081f3", "value": "1536:kya6IvvrS5h+iucKR3oLgnx6JZZ7VEvnjEzh/ZDO7XM+XN0Tc4AgBlrQwywVptse:C6grmh+AK3oLg27ZunjEBY9qhAlwFy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765332984, "uuid": "c583100a-fe35-494a-a4f1-3cbd83d95734", "value": 134536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765332984, "uuid": "afbcf763-c717-4568-8546-788b80263dc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765332984, "uuid": "9ad1e0d3-3e4b-4387-9647-387070f12051", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff05649-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350469, "uuid": "905b4b98-8789-4b6d-a041-dc97596feac8", "comment": "Malware payload (MaksRAT)", "value": "c6e07dd172ce084365816d61c26cf978", "object_relation": "md5", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350469, "uuid": "59022939-daf5-43b8-b620-b019bfff070c", "comment": "Malware payload (MaksRAT)", "value": "cd2486375e7dfbf5b9b04f8bd55e44641db29006be2038e18dbae1df4c5cb80b", "object_relation": "sha256", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350469, "uuid": "08c7c0f3-5691-49cf-9ad5-249ffafdad7d", "comment": "Malware payload (MaksRAT)", "value": "ec2c759b3427e6dfd52c32d2240aa79cb22217b8", "object_relation": "sha1", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350469, "uuid": "578a6497-f8e4-47af-bc9f-1aa1adf38777", "comment": "Malware payload (MaksRAT)", "value": "0bdf162ad539c5b740debcf054e1e7f78ad091082b3633431004631c70288f2b50c97e3037d14fc295de577793f92b82", "object_relation": "sha3-384", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350469, "uuid": "15252baf-8cc1-4d91-a411-93cbc64d9339", "value": "T104E2F16CB910BA28E966C83FD4A9914DDA5430FD7E4762934E730C2A175EECD4E738C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350469, "uuid": "e5e08ebb-edcd-41bf-add0-12591eea6b9c", "value": "768:v8y+qz3vhMX/h/TnOPKdQaWRQcSqhPiJySX1Vp1qunkQ4Qg:3/U/h/TTdGRQcSQ6JRX51j7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350469, "uuid": "0b7166b6-8a5b-448a-95ab-5b511d9dc673", "value": 32078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350469, "uuid": "ca18e64c-1286-474b-a559-9205094fd7b6", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350469, "uuid": "27c6cba8-57a5-4cbb-b6b9-1f3e6728ee78", "value": "cd2486375e7dfbf5b9b04f8bd55e44641db29006be2038e18dbae1df4c5cb80b.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0bb93c-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765344985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344985, "uuid": "c5494d99-5dc2-4049-8335-62607b6be813", "comment": "Malware payload (Mirai)", "value": "e96c2ef6014bbd7380d3fb4931d16162", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344985, "uuid": "e0079a04-3732-4b7c-a614-6643924a8a9b", "comment": "Malware payload (Mirai)", "value": "ce1e916232879f2bafbace2e32d2e1ebefbb993507d3914fb26624848ad1cd6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344985, "uuid": "b872f917-023d-499e-8274-8a4038eff4f7", "comment": "Malware payload (Mirai)", "value": "ecaea3fec81b9223bff2df123ef743e9c08e3dbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344985, "uuid": "6c0249d1-451f-420b-a862-f9d53e7a6d12", "comment": "Malware payload (Mirai)", "value": "fd083c24616cd3272bd960f253299337b5d7a96daee2a0c9020d1be9be6f95984753edda191e7641be8034dbf27070fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344985, "uuid": "f8ea5796-e76f-4297-8ae3-f9ebc93d6e00", "value": "T193C35D9BF800DEBDFC0BD67644670E1AB530A79147831B2663577E63BC361A94823EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344985, "uuid": "109e1f95-d72f-42b1-9a6a-ef04f04cb40a", "value": "3072:/8cNV3bnZBsyWwOFYKXsDPc+Ib3wVf0Oq:UcnrsyWZFYKsFQUcOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765344985, "uuid": "e1f079d5-ab79-47df-b271-b5a703961ddc", "value": 121900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765344985, "uuid": "8e734b5d-00a7-468b-b34e-6d9822936ffc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344985, "uuid": "a4dcef87-51c8-47d8-bc56-8a3e7518bacd", "value": "colonna.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75cdc7c-d5bd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765367178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765367178, "uuid": "c3c240ff-33ba-4a85-ae0e-f24811ea88dc", "comment": "Malware payload (Mirai)", "value": "8188130bbd0e8d153ee7b5e72d3a6d6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765367178, "uuid": "371aab97-6cdf-4f44-83d8-465da9e5c786", "comment": "Malware payload (Mirai)", "value": "ce441aad3e0f8d2af1550c75efd6c0a33fe333e383ab75c61127918195c8f693", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765367178, "uuid": "52c7b78e-c0bc-4ec6-94eb-5bca201c0196", "comment": "Malware payload (Mirai)", "value": "903fc70f3405fc0bd41e4323eaf7116125a4d637", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765367178, "uuid": "3c77477e-cb7d-47e5-9ec8-e0f26949eee2", "comment": "Malware payload (Mirai)", "value": "e49919a82a8d131cba9b95e5ec2578f8fcf7babeaaf07cf44faaba95f3d17f41ef1d4d4cc54e9932e53faec12b406dbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765367178, "uuid": "58d9a6a7-b57b-4255-8806-4f371c4e0a54", "value": "T13A344B80F587C1F6DC47483090A7FB3F8B31996AC079C65DEF98AF32DA6B541521A29C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765367178, "uuid": "571dc8b7-8254-431b-967e-97c07877c00f", "value": "6144:BbDrEvq+//mIBgxOt3H09x+UI7EDGpGDJ:hDr2q+//PBcO109cU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765367178, "uuid": "bad8d784-17c4-4ad5-869c-acc16201a57b", "value": 240448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765367178, "uuid": "9db3244f-d39e-4c7b-87e0-a83f2d67b7a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765367178, "uuid": "f14ccc47-a1b5-4646-ae64-14ef9a627074", "value": "ecco.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da08d10-d597-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkCloud)", "timestamp": 1765350546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350546, "uuid": "1f39dd49-fd90-4299-95f3-743398cdf222", "comment": "Malware payload (DarkCloud)", "value": "98ed4b740af2df6a7fc3c9e31146f61e", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350546, "uuid": "f92b78bc-8493-4766-8017-830eec8be6f7", "comment": "Malware payload (DarkCloud)", "value": "ce4d4d835c3ba33955a32e7f7378333d7c65036c93ef8639991b19a248862066", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350546, "uuid": "6cb7eeb7-04e0-4c0a-a7c6-dd9f99107146", "comment": "Malware payload (DarkCloud)", "value": "7998f5b27131af217670d87cf3ec08cc1a9929b3", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350546, "uuid": "dd3141dd-679c-42ab-9a20-ead5c9e5d454", "comment": "Malware payload (DarkCloud)", "value": "545529908a0e8a65352f37705f2943632f7ff7ffddba6da9351c711b6549c8f27e684faa5d1472f19e2b338c78600644", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350546, "uuid": "340635ff-78a8-4c0b-a80f-e9ee73bd1caf", "value": "T1CD515CFECEE425A8E85525B91F87F2714400BDAFA0507041F0ACEBA283113E052A3349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350546, "uuid": "9128c91b-e709-42bc-8300-9dd9e71d60c6", "value": "48:8ERQbmdDwHLzOYZz6h50yFyI7FKZQ2jVRyx65dSC6biirUZ+eOLg:8ERQgD5YV6JI5j2x6zSCGrUZ/Os", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350546, "uuid": "b5ca888d-953a-49b8-bde7-81ce0324de2c", "value": 2583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350546, "uuid": "bbddf881-d4fb-4e8f-8b06-6fc700a0254d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350546, "uuid": "b2686f5d-b76b-43ec-afeb-b537e41d8a93", "value": "SHIPPING DOC.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f3fa1f-d55d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765325629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765325629, "uuid": "c32fb6e4-2c52-4484-90f0-b5cdf9568c8a", "comment": "Malware payload (Mirai)", "value": "92402604fa91c17102b63a022d4ffd8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765325629, "uuid": "b3a5a64c-4e8c-4071-8099-5d6d9a719103", "comment": "Malware payload (Mirai)", "value": "ce71af9413a32ab4b43a8561b91f9f91e8cfa2056cf6b1ff15f4b6259427d473", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765325629, "uuid": "0c909163-3a7f-478b-8477-e5bb9d852aae", "comment": "Malware payload (Mirai)", "value": "2a42263bebbae751acf330fbc44fbf821d606a98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765325629, "uuid": "928ba23b-6050-46cb-b979-6bc754d2c2ca", "comment": "Malware payload (Mirai)", "value": "5c71fd57f1b8c6dce26c6247e42d4d7979e0d0e7b4aa940dd27a89394cfe2ac825da3156b239b06c9955676279d0b9ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765325629, "uuid": "a1ca9ee2-ac38-4485-b0ab-ab9a8a1d2847", "value": "T130A39E25C4B55EE4C4A2193478F8AF392F63A5C093627EF50AF5C6A48453EACF405BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765325629, "uuid": "b96b69c3-efac-4847-8f31-4f1874a1eab8", "value": "1536:eaOb2osD8zf+LU7ZYudVLcWfJKpPzHRIZ94PC7J1VSLx23beoY:edb2os2+4Wwg5pC94Ps24beoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765325629, "uuid": "897e2e3a-4978-4386-9120-114865907171", "value": 103836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765325629, "uuid": "81134ceb-2362-4f58-9932-d0104f352829", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765325629, "uuid": "c677ad5d-58ba-4129-8df0-169b80dc02ca", "value": "colonna.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd33226-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765344986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344986, "uuid": "7804f032-ddf0-4c70-a54d-86233e7bb4c2", "comment": "Malware payload (Mirai)", "value": "5253d53d3cccba87958ae42d2aee7242", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344986, "uuid": "5b8a8326-df0e-4009-b115-0d5aed252d6d", "comment": "Malware payload (Mirai)", "value": "cf5e98cacec3cc116c4cf02a78876eaa66bccdceae51703d3cbd623638587499", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344986, "uuid": "e515632f-f2a7-488d-9ada-16ebf5bf35ce", "comment": "Malware payload (Mirai)", "value": "136fe659fe9749a4ea206bf3dcb3f73f56e4eeba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344986, "uuid": "decb6223-d6e8-480e-aa11-1038bda5cad8", "comment": "Malware payload (Mirai)", "value": "d54c9298ee37451d0cef0e5d868768851da856c350b77e9e50e831412f321e925c5d20517b8dfb020f2e1bdcd78e8345", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344986, "uuid": "2ff19fbd-c4b9-4a1c-a64e-12bdea455818", "value": "T113144B46EA818E13C4D62779FAAF42453322A7A5D3E773069924AFB03F8275F0E37505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344986, "uuid": "2f9cadbb-1a56-416b-b20b-f9f813dc08b1", "value": "6144:HF7O2eXlrtckBRVI7ZhabAglEV2P9Wv1bSt7jkITHmM/9OEmDwm6kMrK:l7O2eXlSkBRqhasglEV2P9Wt+tE+H/1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765344986, "uuid": "0865965e-3abf-4a21-981a-a1611cdb65a0", "value": 208386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765344986, "uuid": "135fe64b-88e9-4e68-a1fa-66f4208448da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344986, "uuid": "4d8d26fc-16e3-4827-afe3-6003645eea05", "value": "colonna.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f8dc3a4-d591-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1765348106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765348106, "uuid": "1a78c449-7017-4930-8e19-10a9a40638cc", "comment": "Malware payload (AsyncRAT)", "value": "93548d0c95baf74c104a6338ea615deb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765348106, "uuid": "863892d9-f999-4e62-9a77-cdfc6416ab0e", "comment": "Malware payload (AsyncRAT)", "value": "d0609ecac184940c000201c8af3cdf5f4b6bdc6fbab9b5c33ed91495323c9982", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765348106, "uuid": "42dab922-fa48-4474-8463-0708ed4e43be", "comment": "Malware payload (AsyncRAT)", "value": "97c20a3542704b6601492c61f4677d3d67abcb23", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765348106, "uuid": "8a9bad13-5510-49a6-ac8a-a11d6bde98b8", "comment": "Malware payload (AsyncRAT)", "value": "f40c7081853afaeeecac17753055466434fe4444f01f673afee9013d1d1bb7169d2ca75db734a062216bf71624760093", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765348106, "uuid": "8be79a9f-4a7c-4b5e-81eb-f50ee54f1c8b", "value": "T112535C002798C925E2AD8AB8BDB2950146B5D5732102DA5EBCC414DB6B9FFC60A137FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765348106, "uuid": "82275c5c-79c0-4910-90af-c0a64a8aad5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765348106, "uuid": "bd61de08-d399-44f0-baa5-b4669ffbc27b", "value": "1536:TThq619kneNUUX5yh94Gbb0wdLfu6GKrVclN:Tg619kneNUUX5yoGbb0QTushY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765348106, "uuid": "b4da2eeb-7527-41d6-a0be-bab4119499d1", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765348106, "uuid": "f2ab3ed4-8bba-4b79-aaba-15917df140a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765348106, "uuid": "7b783327-bb3d-45a9-aa6c-c4a6b465dd5c", "value": "chrome_updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "585d64d9-d620-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765409485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409485, "uuid": "0a2e5e57-859a-41e1-aa00-a07025ae9060", "comment": "Malware payload (Mirai)", "value": "cccb7296346d7bfc2a8bd76a40febe68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409485, "uuid": "a576d4db-8613-4b3e-92dc-563443e4c327", "comment": "Malware payload (Mirai)", "value": "d0e178ed6c9aa89d8e79d50a0313ea8db54cad186337973a3bc840e895f4abab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409485, "uuid": "c432ebba-98e1-4f95-b358-fa659611d591", "comment": "Malware payload (Mirai)", "value": "5e9337473ad8c26c29dbf95c0237651ef2dae10f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409485, "uuid": "a8b7bec7-ffcb-47fd-b374-9fc57eba65a0", "comment": "Malware payload (Mirai)", "value": "99fc8f45c3ca36c51206255d72a4370cddf22453ece10f34ef7fb35c224e9435533fc267fd4562caca1c776291acda06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765409485, "uuid": "6d08dbbf-d3e0-4b6f-8811-d4c574122e38", "value": "T105433BC5B503D8F9DC2905752D72F3326B36E575113AF9C3DBA5EA32B812A01A90B2DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765409485, "uuid": "19f8f8eb-935e-4325-a967-cae256a344b4", "value": "1536:D+rSh8iKookyUDUEJt2ieKzICHHoNK+m3BJ/lKXqLoaQRD:D+r+7KooLUDUE2ieAHHoNK+mfdckob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765409485, "uuid": "d670eb82-3f1c-48fd-b044-bb3456d6b069", "value": 60244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765409485, "uuid": "04618b80-636a-42f8-bc37-2a0af96553e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765409485, "uuid": "c4ba0038-fbb6-4cb4-892e-7033a81aad4c", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afe1caa-d5c5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765370432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765370432, "uuid": "9d5f1157-edc2-4fac-ba77-d65883f361c9", "comment": "Malware payload (Mirai)", "value": "2b7d877c01fb8f70f39ffc1021788672", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765370432, "uuid": "36cb96c5-81cc-483e-a206-36c7fa215dd5", "comment": "Malware payload (Mirai)", "value": "d17b591889069d9cd3bf82ab91ef30b931a7bf1f56abd7ec5c96f9219864acb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765370432, "uuid": "5e2f20d6-bcbe-4728-83a3-6f5de12418f5", "comment": "Malware payload (Mirai)", "value": "49588de7f841f030c7565d8d838822d54030ba0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765370432, "uuid": "e976bbc8-a9f7-4471-a6fe-ffff76f044d4", "comment": "Malware payload (Mirai)", "value": "175028443d53d69f8013d3b12ec82d7fc7e58466b65ea78cd52c636bd08a8f1a60d12993f56a13607d05646dca00b2f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765370432, "uuid": "39f29507-9805-4007-b963-c2a51f17f48c", "value": "T13493122653519DF4E0B17CBAD86007C0773B68D89768909256EBABAEDCB535334BF043", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765370432, "uuid": "05971016-cdc3-41c5-831d-237ee7db7898", "value": "1536:9VI5gHqP1A7jAMioqD37nTqiYlp4Bp5BgWM0+VwphG5yx2d6ZuD2wODwOYTNQ7II:XkPkAMi77TtLp5BgA+Vwpu02yuD/fTCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765370432, "uuid": "4ff7eae6-7122-41ef-a2f5-2efef25b017c", "value": 92728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765370432, "uuid": "821174c7-5346-46db-ab54-3f07b9a594ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765370432, "uuid": "5d4bbd9a-feff-42aa-9c0c-3a2433e2429a", "value": "ecco.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c7886e-d58e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765346743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765346743, "uuid": "34b7367b-2daa-4276-a464-53a8c55cac9b", "comment": "Malware payload (Mirai)", "value": "41963febe3f5930f3602f94df1387341", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765346743, "uuid": "690a7665-6f54-4115-bd26-82c8b2802999", "comment": "Malware payload (Mirai)", "value": "d207aae6f16a2f6b81b08f752b306c347e83354d547f7292ab1f6a3f16bcaeb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765346743, "uuid": "c463e230-b271-492f-808e-16aaa1128412", "comment": "Malware payload (Mirai)", "value": "88d29479fef92eff4de548c4c70b65787cd03913", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765346743, "uuid": "9508ea45-f32e-43d2-bb7f-66a977016272", "comment": "Malware payload (Mirai)", "value": "bf8fcda096a7a3d898c947b6f6310ae72ecf0f55c81456ddc9f306b44d8355128423f1c20d5011d0a8631aa7f6ca4333", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765346743, "uuid": "4ea805e4-eff7-4628-a70b-00a9892f49f1", "value": "T147C35B227A761E27C4D0753A21F74725F2F257CA22A8D61E7E710E8FAF247502513AF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765346743, "uuid": "35a26dcb-f303-4f0b-82cc-b1d2027dac6a", "value": "1536:P1wrLxBYbT8SekZSPF0YlRhb0gKo3bR8zWK3iG/sErK7u+AX593jCxbHFtntN7hs:9whxd0g93V8iKFrChAp9+FX7hs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765346743, "uuid": "a10df428-d238-4516-940a-cf80b4fbede2", "value": 119636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765346743, "uuid": "0d2feaa8-05ea-44a1-bb2d-5da223b5db3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765346743, "uuid": "823b1501-487b-4a7e-bd1f-a8969350a033", "value": "colonna.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2daa8d6-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350474, "uuid": "deb70b3b-bde0-48fc-95a4-bd8ef5bb08d4", "comment": "Malware payload (MaksRAT)", "value": "ccae5cfaae865af53f6568d983fa4fa9", "object_relation": "md5", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350474, "uuid": "01a28029-b34d-473d-9f1c-8d40c84fa47c", "comment": "Malware payload (MaksRAT)", "value": "d28829b9a8f01db7908fdaf815e266e1a532cc5115d82c5eb328a4c4a3622867", "object_relation": "sha256", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350474, "uuid": "b3702409-43a3-48d3-a688-5914d0d7c6d7", "comment": "Malware payload (MaksRAT)", "value": "8d7242eb257b0f2551a9765bb826a5d28b2e63f4", "object_relation": "sha1", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350474, "uuid": "45a55f40-1a5b-4a50-b4d3-606a9bb10799", "comment": "Malware payload (MaksRAT)", "value": "d88c223df99378a02afb30198c7b56d24912047f1f7cf9f48bcb606fc0b9582b582a98c58a33b32a42d3fa86de5c3206", "object_relation": "sha3-384", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350474, "uuid": "e8f9070a-0877-4f07-8b88-c64ba7d87572", "value": "T173E2F1DE970FEED1D023D8355902E36FAC15A12CEF58782608D51BC96E9881C0F69DCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350474, "uuid": "2e91ae7e-d145-47a2-8b36-e8ea25fc1c9e", "value": "384:Ch6VgQEYGx9yaFals/AtRNiDbB+cS+6Ud9mY3CJwi4KjmmCdRLxzsCLgXXw+pYny:Ch6yfYlGaviUEdyyzuELGCUQi7HjbAd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350474, "uuid": "08810e42-a808-4e61-a396-634d5ac54aa5", "value": 33233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350474, "uuid": "ba0390b8-7cb1-4abd-b32d-2daba6d94829", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350474, "uuid": "908706ce-a61f-4796-b8ec-25146925dec7", "value": "d28829b9a8f01db7908fdaf815e266e1a532cc5115d82c5eb328a4c4a3622867.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b968cce3-d5dd-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765380872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380872, "uuid": "8ad4b9b5-30ec-4647-97ef-4e2e74e0171e", "comment": "Malware payload", "value": "ff1a30ba8681f816f626ffb8fce1038f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380872, "uuid": "b9056753-f4fe-4f61-bc62-b7cab6dea70d", "comment": "Malware payload", "value": "d2f763f758d1adca69bbc83dacb45ad50ccf57078e421916fdf3996e4d2ccfed", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380872, "uuid": "96ddcb15-b647-40dd-88db-d753c038427c", "comment": "Malware payload", "value": "5ce689d022f838611b5e535c1b0023340e9cf198", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380872, "uuid": "40a0c8d8-7675-4869-b498-e1156de2b2a5", "comment": "Malware payload", "value": "15997e84d2a641b9b8d7da3a1b641698d771e35d6e09afb8c5f89d9ac88ea41aacad2f3d88bb1d722406857e39166697", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380872, "uuid": "0756a52f-47f9-43f1-ad32-510ef5bdfe7c", "value": "T15ED165257C09A870120D8DB598BE3C64B516A28FC2419C4DB93E45F80F767A8FDBE49E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380872, "uuid": "172b32bd-90f3-487c-b160-502f301b510d", "value": "96:hErJBcVJhWd0hJRkEm+f4MgNJ6Kakm3A1+tR7uzfqpTtyAgv:OzsJXhp5cAqHy9yW5jgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765380872, "uuid": "09ca9c42-009d-4b3e-81d8-2b91d92ac8dc", "value": 6771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765380872, "uuid": "7acee280-ae1f-4085-8447-42fed1860ab0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380872, "uuid": "8f31c71c-cb99-459f-8876-b76a184a2fb8", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc7d9fb1-d60b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765400741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765400741, "uuid": "ae852a27-5551-436e-99c9-ce6b6636ed22", "comment": "Malware payload", "value": "b3b78fd663390a923f970110ad5b1b9b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "crackingcity-com", "colour": "#4352FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765400741, "uuid": "1dc5228c-6d69-497f-9d9d-2d24a83328b7", "comment": "Malware payload", "value": "d309712d8d5fd6ead0801faa17df6b388e4a2dcd29db2e1ad6addcdfd6321439", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "crackingcity-com", "colour": "#4352FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765400741, "uuid": "a3c1ad01-8b00-4983-9f3d-780c288e12b5", "comment": "Malware payload", "value": "8b261c71e04be6bf62606fa1879a9edb7837bb01", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "crackingcity-com", "colour": "#4352FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765400741, "uuid": "cd12ddb2-a9e1-4a1b-928b-62ad414e6eae", "comment": "Malware payload", "value": "a2b316ecafa919ad7496dbe148514a5e8f8d0d8bec0cdfbc2befd4bdf56394e157954d9e737b30ff776e3cc9c2c23bd4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "crackingcity-com", "colour": "#4352FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765400741, "uuid": "6adb124f-56a5-4c09-8eb1-3380e07bac59", "value": "T1F466B02E4F81CBA0D46CFE325C75D035DA64A8C8A8777A16F474B6B5316DAC60C831BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765400741, "uuid": "6240c820-c525-4c5f-9b2d-22a8b2c3de83", "value": "c4b8b0aba9f9c876ca624bdbda64d516", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765400741, "uuid": "7c278e6c-69bf-4147-bc34-6f08e671e13f", "value": "98304:9qFHL7il2MTCt3osPUYiYZAnLOdn3lr9CQdes5MsNI5mUz3eg6UfXqKigQhHAbtl:9qFr8/m3oVsvF5lMsNEA3/Pg6J8Xdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765400741, "uuid": "df81ba95-e5aa-4321-bd63-03bacfd31f7f", "value": 7070976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765400741, "uuid": "2ea1844a-00e4-46f4-a7d7-697dca45d1cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765400741, "uuid": "1f0ceb1d-46ec-4688-a449-1993d20e9ef2", "value": "IDM 6.42.57 Patch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f3fc6e-d5b6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765363960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363960, "uuid": "1aa75781-3b11-4415-8cd2-8cc8efbd9486", "comment": "Malware payload", "value": "e9975e39b87a0369dba21dcc7a4dcd56", "object_relation": "md5", "Tag": [ { "name": "ShadyPanda", "colour": "#D1067D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363960, "uuid": "2d338c9e-66f2-49a6-bb75-1c063cb23cd4", "comment": "Malware payload", "value": "d367f44eb907de54298314fa3e6b7c31cd04c04e070d5248ba63b9628e97900c", "object_relation": "sha256", "Tag": [ { "name": "ShadyPanda", "colour": "#D1067D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363960, "uuid": "44d6a9e2-bbc0-4bbd-8256-8534917679eb", "comment": "Malware payload", "value": "49d45be4391df6c8fd06a3bad06c9a4530b5fb54", "object_relation": "sha1", "Tag": [ { "name": "ShadyPanda", "colour": "#D1067D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363960, "uuid": "a10b23b2-0bf4-4c0d-9687-dd693db54667", "comment": "Malware payload", "value": "80339134be4eecf8dc50d91d68daf260fa32ce6a657471a1fca0cbcfa25dd2ac76bd62f126482ac4d59c2519c7eb9fce", "object_relation": "sha3-384", "Tag": [ { "name": "ShadyPanda", "colour": "#D1067D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363960, "uuid": "5cacc829-3ed5-446b-abd7-0bd9dfa8a434", "value": "T1A83633A75611CD87DC936BB3B4C18DBF3518A374222EB78889746D839FC5BAD37900A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363960, "uuid": "13648151-b71c-4041-949e-11fb791053f5", "value": "98304:J+R9PWzQuLNhd1/azrw7LFxBE319zO2BqVhM8TQguUmr84:gL+8E/aI7LFjEl1Onc8T1ux1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765363960, "uuid": "eda6f958-3285-48cd-9ad0-be4735d5ff43", "value": 5110722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765363960, "uuid": "9e04534b-6058-47d2-8953-cf207c1d9190", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363960, "uuid": "fcb733a1-f1ac-42dd-a38b-9e121fbba191", "value": "ibmgdfenfldppaodbahpgcoebmmkdbac.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68aa485-d5ec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765387363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387363, "uuid": "3b74f5c4-df87-4e2b-8800-adcbc77d7780", "comment": "Malware payload", "value": "d7d1e784d43d909eb4084fa6402f7a18", "object_relation": "md5", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387363, "uuid": "92894c0a-f9f8-4110-baeb-50f7c571cec0", "comment": "Malware payload", "value": "d36d3d941dfdd327600429dd566b576d9934ca30ee2caf5cbacaf2113cfb3048", "object_relation": "sha256", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387363, "uuid": "cea9c9b6-a981-462b-9865-282637ac5b4a", "comment": "Malware payload", "value": "d5a9e26d8b08a431bfd0225dc6189b3773499d9e", "object_relation": "sha1", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387363, "uuid": "83fea773-21c6-4932-b6f8-36ff7fb60dd5", "comment": "Malware payload", "value": "39a091ae8f82fdf34933370dbd423c587d41d465307326dd565c10f08c4d80b8f29923c7a89ec59b5effbc7c5f8b3a58", "object_relation": "sha3-384", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387363, "uuid": "51dceb16-475b-46a2-b00f-ed9ec75d00b9", "value": "T135553346C17C28C44F7D0A677BBF995C62298EFC10021863AF569CD7293F38B86745AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387363, "uuid": "727bd7ba-8833-44bf-b5e6-e57bd90a80ff", "value": "24576:bcjASGYdsxQ3roZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRV:4jAedLoZ9bq+MmMEL+hcjXHC/wnwdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765387363, "uuid": "c4218b9a-5921-4a8c-b974-e0e60e82cd96", "value": 1395076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765387363, "uuid": "b77865ee-f12a-4c38-8d31-d13d3e1df3a6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387363, "uuid": "56771091-5b23-4bca-8a2c-b463cff4cc5e", "value": "hwid-changer_1.4-alpha.1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6133ff0c-d5b6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765363974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363974, "uuid": "2eaa3bbb-0812-4329-816f-4db3c2d8e407", "comment": "Malware payload", "value": "b4a828b6ea8f0faaf9a2cdbc5b7a8241", "object_relation": "md5", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "ShadyPanda", "colour": "#D1067D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363974, "uuid": "b3cffa7b-690e-4728-bffb-18d69b258f82", "comment": "Malware payload", "value": "d371b9bc3af2d0314706a9f395b87661e572d5d4ccbf95a53465374818e5f7e6", "object_relation": "sha256", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "ShadyPanda", "colour": "#D1067D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363974, "uuid": "965e7b17-eac6-43e5-bb6d-19c335db8509", "comment": "Malware payload", "value": "b310ad6bef83357e5135cc8c2b29ef813ccb39ae", "object_relation": "sha1", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "ShadyPanda", "colour": "#D1067D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363974, "uuid": "401b964f-39c0-479b-8c31-b21fb1283e1a", "comment": "Malware payload", "value": "e77778101ad29600d667d42ebc0cf319ef2d1c77f8f9e6a6e989b2396a3cebb72141671093834d7808e6308df1344bf0", "object_relation": "sha3-384", "Tag": [ { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "ShadyPanda", "colour": "#D1067D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363974, "uuid": "8ffb1cfc-c2ac-4192-8fd4-9a191959af82", "value": "T1D48412682EDE6953C81B71F069D9F143E00EDB5E0A8B7E5F314A64661431B2D8732CFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363974, "uuid": "8c9e22da-88d4-42c8-a7b9-06da71309df1", "value": "12288:epWQ5OjPqg8jMOqnhW3lRXTL4R+5o3U/untmE2Bk3O7DssO7lhMQ:edO7q5bqhW3nW+w4YcEamw1or", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765363974, "uuid": "aa4f6cf0-b50f-46d8-814e-7300160ee3fc", "value": 406058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765363974, "uuid": "164de6fc-3e56-4adc-a54a-10cf4caedacb", "value": "application/x-chrome-extension", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363974, "uuid": "2910806c-1732-4812-9ed4-2f68ed5f0a55", "value": "eagiakjmjnblliacokhcalebgnhellfi.crx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681ca9c4-d605-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765397915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397915, "uuid": "fcfc5e92-7e68-4e84-8af3-c5a514970d28", "comment": "Malware payload (Mirai)", "value": "bf64167c31dec49fc1edca460edb55d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397915, "uuid": "5aaa1d79-9296-4d95-8718-a7b042fcb348", "comment": "Malware payload (Mirai)", "value": "d3e66628e921e3740a78c8112484767e0450d6b5581a526a5a08a4b00f122b11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397915, "uuid": "3d6973fa-b087-4243-9eb4-c955fa8486f0", "comment": "Malware payload (Mirai)", "value": "1dec9d5748f504ba443a2e61deae97cdd188625c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397915, "uuid": "360bde3e-eb25-45d5-9a35-cd4f91192854", "comment": "Malware payload (Mirai)", "value": "9daf0fd16e032a582a7fb19d9a01fe331de178e743d7474630bf475cb8d997819c7720e7c29e769a3bfc3f25dc6189a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397915, "uuid": "f616ca67-5622-4b5c-be56-d938e96c434e", "value": "T15AC3AE87FB8B14A1C8120AF013C71F9D6B576211CE6FE8E3AC1D763B5A7A4DB1516381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397915, "uuid": "52311500-1d3c-479d-bd8f-41e5f4c11008", "value": "1536:dbM2odTUKXzqJrZb+zeWVrGZ2TuLi35m+0lD/W7MYkxP/lg0iEC/LWx:dgdwKDqJr4zeWVSZcY6A+0I7MY4g9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397915, "uuid": "589d6fa4-0334-4c45-9d71-b9a492597a54", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397915, "uuid": "4a3c1cee-b0e8-4263-a746-2a833a19ce49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397915, "uuid": "58c3eea7-ebfc-4d7b-a9f1-65ce1c8c2f99", "value": "Labelloperc80.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71867d8-d623-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765411013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411013, "uuid": "d6a8e648-6e78-45e4-a1fd-fb32359f6c6a", "comment": "Malware payload", "value": "40ea03865f56b613f8e8d5acb6b36641", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411013, "uuid": "1ad5051e-c21b-43ce-8591-03660ccbf8b8", "comment": "Malware payload", "value": "d414a840df9701ed5446a7411c01553d8fc08bd1ce1c435d6d9a7de0a9073556", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411013, "uuid": "498fe760-292e-40a6-bdad-c62fce09eb39", "comment": "Malware payload", "value": "2b89529e183d2a1a010949ab736754cd77545f31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411013, "uuid": "b3eb513c-c927-4ae9-a68a-0deaf14992c4", "comment": "Malware payload", "value": "6dcbb7b42d876fd9746d82dd4b4bf3384fd7d7ce231a5a97a4d72ec208e439826eab1262af8b00a33c192c60d3d859ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411013, "uuid": "a5ed1965-503b-47e3-b1af-c193ef2ab395", "value": "T152A3B53B77271E63C0CA547101EB1331ABA9DE4438B94BD7A9917DA83F36E8434493DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411013, "uuid": "913cc522-1125-48ba-9f50-ced86f308233", "value": "1536:Koum5DGG2vUSo95cHptZ/dtUeYgogjzUI8:1DTSoPI7oRgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765411013, "uuid": "507dbb80-3b61-4609-8811-9c83361d7cf5", "value": 102978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765411013, "uuid": "26fc393b-f6bf-43f1-8ca9-0b10f76a9ed8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411013, "uuid": "dd948619-7d8a-4f7c-8148-c4cb354ae9c7", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c3ff33a-d5a0-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1765354516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354516, "uuid": "959f047f-9228-41c7-9717-55097be09a69", "comment": "Malware payload (PhantomStealer)", "value": "0e649442b996fda87f793ba9ae2b9ebc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354516, "uuid": "cb181884-9609-4a27-99c9-64cff97d2dec", "comment": "Malware payload (PhantomStealer)", "value": "d42b4e0a968df2f299da9a2fef8e5cee57bf64ca15095b4591b03333ffb21000", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354516, "uuid": "851337cd-aad3-44fd-83f5-09d9e0994ff3", "comment": "Malware payload (PhantomStealer)", "value": "cab6171e62483fb9c37fcfa24b1aed56b9efab68", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354516, "uuid": "b6e0a3f0-f8ec-4720-94ef-dbe0009b3caf", "comment": "Malware payload (PhantomStealer)", "value": "0d7d842ed62aa9cd551021a45f7a31afef00b45d1d503eb3b475608eceeeed53c1ed2adbf9a5a890cddeca5fa12ec3fd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354516, "uuid": "fc0e012b-da8c-4bc5-b138-0d315d841ce5", "value": "T165D44A20DD2416B94F071BA9FD541E61CAFC960A552A90F1F6DE070E61029FCE3FE6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354516, "uuid": "629b3bff-930d-4afe-82ee-42a3470a4c5d", "value": "12288:sKHKgKlJ2jQKlJ3KlJg+IuKlJg+5KlJg+I8KlJg+IzKVKlJg+IrKlJiKlJg+I2KX:sKHKgKlwMKlJKlxIuKlx5KlxI8KlxIz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765354516, "uuid": "87467a56-321b-46ac-a0cb-cb76e224792c", "value": 599065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765354516, "uuid": "20b50c84-8a10-4ccb-b302-d1849a7ada9a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354516, "uuid": "18057179-58ef-4fa0-94af-76ffefad1bab", "value": "PRICE REQUEST N\u00ba LC251311-48SG97 _ Helvyk-Elevators.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ad3760-d5f6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765391331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391331, "uuid": "bff44a1f-0af9-4734-af52-8b0513ee208c", "comment": "Malware payload", "value": "1b05c72dc0b51beb2291bb8c047e3bda", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391331, "uuid": "1b0cae12-8e75-4da0-befe-be6e299684e3", "comment": "Malware payload", "value": "d42d171f0f71e29858f53ba0a9af3e701d81951d42b19faac4bacee9b193dac7", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391331, "uuid": "41438360-7534-48b9-b30b-a0b4c711bf7a", "comment": "Malware payload", "value": "21a57f1710eae6f81e3019085a6939821207e42d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391331, "uuid": "6f8681ca-6d0d-4560-906d-3da478afac04", "comment": "Malware payload", "value": "46838c5c96a4662a8cf78e2cb43bbe3d86da39a28842d06a4d4933f8ac46a088c56531c39a0b444f7969971f73bb3d16", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765391331, "uuid": "2b79f427-b92b-463e-8e21-9cb1520b54f3", "value": "T13C01F4180FA9C4B9C7AA8D0184FBBF967DC0E608021D33742CAF950CA244E3AC8779F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765391331, "uuid": "173c8797-381d-4990-8bda-ce7e29e7fa01", "value": "12:rR1VX6piyGSKTtgu5MdoQF5b+Vzn9uG/mIFX0FVYTYlz7Aw:rR196oyjIMZb+VznRmIqFVYG7Aw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765391331, "uuid": "5e530c3e-88f9-4457-9035-92d889cc003d", "value": 709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765391331, "uuid": "6c016076-2a51-4a83-9f61-676eaa52bfb8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765391331, "uuid": "93f5506d-5102-4723-a6cb-4f08423d198b", "value": "00178421_239465.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1f28f0-d594-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765349253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765349253, "uuid": "b6ce7fd3-42e1-4a05-86ea-ba8e08ec0de1", "comment": "Malware payload", "value": "ad39985de94a630b8eaac76687cb428d", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765349253, "uuid": "2000db0a-e5dd-422b-82a1-3f4403aeca30", "comment": "Malware payload", "value": "d44e033e53c68e502fc920e0a252f1fed830f0903004be5ee92fee3a41eb4996", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765349253, "uuid": "a381031c-3c0e-420c-9b9d-82ff1e9362e1", "comment": "Malware payload", "value": "9cd706ccaca5cab767068cfc66103807da73ff0e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765349253, "uuid": "71200bb8-f6ea-4e60-81c6-668dbb27fe40", "comment": "Malware payload", "value": "3016a4efd37060c2ff97f3a1c4f31c2edc1b457f30bc2709adfd9c0cbfea2f223b6592c1a3916206004f6243ce371347", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765349253, "uuid": "aff39cc7-0fa1-4897-8562-ce7490620938", "value": "T11A353375664EC8EBF438A89F338F0A571FAF1C79CCB631D2D19448295A23184EF7154A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765349253, "uuid": "a16cf4d6-da29-4450-ac0a-ea386089e2ae", "value": "24576:BSzXLQYDiN+JThDTD1GPBEGYow5C2OLGIhpLzM:o8MzxHel2OLGCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765349253, "uuid": "117a5c73-0556-46ce-8dbf-451eb99508e9", "value": 1090552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765349253, "uuid": "eecdc793-e5c8-4828-9b17-8b93612ae01c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765349253, "uuid": "01ac536a-144b-4ec8-b132-e99175addf43", "value": "cupid.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee6f42a-d597-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765350924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350924, "uuid": "5620c7f5-f47a-4c3e-b982-1976093dc7ce", "comment": "Malware payload", "value": "0be3ade9bbde39c0c456bd5bbc6f48a5", "object_relation": "md5", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350924, "uuid": "0a349960-f930-491b-aa16-2551815d9e08", "comment": "Malware payload", "value": "d4e270f6e9ca5934b568a0fe2fc48ef28787d82ed94625d88e25fb513b7672c5", "object_relation": "sha256", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350924, "uuid": "1ffe8099-2414-4365-b75d-bf9d3ff09138", "comment": "Malware payload", "value": "178b47c0ee334bc344ec97883ea6d8cf097c90e0", "object_relation": "sha1", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350924, "uuid": "ec065928-c2b5-468a-a6ec-4946f2b3e3a0", "comment": "Malware payload", "value": "723f0aef8ea8f71bed9e53460026ab64a1c5f9948f8a7ec9585157420c585820dae34d2fbaaa266a9e36854330d740e0", "object_relation": "sha3-384", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350924, "uuid": "03d95c95-ad33-4a9e-881c-ea7b6dfe11fb", "value": "T102E2F17D29EA70D5F936DB7680A745D04771A4AAD086AF27C02297C28CE03EC079F446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350924, "uuid": "adaa16cf-ffd6-4906-861b-711f8412d031", "value": "768:IlRMGhmTj9KD+U/EcKEfRhvWp8CeL0hGfYeVusSQYtAGS:IlPwKDb/EsnvWyCiUGweVuHhty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350924, "uuid": "a08e25d3-b69d-4b3c-a1fa-665d9389fca1", "value": 33938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350924, "uuid": "5a1f9c80-0634-4be7-95d7-bcdb19cc532b", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350924, "uuid": "6da4d9ef-2133-4911-8567-048a872d16f1", "value": "d4e270f6e9ca5934b568a0fe2fc48ef28787d82ed94625d88e25fb513b7672c5.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc34e80-d5c6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765371078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371078, "uuid": "917d7fa7-44aa-4b5e-958a-78c4cf0730ac", "comment": "Malware payload", "value": "b7c028f705cf5019e6a0c4da16f5bbc8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371078, "uuid": "ed145647-4dae-43b9-a3ed-837535ce16ae", "comment": "Malware payload", "value": "d611362ce8941f294ddbc94bacfe19c185a09b7bf94b782df063f8f4cc17133c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371078, "uuid": "08b43b22-842f-49ce-a7f9-d7d92b184b1d", "comment": "Malware payload", "value": "36c7c71ed47e8eeb42ea4cc6afa43f23696f93fe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371078, "uuid": "1e326695-57b1-4e5e-95c2-bcf9db4ba194", "comment": "Malware payload", "value": "5b7a64b42bc87183efd49887c4aad50288cd0abb4c3ddf74f4138537a92cc7dc382261ae57fafb0f32489b53823a9ec4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371078, "uuid": "9c61c7ec-eca9-42d2-a08a-7c0835220eda", "value": "T17606020E735C2670F5A36639DD175E815139717AAA82202775082DF9CF2C33C9F52D79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371078, "uuid": "35d03823-be0a-48ea-b0e3-fb64d0afd396", "value": "192:Snnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnx:uxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765371078, "uuid": "3419d470-b3be-4440-846d-055ec4c366c6", "value": 3913392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765371078, "uuid": "be344cb7-f68b-4194-a332-a342dfec403a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371078, "uuid": "ddd8b755-d8f3-4002-a981-002d36c05655", "value": "Enquiry-Dubai.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f798946-d598-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765351113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351113, "uuid": "e6a84b1d-d901-4efb-a344-c6e27f305106", "comment": "Malware payload", "value": "12fa13f399db8bdd530419021af842ee", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351113, "uuid": "642a8be1-6c58-4b4d-83e8-1a42576edf62", "comment": "Malware payload", "value": "d763fee14ccb36c0d1cd5355dfb10b26466c6be5f10fe70dc7ee3d90bf70318a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351113, "uuid": "a2557b7c-b5ef-4329-b53a-0edbc87f3cee", "comment": "Malware payload", "value": "dd4ea96c9405c171e35143f0a3c8c3a60b1cb3d7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765351113, "uuid": "099e3e36-9c77-473e-8366-e468e102543e", "comment": "Malware payload", "value": "8d77b66eed2305684331d72a5986212dda1636336fc2b0922cdac84b8c8d73ba9d702e90f3ebea2aa3b5015b6fab77ba", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351113, "uuid": "616244a7-a8d3-4a86-8745-3182960a60f0", "value": "T151A51241F78E89A1ED3EEDE27C6EC0D8D782E2247A0B2F8D3C5250DD7A3418A091D9D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351113, "uuid": "46bfd619-13bf-4717-99b8-f4490e82e1a6", "value": "24:oUoCIJFlMzhBCJURJcgT/xLczKTBpyyhyhyhyhyhyhyhyhyhyhyhyhyhyhyhyhyn:iU08BTBAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765351113, "uuid": "90545b4b-252c-47f0-bdb4-2926e80b5039", "value": 2167962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765351113, "uuid": "a6138ba2-8fe5-470c-937f-a98813a0cace", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765351113, "uuid": "7762d6b0-9c3a-42f8-b214-4282e42d5843", "value": "1247-60720-ARMAN.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974ddf0e-d591-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765348173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765348173, "uuid": "528e22cc-2f8f-4196-b61d-792ef6548979", "comment": "Malware payload", "value": "4ad3608638999fe1a603a37ad86dd3c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765348173, "uuid": "c6f56693-e411-4067-be3c-f57ab0768596", "comment": "Malware payload", "value": "d77643273b1afd22432034f1b8cc88cf3cf7fec3d69ceea689a5001b75c28d9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765348173, "uuid": "a2691a8c-2119-4194-9b53-0aade15b61ea", "comment": "Malware payload", "value": "bfeddba7ac8a7727d7a50c9fe8f8bc0174a709bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765348173, "uuid": "0c2c6f97-8285-45bb-9ba2-1a03bdd491b5", "comment": "Malware payload", "value": "6b45c93cae6650f4a4804d0f8be473bed242b64653d79d75e86439619a1a0fd74b0bf2595f66ba1401c5f4e47bce489c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765348173, "uuid": "d1b451c9-63b3-4dac-b539-e4d085bbe6fb", "value": "T10C073346059B66B7F237C0BB667DAAF8391CDB33C9DB8084661CCC031CFAAB096D4951", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765348173, "uuid": "ccd05f95-a9fa-4220-8855-7995e9f72054", "value": "cdca197527f2c7f7fd5951a6c7a91568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765348173, "uuid": "b19bb1ef-c643-4238-ac14-4bd66c8bdc43", "value": "393216:oYVQ+pgkwVqkGbr+MeWmt2wp01F4MjnLanKoz4S0va037Ge:oofyDw+MeW1F4KtS0vv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765348173, "uuid": "a849b590-3d03-4a43-8466-cb6060b75d95", "value": 18414080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765348173, "uuid": "38c23bd6-2992-4168-a2ed-110d1d0cbd6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765348173, "uuid": "22478d39-67d5-4317-bd59-7deed5eb1045", "value": "12025521.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01979df-d60e-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1765401955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765401955, "uuid": "394ff4d6-c428-4376-833e-a117f54d624e", "comment": "Malware payload (GoToResolve)", "value": "c13fcc7711feedbb655d301f7e22ee36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765401955, "uuid": "6ae04b5e-e4a7-45ed-ab3a-5b5a0f4d30bb", "comment": "Malware payload (GoToResolve)", "value": "d78a33016cd68b836958bd19ae5651afdd1df61a9765b62161f6e3ad9423be3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765401955, "uuid": "0cf50b10-c154-464e-a2b7-1807365895bf", "comment": "Malware payload (GoToResolve)", "value": "2c6bb25571b5e5ba353ad169ff3efe2cceadd2b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765401955, "uuid": "6932518c-77d7-4c05-8f3b-f64c7e55edcc", "comment": "Malware payload (GoToResolve)", "value": "2bf9b21785ed091ccbf8f4a3702d6625b28a6cbd06514c4646b3a36ecb425d714f27c05594b242890e04db0a8cf387f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765401955, "uuid": "02638cc5-8d86-4c36-ba85-cba75547a71f", "value": "T1E637333132568471CC5211F1E929AFBBD66D6D248BB218D7B3EC5F2997601C33B32A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765401955, "uuid": "012e0ca9-5980-4cdd-a12b-8aa10228bb81", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765401955, "uuid": "7e6aa091-8b1a-4fe4-a50b-6617443b7b4d", "value": "393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpc:q9WtLzgOTbjZvk/ekS/mcpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765401955, "uuid": "97bbbfea-98cd-443c-8670-78d2a66214ce", "value": 24446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765401955, "uuid": "7608e610-a914-4dc0-8793-6e119b86359b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765401955, "uuid": "aaf105b4-87aa-4f2f-bb0a-4f4127c6f51f", "value": "UtraDocuView_Proposal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4853398-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765345189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345189, "uuid": "fe97a662-f76f-4ff2-817d-ebc999f568e7", "comment": "Malware payload (RemcosRAT)", "value": "38cf4a2629da53a228ceae2856796a5e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345189, "uuid": "a4c37bf6-f533-41f2-855e-6d446e943979", "comment": "Malware payload (RemcosRAT)", "value": "d7c43dba60ce0a6c43e389947fa8ec1c18e6e050a70bd7a3bdac1474f8809c06", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345189, "uuid": "ea76e910-ea41-4989-af84-9187310a2d8b", "comment": "Malware payload (RemcosRAT)", "value": "958ed538309888548f856c0cb5506ae2abbf10c7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345189, "uuid": "4f59c729-3c07-4980-a1ff-d894d23346b3", "comment": "Malware payload (RemcosRAT)", "value": "4fbe12efd4fa60f2392b2f471b7efe1d30f089fb19faf7898c5d13410e7bfacdc22d9003564732254f468bd3bec0d596", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345189, "uuid": "a7a43683-cd42-4f64-a1b0-3cb389975803", "value": "T153D44B20DD2416B94F071BA9FC541E61CAFC960A552A94F1F6DE070E61029FCE3FE6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345189, "uuid": "f40bd1e9-eefa-45cf-b84a-96150bef3204", "value": "12288:sKuKmMKlJXKKlJIKlJg+IxKlJg+7KlJg+ILKlJg+IcKVKlJg+IUKlJsKlJg+INKu:sKuKmMKl5KKlGKlxIxKlx7KlxILKlxI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345189, "uuid": "28c29408-0e1f-4d87-afbb-c9a2d1b9e121", "value": 598980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345189, "uuid": "8d9cf09d-6501-4cd5-9c7b-9fc532cbd9d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345189, "uuid": "d0050adb-b456-4b65-badf-dd7647d800d4", "value": "Imagen de Pago - 2025-12-05.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff88bc5-d59d-11f0-a129-42010a9c0007", "comment": "Malware payload (njrat)", "timestamp": 1765353449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765353449, "uuid": "22a1619e-8a1f-40c3-b652-03ebcfaf0158", "comment": "Malware payload (njrat)", "value": "48f4e1542df2ca60b30a238d4b0c1b27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765353449, "uuid": "5a37ac11-68d6-49dc-93b0-ea947b4e629c", "comment": "Malware payload (njrat)", "value": "d90e0f94e8df83ea22b969f61790f92e5439d0ce4eac48950e7c47aac0ada1b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765353449, "uuid": "65b45df1-aadf-486d-aa60-ab39be59daf2", "comment": "Malware payload (njrat)", "value": "de347dd9398730b65d992ffbb68b31712a97f6c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765353449, "uuid": "b8a3bdc1-43fb-48c0-a0f7-74bab227bad7", "comment": "Malware payload (njrat)", "value": "277c4a4a36b98d8eadd65e6ac05756da25be1ac4f89dbe38dba5aee6eaaca00054f150066539408f5db0e55b1d8185b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765353449, "uuid": "7dabe464-6529-475a-aa2a-fcd336b47785", "value": "T1B77512E03E76772ADEA50574A128EE7542F51D687010BEFB6ADC3B5734AC210AE0CF52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765353449, "uuid": "dd5c9cc6-43b7-4ae4-96ff-0221814c60e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765353449, "uuid": "e7ef8a21-09c1-41d8-92d3-05aded4c4a53", "value": "24576:updzrlZ153rrQSlDPU+axfdeVzDn09+HAclKPgPVET97lEc4NOeeYRh5jQ:qlxrrvNPpaxfoVzD09q30g9kl63j7dQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765353449, "uuid": "b2320d46-befb-401f-8a40-044e9fa1ff98", "value": 1563648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765353449, "uuid": "757dca1a-b298-4dff-9773-2fb0fd777368", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765353449, "uuid": "fc4bf59d-06ce-485a-bf12-7db6ad2331f7", "value": "AWB#7588375382098-325_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f94019-d61f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765409322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409322, "uuid": "1b9396a0-33ca-42df-a350-0cb5f891b4e4", "comment": "Malware payload", "value": "2f9e1f0bc0c3c89ee96690768a9fcac3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409322, "uuid": "4bd59027-ea7d-420c-a0b1-4e6fc1d3ee39", "comment": "Malware payload", "value": "d98fec13e2f261a0f8da106936c73f1ecdaf4b1e87910581b483d7beb9eba767", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409322, "uuid": "62969376-44d2-40dc-9b72-98a455300197", "comment": "Malware payload", "value": "d0fd1f036ff054b9370666f18283345f3d15bcd1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409322, "uuid": "0ec9f996-0539-4562-aa73-7e9708be1fee", "comment": "Malware payload", "value": "a6cb02d0ef22fb2cfe91a6f41ed6d16bdb3183019d587d46a2645fcff8e56f38208e6fb30a76b2bfe3b6c18e1ac1b3ae", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765409322, "uuid": "59c6c578-daca-413d-967f-2f94d704220b", "value": "T1A38364BB41424ADEE802B5338F3F55BA9AC90F6293345F2A2D98D45E4D3214B3F4C6E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765409322, "uuid": "d8cc74ff-bd82-4474-aabb-c8f18443ac1c", "value": "1536:yXFmMWFinVkKF4nEHlIhzNm9yelPxT3cd:yXwekM4nclMSsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765409322, "uuid": "1ce1b06f-864c-4ac1-9875-1693c3ed141d", "value": 84729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765409322, "uuid": "5c108c10-c853-49d2-92c5-7b8f7f5a0f3d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765409322, "uuid": "7205512b-1eaa-4f26-8556-4a2c113073fd", "value": "Italia_EDEKA.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb48427b-d5ce-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765374433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374433, "uuid": "d94334ad-f7cf-4930-b32c-1fae51761174", "comment": "Malware payload", "value": "1604f67457cae93d80cea39cca3b2e55", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374433, "uuid": "5bedc308-c2f1-4848-8483-517418e6e248", "comment": "Malware payload", "value": "d9dc90fd23cd2ad5e5a1b9df65d36f5328e0bfec7c278b2b6010d9812012ec5a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374433, "uuid": "4b37b690-0d16-4944-bed6-02af7fb70069", "comment": "Malware payload", "value": "680f6aeaf49f5bd696d21620a513867d4007a128", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374433, "uuid": "4c58777f-2758-4814-a42e-40155f080eb1", "comment": "Malware payload", "value": "339fcf7f5ac7c09d7bbbf7f9570fea14bf6db39cf6c66172ea6f08ab04ff67e38b119a4f1c84cbc120f379bbc266cf37", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374433, "uuid": "d8f2b273-c745-4c42-afe7-ae06f5b0d614", "value": "T1557111E5BDA2ED267F0D5028BDD94A837C5B2F7A460DBE136082686A707C14C71F8934", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374433, "uuid": "bda66f64-78c7-4043-a535-b04817b3c9bf", "value": "48:0/DZe19PpRAcqxh6yiJKcz1qDK1oH6aOu7AYTip8PB7om/faJ/llwMnD/j70OH:4I19PvqhiJKI1Foai9TioUcoiMPIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765374433, "uuid": "89954a3d-86ce-43e5-b612-af27e2b35b50", "value": 3668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765374433, "uuid": "e3cb7e2a-fbc0-4170-bdfa-4012fe180e9d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374433, "uuid": "c52f0a33-1854-4917-b877-2e3b965acb17", "value": "b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf86244d-d5a2-11f0-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1765355569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765355569, "uuid": "2f544f89-579f-4674-b45e-68647aee9ab0", "comment": "Malware payload (MassLogger)", "value": "c86c6d9305f421bbf31afcf88a5b10ab", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765355569, "uuid": "fb5a4f87-6e52-4ff2-9473-4166b89c71c3", "comment": "Malware payload (MassLogger)", "value": "da81730149ec58d59873f1d67dee6e084edbe63999fcac58554d8c3121605aaa", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765355569, "uuid": "9abe8de0-b214-4b88-b348-3033d4fc057b", "comment": "Malware payload (MassLogger)", "value": "51d4cfc3e8ddfd51631fb16aa916b41096eee43a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765355569, "uuid": "fc193b32-a3b4-40d5-9295-46e95c947c09", "comment": "Malware payload (MassLogger)", "value": "56ae715c4da26699f76a873404c63178315399be20a1218d486a65bf8dc29440faa432ba38b8a8dd23cfa096c1141f4b", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765355569, "uuid": "5eaf8df2-4cee-4a16-b694-6d5a72e6f1ea", "value": "T16AB4233DC5099D580C49FFFB4DAE73DAE91556E90C300FA796348C728FAE14122AAD9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765355569, "uuid": "2a669fad-6243-468b-85a0-6c657d4f089f", "value": "12288:46/d/7bfWNxEp8/TlW5SBdkUPdwSWG9NwYsl+7AxNLcvgn:FdfeNmp8IsBdk+w49N/sl+Mbcvgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765355569, "uuid": "74438ce6-7266-46a8-888f-f345a9d70112", "value": 495840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765355569, "uuid": "45b1cf13-e2d5-48cc-9415-18b2cbf94d03", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765355569, "uuid": "7d7b2b96-50aa-428e-a36a-670390125496", "value": "Product Shipping HQINV25100088-P.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3df461f-d588-11f0-a129-42010a9c0007", "comment": "Malware payload (DCRat)", "timestamp": 1765344409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344409, "uuid": "55e68fcb-a3fa-4f59-8759-d84e1022531c", "comment": "Malware payload (DCRat)", "value": "987446853300452181b49f6739ded6ad", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344409, "uuid": "2b81f82a-403d-4d9b-8151-df2d05840b3d", "comment": "Malware payload (DCRat)", "value": "db2000430c77dc833b265c715e2adcd722bb14ca83bf81f751cf00f9fa8f959d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344409, "uuid": "f6f66490-c8d1-4b7f-878c-7ef60dbb2c5a", "comment": "Malware payload (DCRat)", "value": "8ddefaa756eb2ae97dca18f72b3a5e7530ef141b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344409, "uuid": "251ec62e-7232-4acf-9539-a18d768fd799", "comment": "Malware payload (DCRat)", "value": "d0d022b37c1406d36f1a7bee9c193b0bf82ca4ee01a0cffd6db23ef2aefe961a3e9d8e94f997ac033f6f54dc3f0538cc", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344409, "uuid": "64720482-6536-4628-8e0d-8a8d420ea97d", "value": "T13F2604238EB84663C120B6BB1F661F5DF8121ECB5ED65E7FB21455C9EBF4AC1E012620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344409, "uuid": "d445656c-955c-495e-ad4f-65628eb31a01", "value": "96:S0urXLaS8dIQoffnKBpe0VAKzJYcMGapAC3o:SdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765344409, "uuid": "532b1921-1891-464d-a697-6f01dda9e0f7", "value": 4458701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765344409, "uuid": "8fe520be-6385-49f1-9382-4dc4f63d694c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344409, "uuid": "032f85a2-dec6-4fd2-9bdc-e94270a6fdfb", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b561a2-d580-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765340894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765340894, "uuid": "6b709eb2-573f-4737-8c83-96e864756ca4", "comment": "Malware payload (Mirai)", "value": "c6381ebf8f0349b8d47c5e623bbcef6b", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-55182", "colour": "#999986", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765340894, "uuid": "1da4b875-6e13-4553-8407-8792e2b2e968", "comment": "Malware payload (Mirai)", "value": "db38b69a3444f00035ac36b2a82f7fc4c9bc9d30428100d7805016961b3253ee", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-55182", "colour": "#999986", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765340894, "uuid": "70189f4a-8f0c-4855-8e06-27383f0e4869", "comment": "Malware payload (Mirai)", "value": "c87661e2e4d48061690e85d856f3d7258b0862f6", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-55182", "colour": "#999986", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765340894, "uuid": "fefd7bdc-7e44-41ed-bc72-6f1e5e1635f2", "comment": "Malware payload (Mirai)", "value": "212525dd4526a92ed8bbd1009bdd6d6e4c5d8cbbd6d819f4c2e5a71c7d76bf12ef7bdf50fae46473ca3284b4658dae29", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-55182", "colour": "#999986", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765340894, "uuid": "277ea822-c4c1-42f0-ab06-b1ca4ed680f4", "value": "T1D2C012FB00505070014AFE2034B14451A321D7B1379C5E06DFCD0421C4C8E84A468BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765340894, "uuid": "b4259f1f-99db-4eed-9fd0-d18c725963dc", "value": "3:he8zgMFZXLFLxUdVgZ8aOSZjZxvTFLK3iqP4KSEVMFZXLFLxUdsRzSBwmH3XKvn:I8zgMFZ5LS4Z86lFxK3iO4KSEVMFZ5LX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765340894, "uuid": "43219f94-3ac7-472f-9ce6-aee559c40a0c", "value": 184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765340894, "uuid": "301841a9-ebdf-4d2c-a51f-043038caf480", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765340894, "uuid": "6394955a-b241-4b9d-80e2-fb4cf93bbd97", "value": "c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a097fd68-d58d-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1765346470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765346470, "uuid": "a2b2f434-a208-43c9-a081-2d065ee090e5", "comment": "Malware payload (Vidar)", "value": "226641c0ca0ec68b9ef5ee45e5e86b40", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765346470, "uuid": "e534725c-1e8f-4a61-b5c1-ec87d11499b4", "comment": "Malware payload (Vidar)", "value": "db72ecce4dddaae2927a0a5099fcd0e80c57a2dd86e638c43b13d075ec59ef1b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765346470, "uuid": "7a0db571-20ad-43bc-a82e-c59335d7cb02", "comment": "Malware payload (Vidar)", "value": "80083f725f6a0e6699da30c3aa1ecca1b96f02bc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765346470, "uuid": "af2cc99a-9c00-4f4f-b758-41be9405c91b", "comment": "Malware payload (Vidar)", "value": "fa1e5388614bd214d0f558021073ba41fded74a08b0b7e5ab33b64063603cee505bd45d05517bb3b2dfd1e27d2c95f62", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765346470, "uuid": "6fa21112-93ce-4811-875c-18d00c659b91", "value": "T1879512D03A39771ECFA51A30E528DDB542F91DA8B401B9F64ADE3B57B5AC110AE0CF42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765346470, "uuid": "e7d8ebc5-13dc-4a56-9e19-6d3eb9f50f4d", "value": "49152:VL80nI0thT+NpIzalebmOr+aaITdnR6mNgDl:VLznI0tt+NpIzalebmOrXaoR6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765346470, "uuid": "5a53200a-67de-4335-a9c9-e18a3439ba4c", "value": 1958912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765346470, "uuid": "24fc1946-083d-4980-9e16-2f90e7328161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765346470, "uuid": "5cfa772b-014f-4cee-95ac-1c6746886730", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf002604-d5c9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765372318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765372318, "uuid": "1a48189d-e22d-492a-bc61-32b003623213", "comment": "Malware payload", "value": "4445994d2a0f54576a206387b5e1eb45", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765372318, "uuid": "47311cae-2629-4285-b99f-2f8ce41e4e5f", "comment": "Malware payload", "value": "dbf64e708a2f7d48d1a8116d6982e656f5b8d72b9125be1a207f55d07c43a824", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765372318, "uuid": "4d9667ce-bdcd-4fab-9630-cb2c9eefa118", "comment": "Malware payload", "value": "205adbd8270e2df826fbe883042208c259422928", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765372318, "uuid": "e260d684-f72a-4d01-b9f3-31a7b1129f66", "comment": "Malware payload", "value": "87d16e153302a8a5d89e6f7b93f7e63c49cae12b02105e0adb0e3888b2d27dda6370ef9340e5d423728aa5a6e1c4a37d", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765372318, "uuid": "d5a143c5-1d3e-4014-a718-6bb95bf69dee", "value": "T150A7331A1DB4B6C0FF6D852691D4E16EB3AF26A7F6665FF4E02413F8E8C543A1207C09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765372318, "uuid": "939979cd-3ed9-4b53-a059-26042b27242e", "value": "786432:jdJmsRsdZZCjcm9uoP5agLrT11MMCUpDLmqHJyR7IgeHvFXGQZLkBy7K+JSYpNFv:jjmsSocOuoP5aUJCSDium7I3sGkBM1Jp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765372318, "uuid": "06f57480-a7cd-47b7-9f7e-5649bf29c646", "value": 46613486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765372318, "uuid": "69e7b04e-b96f-4f6f-9fb2-634b701eaa0b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765372318, "uuid": "756defc9-b0f6-45e5-9693-2a1713b21d54", "value": "KotilaV37.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ad4c2d-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350071, "uuid": "9fcb6254-db29-41af-b4e5-67ad6e3abcbc", "comment": "Malware payload (MaksRAT)", "value": "081f1a973599623951585c4bd1f1679b", "object_relation": "md5", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350071, "uuid": "1c7875ee-1a47-4fdf-8d3d-a79c94fb0d8e", "comment": "Malware payload (MaksRAT)", "value": "dc069d170ae0819238da9f2382001df44b2240620201e216fdcf43b0bb4b22aa", "object_relation": "sha256", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350071, "uuid": "077e9e7e-ebc5-4918-ba9b-358cb28d4937", "comment": "Malware payload (MaksRAT)", "value": "804eaae5795711a125908a72966acbe340aca383", "object_relation": "sha1", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350071, "uuid": "72d35177-657c-41b4-a425-ffdf2959bd4b", "comment": "Malware payload (MaksRAT)", "value": "787909000eb00a34913a790032d0d2152a5b950dd9b132fe0c41e963b107724d4f7e519531dc159548bbb253307dd393", "object_relation": "sha3-384", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350071, "uuid": "47514445-a01b-4138-911f-290c0760d2a3", "value": "T148E2E15EAFA2C429F046D5F01B0FBE13CA5EB6AB2996C51E1AC19D99204890D53227CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350071, "uuid": "c34220b3-ec97-49cc-ae25-ed636b7b1075", "value": "768:HtBG3XN2hR/RSCjkCnkRcU5135uEmoC/P/g/ri4y+lX9S:Ht43XN2TZHjvnkR75135uEmo8PoVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350071, "uuid": "1fc61f02-1790-43e9-a77c-39393b055d65", "value": 32935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350071, "uuid": "25acc32f-3e25-424a-bd9f-cb1c997239db", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350071, "uuid": "a64d6bb1-1683-4429-b649-165d940913e0", "value": "dc069d170ae0819238da9f2382001df44b2240620201e216fdcf43b0bb4b22aa.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef986ba-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (Loda)", "timestamp": 1765350306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350306, "uuid": "8cbbcfdf-f91e-4a06-b781-bf5b42b2cd7c", "comment": "Malware payload (Loda)", "value": "76b94a5d858a0b9ae76d1d0cb2060844", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350306, "uuid": "1cfab205-7137-4b0c-a62c-04c994d0dac4", "comment": "Malware payload (Loda)", "value": "dc68a3a9db6666798ff7519a676fcf96f042b0e988c69da269e2a0fd3a2635eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350306, "uuid": "04568f1c-d815-4082-b1d5-8eca5020dbe7", "comment": "Malware payload (Loda)", "value": "96e6761f6c48a65265d1c7261d866d2ceedd0f33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350306, "uuid": "ae0e8d31-c93e-42f8-bf81-b5e83cdb8cac", "comment": "Malware payload (Loda)", "value": "6ae6f7310a20bda75b0d0ff32c2288cd52bafeeb0ddf06e921ce0cecff3219b85b1a443317de3e6bc27794f61956f550", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350306, "uuid": "215a436e-5352-4fb5-bdd4-c2d0f32309a3", "value": "T174352329BA5BC8B6F92BC33099EBC3E40730AE16ACA647C176D4FF2D147044456D29F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350306, "uuid": "15cc9e42-1e23-40d5-8142-f33302458642", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350306, "uuid": "54bb7ce2-089a-49f3-b3c5-8928386c4c09", "value": "12288:6Xe9PPlowWX0t6mOQwg1Qd15CcYk0We1GnwHdd7v1prSdKUhbdpOCyxmpGVWu76F:PhloDX0XOf42G1BTpVWuF76ubZL6RF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350306, "uuid": "75d9f4b5-9190-4306-8d4d-898707ac38bd", "value": 1062400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350306, "uuid": "134ea63c-1832-4b57-a84d-abd0dbd91635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350306, "uuid": "072c28bf-6c50-4d11-a547-fa48defaa318", "value": "Bootstrapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c85e34-d5ff-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765395548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395548, "uuid": "d3794bd0-5161-4fc7-9c7a-c437929003e4", "comment": "Malware payload", "value": "79da19a170fea52a9c1fbf794484d660", "object_relation": "md5", "Tag": [ { "name": "185-121-234-211", "colour": "#ACF702", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395548, "uuid": "7aaa77f8-581b-4b4e-91ce-ea4a4bf81db9", "comment": "Malware payload", "value": "dc6e46aac9aa53de80ae8b7bd7b53cb85f12b766ac8fffda5dbf9c9941b19f00", "object_relation": "sha256", "Tag": [ { "name": "185-121-234-211", "colour": "#ACF702", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395548, "uuid": "c1f6c415-4514-4ccb-a47b-600473cadb71", "comment": "Malware payload", "value": "489eace4f0ffab5094394f207f755e8fb2c18266", "object_relation": "sha1", "Tag": [ { "name": "185-121-234-211", "colour": "#ACF702", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395548, "uuid": "c7be9ef3-a952-448b-8ac2-70cf07f0d7ad", "comment": "Malware payload", "value": "01f1dd5e07db137ce5c94391fbf18e7230c07c05911e07246e29e16acdaf19ca8400936224e43ce50bda2133ef8e920a", "object_relation": "sha3-384", "Tag": [ { "name": "185-121-234-211", "colour": "#ACF702", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395548, "uuid": "38a56cac-1829-43c9-9c07-6a90ef1e27e0", "value": "T16BB56A027951C03BE222057098B9FBB694BE37B86E6140537F79C74C9BB67616F27223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395548, "uuid": "714f190d-78ea-4ded-92cc-3f5950ef9de5", "value": "b6797b4ed203d86b901db4ea2add63a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395548, "uuid": "745eae05-7ec1-425d-843c-4c52fb4102df", "value": "49152:tt7GwJ8jh6iOZgWkHcFe4F9t/REHL7HeHrTHIHvH2H/HOHaTCo8h4NDGoG+Xo6jy:LUl6i6TJg10XxV+eLdSAPZ+UiSZFDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765395548, "uuid": "42aa8e4f-2920-4d9d-9f44-267331ce1b86", "value": 2394008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765395548, "uuid": "158acdae-c396-4f24-8b4c-0f9b551900b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395548, "uuid": "e5c70afa-b32c-4d6f-ae8f-53a6823df192", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20f8a1b-d5b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765362499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765362499, "uuid": "09555a04-1812-4f7d-bd42-79040cd0e739", "comment": "Malware payload (Mirai)", "value": "cd90e9863674d0e2253caad294223798", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765362499, "uuid": "50376f99-f95d-41a5-bd82-732f8923b04c", "comment": "Malware payload (Mirai)", "value": "dca8e7f9ca28773cfd9f56ede2aaafef95a0ba43fcb3001e10ef41933867ad0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765362499, "uuid": "b7346ff0-b6eb-4a3b-b0a7-123cfe1371f5", "comment": "Malware payload (Mirai)", "value": "9f1a1f6ffd81686901bcfb0c55055826158058c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765362499, "uuid": "73b9e92e-a7cf-4fe3-b7bc-3d5f00912a75", "comment": "Malware payload (Mirai)", "value": "e0c0f67710993b6d8f4aef6c26c2a877cf3ec8d074aba57ffd53aaff93cb7467454de3b6561cf4a411b977e7a4cecbef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765362499, "uuid": "dbbdf92d-a089-4f71-83c6-446ee862db9f", "value": "T169445C02B72C4D03D1E71EF42B3F57E593AFE98224E0B5812A5FDA498176E331949EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765362499, "uuid": "21094714-218d-4236-894c-df080a2bd92d", "value": "3072:N0Yff03/iLT7NuyAS1RsRAU/Tbbxe+eLIHxvGUw9s0eKHM59Pu:+YfVTAS7sLLbbxe+ekHxvGt9sx9Pu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765362499, "uuid": "1b5ae38d-c048-4301-9e38-e56033f6bf0a", "value": 266052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765362499, "uuid": "b32933ad-21b1-4cc7-97de-05130c9dc808", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765362499, "uuid": "997a9328-023a-4752-abf4-1d56dcce2b2e", "value": "ecco.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25511c3c-d59e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765353565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765353565, "uuid": "30f1a76e-d879-4500-b51c-48104e8ad8e2", "comment": "Malware payload (Mirai)", "value": "9bacb0a86f375029e9e48cfa952f6d89", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765353565, "uuid": "75969e6a-af7c-4dac-8dcc-33a2714e260f", "comment": "Malware payload (Mirai)", "value": "dcbe16957595ccd61ed97cf44f07a5967788bd48bd903fc688ef3995b0132f91", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765353565, "uuid": "7624873e-bd4e-42fc-8858-fc4abbab6ff5", "comment": "Malware payload (Mirai)", "value": "1dc6b1bd7ada0a6053aa036da29d1784f3b4db4c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765353565, "uuid": "f2429d99-b01b-442f-b5a9-1ce71830514b", "comment": "Malware payload (Mirai)", "value": "84405952a4e5171b651639e99011a908d35e4c47af5f9d412ac8b246b7faa8b69d4dd743772b7f619b499bf0fbdd6925", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765353565, "uuid": "0301e8b3-fce4-40c2-879a-10bcf685f9aa", "value": "T1617198CE30602A346E1FC976337498D176D649A42987DECCBCD4BCE25C9AD80B4C6BB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765353565, "uuid": "b54b08c2-db4a-4a87-95d8-6392ebf1eb94", "value": "24:wyFTZ7v7bJ7T2syIfwZ7ue7uO7msyqmIqxZ7Ku70oia7ysyH1Z7KE7toY7asyhYA:wOXNCAqi1ctyFpWhmWgWyCpI79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765353565, "uuid": "a36b8a24-cdb5-47f7-802c-ce3d10c99c06", "value": 3558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765353565, "uuid": "28b0682b-964b-478b-a78e-329699356e9d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765353565, "uuid": "ba430cba-bf33-4b5f-831b-f749f6f0f655", "value": "goth.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3122320c-d604-11f0-a129-42010a9c0007", "comment": "Malware payload (EternalRocks)", "timestamp": 1765397394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397394, "uuid": "450ba698-2ea2-48dc-9eef-6822b19d8a2b", "comment": "Malware payload (EternalRocks)", "value": "6e3a24a6ad18efec6b48ba47a1bea659", "object_relation": "md5", "Tag": [ { "name": "78-40-193-126", "colour": "#23F4EA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397394, "uuid": "d2eb2ad0-d481-4f88-a5f3-6d64f4864729", "comment": "Malware payload (EternalRocks)", "value": "dd86a3e996b53b952e35477b7980929b1c43c42efec0eadc618115a22ffb86dc", "object_relation": "sha256", "Tag": [ { "name": "78-40-193-126", "colour": "#23F4EA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397394, "uuid": "ac7f0b16-8317-4388-a04f-0c4314e918c6", "comment": "Malware payload (EternalRocks)", "value": "03f3da41c13d5e65bffe631ea901ee886fff238d", "object_relation": "sha1", "Tag": [ { "name": "78-40-193-126", "colour": "#23F4EA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397394, "uuid": "9c6265e5-9bc2-4e21-bbc5-214d3708d0c6", "comment": "Malware payload (EternalRocks)", "value": "b9ea57526ccbf4e9bcd2fc6f96645a60a070cb8290b39b21f580324a92443f7506bd436cf982dc0db32abc2d7cec7b6a", "object_relation": "sha3-384", "Tag": [ { "name": "78-40-193-126", "colour": "#23F4EA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397394, "uuid": "d4d387cc-7bf8-48f5-89cc-7dfad08e3a5f", "value": "T1ACA67C10A8C86607FD7ADFBC999E76500F7AB1952901BB398F4149D93ED2B58C8039F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397394, "uuid": "c923abd3-3f67-486e-a296-1565faeaf792", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397394, "uuid": "758b76a5-c948-479e-bdbf-e276e66c3c81", "value": "196608:v7ujFC6eW1Obq9To8vg4sP76xW82bhHoMGmlG:16eWMbqS8vg4szz82bx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397394, "uuid": "3f5c19a4-f50c-4723-9287-03694e92829b", "value": 9682944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397394, "uuid": "6309856d-8c31-467d-b679-f8e2f78a7b4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397394, "uuid": "817b1e95-4cbf-4b5b-80c3-12b049b0257d", "value": "CrashRpt1403.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f312f91c-d5c7-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765371520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371520, "uuid": "5faa87a8-fc2e-4ef2-a37f-c770ca614f94", "comment": "Malware payload (RustyStealer)", "value": "3a2aa435122623425a95e0323c81fdc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371520, "uuid": "c9aa81f8-148c-4311-b130-92dc31f64800", "comment": "Malware payload (RustyStealer)", "value": "ddad07b34bc5dfd040d211a8b0c47efe0949aa6ac1aa92b7c2977b1402683d2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371520, "uuid": "a203b1c3-3285-431e-81df-396d295e5c0c", "comment": "Malware payload (RustyStealer)", "value": "cc42fdbbd5b0c6b4b7e2f3056553371a98962a62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371520, "uuid": "655b2a90-baed-49c5-ab73-c8f4d5fe66f8", "comment": "Malware payload (RustyStealer)", "value": "e3493312f1e141b386fc3202e39bb41c72685ee4c4d32c95c47f5f5fd1388bea71877f5b862124014ac7171421d00acb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371520, "uuid": "d1f2e24f-256a-4dab-acc1-9aed2378b6df", "value": "T10EB6AFB7B1912CA8E356C03D8357A17BAF3BB58727126FB716A888306E53BD12F04745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371520, "uuid": "f99759ba-863a-447e-8bb1-0368960f29f0", "value": "3d5b6c89a890635218157908ec7f3427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371520, "uuid": "743087fd-d7ca-477d-8769-6950d3ab9a8a", "value": "6144:biJW5zdp/R+4jbwYTb2sZ+JUHbsKhR+g4pxdr57D5XcEbdIN0Dr9XDOX/DBZuoEl:2JWL9lbvZ34pxXDuRNoA/DG8uMYMFNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765371520, "uuid": "59753f0f-bcc8-41c1-b52b-9c35000ac1b1", "value": 11093378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765371520, "uuid": "2cadd338-6412-4a9c-9bc0-31b0087e94c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371520, "uuid": "c07955b7-40c2-4b8f-8f47-952e49477ebb", "value": "SoftWare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd11b25e-d5b8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765365040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765365040, "uuid": "8c9ecfa8-e850-41f1-8f9a-e391472ad3c3", "comment": "Malware payload (Mirai)", "value": "f54ef3879607d7116efae45143ee2e90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765365040, "uuid": "89ea97f3-b10f-4937-a78e-7f91cf6957c7", "comment": "Malware payload (Mirai)", "value": "de41e4673ae51389ee0bd6ad0a60d3164073102847e6c73b8ff825b177a16100", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765365040, "uuid": "743619c8-7625-4531-a193-1f71e3945f23", "comment": "Malware payload (Mirai)", "value": "8a13f53e66c0243900076d1a11c2123b73cce21f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765365040, "uuid": "daf9f32b-765d-47eb-acf8-2aed63cc0ed1", "comment": "Malware payload (Mirai)", "value": "6ee3faad04726f66341364b69a4ac89d7e875d6eee74ba2bdca05c0b8f75edf1946d226856076d6cd4f63981142c046f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765365040, "uuid": "04a6c972-9de0-4d60-b94c-0543f6ce9462", "value": "T1F8F31881FC829A6EC2C353B6FA6F528D335267F5D3DA7102C85407297ADA90F0D77A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765365040, "uuid": "d2b4f3a4-328b-4c0c-a39d-e36c160f782a", "value": "1536:d1hjNbdPwMEVkIEBs+gdWkSwub9QDdlGYRLkW70D6dc2bF12ZhnzfcIQveZWCL1L:d1NVVwMEVkhmAqdlw2bU1cwrpaodgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765365040, "uuid": "93090e4c-5623-467e-a512-707634994e0e", "value": 157808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765365040, "uuid": "928d6f2a-89f4-40ff-80fd-60b390495689", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765365040, "uuid": "5047c1fb-8fd7-4257-bbda-b29ed08b5180", "value": "ecco.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697d08e7-d605-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765397918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397918, "uuid": "fb13630e-c665-4c5d-98b5-96a805717772", "comment": "Malware payload", "value": "392d83c7b84215c449810dd490a0810b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397918, "uuid": "a679f60e-95b9-4dc1-82ec-8f5416ab4a27", "comment": "Malware payload", "value": "df7d333afd2610426cf8a273976eea8c200acf87ddc9589eca2a945d77335bef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397918, "uuid": "8e56f344-a9b1-46c4-a2c2-80133e607f78", "comment": "Malware payload", "value": "7001d4d57bd0e2a905249a7ebff941f6ab2dd33b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397918, "uuid": "40d702de-f4dc-4740-8533-33ebd8cf8531", "comment": "Malware payload", "value": "d93dbe73522a214bb816458bfcb59678af9f65bf0ee3e3177cdbc757efa86dfe9001d1f19666ff48e3ef495d7f3f204b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397918, "uuid": "ccf3081b-55ad-4cbd-8a1d-944d0475a552", "value": "T109935B22FA79193BC8C4A87762F34761F1F6438B24A89A1FBD610D8DAF2465032577F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397918, "uuid": "37df0405-7d54-4d15-8e8d-61d3e0454626", "value": "1536:zlcsL5p8C0CV7t+JwBKkGUVr4+gZgDtBqbq56Aw5wL6otj3ce:e4bH+9Wxrqb66X5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397918, "uuid": "06f62e91-609b-433b-b98c-c17abe4e7aa3", "value": 94976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397918, "uuid": "9c0a3852-d5f0-4be0-bf61-0405fdd5405b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397918, "uuid": "7485ba29-9b63-408b-9118-48eedd9b7e63", "value": "Labelloperc80.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a885e3b-d5de-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765381196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765381196, "uuid": "0a3ae64e-9410-459c-aa52-a3c1f9b3fa5c", "comment": "Malware payload (AgentTesla)", "value": "4760ad87baac6b47ed19e756728ea7aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765381196, "uuid": "b644d978-1e4b-40b2-aa54-fdf63afa4940", "comment": "Malware payload (AgentTesla)", "value": "df9bee1b34188c7b8eb31a4d8a785c7c87f2d284f2c0ba5308bf75a5dbae5ff1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765381196, "uuid": "0bc52f0f-5d62-49eb-bfff-0da7a4111454", "comment": "Malware payload (AgentTesla)", "value": "41ba5a39b03843fd90fe61cd77d66bc4acf7a4f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765381196, "uuid": "dcd98b4f-08ee-45a7-9b53-37c65bd9ade3", "comment": "Malware payload (AgentTesla)", "value": "ca1cf1e0f4aaadd14a29945b30c8d01aa3884230403fabf27461b6d4571f7c450acae01262073471b7c1f5abcd8b04b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765381196, "uuid": "48346be8-4905-4ce1-acab-75645e7ecd90", "value": "T10DF423A499D18A51C6057334C836CC2505783CB16E54A77D8B39EA9FBC30397EAB3B1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765381196, "uuid": "f4b4f663-0599-42ec-b85c-ed77a81423ff", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765381196, "uuid": "d704d2c5-b407-411b-bbae-1f504a503435", "value": "12288:Zz7hU5I5yuNHIgzSFKxWltRohBfSTso93UWRsDXjs32gzcj9TRqveZYlW9GNqG:Zf+iN57Gtene3RoXm2+chTRylvqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765381196, "uuid": "de8c0e74-a8fd-4a8c-8a73-0506afcb4558", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765381196, "uuid": "90bc0c9d-3851-4760-9eed-bc756ba8077a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765381196, "uuid": "ffe2f449-f820-4e38-9110-7382e770cfff", "value": "ITT-QT2025DMT029.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804c61a3-d55e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765326230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765326230, "uuid": "43fe27af-a956-45a2-a27a-977e33b1a619", "comment": "Malware payload (Mirai)", "value": "61e52d6ab5796709310e51bc5cd97f37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765326230, "uuid": "75927eaf-d481-4ac8-922d-a6b470c4011d", "comment": "Malware payload (Mirai)", "value": "e08b23fa441e9532c555d2524e8c050efcb4b9f17f229ecec42b2b8f873820b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765326230, "uuid": "c8fb001f-421b-4233-999c-b69903f0ee69", "comment": "Malware payload (Mirai)", "value": "b8c35f0e23a84bfb951e30cf1ff3c872272018a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765326230, "uuid": "948b1398-3764-45a1-a12e-7d66d72fe09e", "comment": "Malware payload (Mirai)", "value": "b510cb8baed7b7b60b96770cc1c53bc4dce41bd448a939103c52a7972be7b2283ceecc0bbca681b57767c68bac754c5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765326230, "uuid": "49f53667-6b1e-4a37-ba97-c3c523d043c9", "value": "T1D09302AD02B97D8F8E6DECBC515C0DB45F87334F1C6B14949A12E885973B0BA2C884BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765326230, "uuid": "bc56f477-0e4c-4ce8-9c42-112ea54fad79", "value": "1536:2NLYrBOrzRDHofsb02jsiFZLD3JnIAfQjJ4yLNaOsitSA4T+96eGLeOzRitQvI:2NLYrqZHofszsKZ3JnW4iaN04CwteOFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765326230, "uuid": "0a465ae2-6cad-42a1-bec0-8dae3effdcc8", "value": 91740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765326230, "uuid": "446b6778-6832-4d6f-a619-0484b18a0c64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765326230, "uuid": "4b6fd5dc-7f79-4555-8067-0adbf7e5e3e5", "value": "ecco.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0e8ac2-d623-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765411022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411022, "uuid": "c89f8848-85f2-4a9a-89d2-e396842fc095", "comment": "Malware payload", "value": "f25d9f66bf3c22f96dad06c784f9b554", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411022, "uuid": "5a8503c1-0f6c-4a75-a430-7e2682d2ed86", "comment": "Malware payload", "value": "e0f7a0c2e3ab78890a3b5d6ec4ff9ca63df55433355b72dab536cbbe17fb050f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411022, "uuid": "8b754b0f-fbee-478b-b8fc-f86833d40f41", "comment": "Malware payload", "value": "28267ea9d8d02de9383f34df3dd0f42718b8c2a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411022, "uuid": "45467e28-bb87-4855-b371-0d9fc266ac84", "comment": "Malware payload", "value": "85369e41200435ce835b6a5a40eb53a6c729b225e0372eaef253176b8cb6c5c277be0fdc266f4f8af44189119a94c29b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411022, "uuid": "a0188c27-154b-4c9f-9fcc-9e9ab1edb0ed", "value": "T194C3766A3E51BBBEE5A8873107F35F70C399299226A1D781E26CFA185F7128C1C5F350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411022, "uuid": "3946af02-df2f-4105-ac20-fa714494b634", "value": "1536:fVNy7Ksv/V1Kn+VIUEp/NdJkB2PYQjP2rK4PFHi/uYe7ealVoD/YNO5e+vg8:KflC/oC/uYePV49I8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765411022, "uuid": "bc8cee8e-5abe-4afe-9a8f-17e8c20df758", "value": 119167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765411022, "uuid": "62d8a8d4-2778-4b30-927b-5a99047e66f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411022, "uuid": "bd86de61-2cda-41d7-b59f-9dc2aa1148fd", "value": "ntpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08491ac2-d602-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765396466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765396466, "uuid": "fba9a8f2-1cba-4635-9297-7dbd9082ebe8", "comment": "Malware payload (Mirai)", "value": "69ab73173677dca6a70438e5044b3342", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765396466, "uuid": "d895affc-41df-4068-89b4-a66beb91d0cb", "comment": "Malware payload (Mirai)", "value": "e1520f4996a99488404cb34b7d78f958c9a916f25823a60901b2b9681c801800", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765396466, "uuid": "8432d714-4553-4955-8deb-3b400ceffa66", "comment": "Malware payload (Mirai)", "value": "54043b8061168555b8e0e40ebdd00dfac6220357", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765396466, "uuid": "d2d76c7a-7b54-4989-b06f-eb341f5876bb", "comment": "Malware payload (Mirai)", "value": "dee46abcbfbe1d43696fb301c3d15659bafb280281231802654a9221aef66cae9fbd6ba25f79dcbe642b6a485a85cb6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765396466, "uuid": "e8b600de-5530-4c50-8a5c-ec4d3775deca", "value": "T115B3C81E7E218F7DF768863047B74B21A35933D627E1D685E2ACD9041F6034E285FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765396466, "uuid": "2f0ad9da-92f4-4146-a78c-84c79cf0fdd4", "value": "1536:DKFAHlCSYBqbZbKvrCdBiXFpVKpNLxSdWtyB/TqbehL1HD5oAB1t:HH8ubUv1pVKpNLxS2y959oct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765396466, "uuid": "47422723-c6ce-4eae-b5bb-2a236428fe9f", "value": 114280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765396466, "uuid": "42b3e754-983f-43c5-82bc-a2b13a8c52e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765396466, "uuid": "1352352d-2165-47ec-89f6-8c633c510bcd", "value": "Labelloperc80.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9356379-d623-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765411017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411017, "uuid": "3b5a7f39-8412-4035-aa8f-9626bc05433f", "comment": "Malware payload", "value": "353be116889f3698c72a7ba69548d23d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411017, "uuid": "58916fbd-d55f-464c-9445-417979fd36ac", "comment": "Malware payload", "value": "e2e67d52821162ef4e0eccc5f36cfb8fe50a49fbd6157ce90603c4d3dc9694b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411017, "uuid": "e0814f40-0676-44ed-930a-e30a7ad613fa", "comment": "Malware payload", "value": "faadda895a1e33c31f1a5920a0649bd8960ed2cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411017, "uuid": "e07f1fdd-ba30-4393-bff9-469096430665", "comment": "Malware payload", "value": "6eb68fe0ed700b5828e28449492d49ac7df84768ab239690873d6b21f78104bc5573b2064053a6f6d80c67ffab195ea6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411017, "uuid": "53d85acf-3410-4100-aac6-ec476b327d4d", "value": "T1F5B3F805D9905737C2D23BBEF79A82CE73221F989797331196287AF41BE5B9D1E39020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411017, "uuid": "ab192353-7856-4b54-ab72-7c4f1cf17fbd", "value": "3072:66z1EqLgV4ZQGBcD3i/lMpaLhmVAg/i4dja+A3UxglryYlrg+RGf4J2W:fyja+A3U4rg+C4Jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765411017, "uuid": "875701a7-1d6a-40b1-b124-41710c29826b", "value": 117425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765411017, "uuid": "3672c3b6-0c1d-4896-96b4-ef5c5bb0f120", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411017, "uuid": "3d4ec4d5-b4ea-423d-8d31-73aee7b2d3f7", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3fb3be1-d577-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765337054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765337054, "uuid": "d3475b9c-0d6d-4a92-99b3-2de332c90f94", "comment": "Malware payload", "value": "d5725519d9e66bc590ac54c11d1d90e5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765337054, "uuid": "414d621c-2e26-45fb-849c-6ca3d516ecea", "comment": "Malware payload", "value": "e38362aca79b16d588174e64a33cc688504c845d882624243fde90abd578bd7d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765337054, "uuid": "ba087d7d-995e-4142-b223-88e3b76b4e41", "comment": "Malware payload", "value": "446bb6ba79c699c1f76cfa1624805af863502bee", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765337054, "uuid": "8aa1f487-2c63-4bdb-8e5a-e859c25e155a", "comment": "Malware payload", "value": "05b969e083a3afed830a339a64c7eb01a9ae3f7747efc3e7a7d33a1815e78f3bd861d8ff003b7cbc26c15dbb015f4d2f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765337054, "uuid": "1f8dfbc0-af4a-4380-a92a-583c3b21fdb7", "value": "T16BA3E1F263177CD98F5FE419DA918A3873932AB246B0B4FA17171E8C133886DB63481D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765337054, "uuid": "e5dfb28b-d05d-42a4-9461-09c1eac8ca64", "value": "3072:RmOztFDUsh5IGmpmhF4hyJGPTIyV5w72oD0rUco+:kOztph5fmpWwyJGkzGrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765337054, "uuid": "ad99ca28-40e0-483b-ac8f-bddb9753fc5b", "value": 102091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765337054, "uuid": "d6aebfcf-d597-446c-a48b-2e2f22d854af", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765337054, "uuid": "6b8781ad-6125-4646-9eb9-33848412c769", "value": "gfdsgsdfhfsd_ghsfdgsfdgsdfg.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8292ca9-d61c-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1765407982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407982, "uuid": "630caeeb-f88a-41e8-aa91-5810495d23fe", "comment": "Malware payload (RustyStealer)", "value": "0503b26386d37b0f0d323b767d478dc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407982, "uuid": "b52ba074-ea33-4947-8e8c-07a06cd03ca7", "comment": "Malware payload (RustyStealer)", "value": "e4e09416c63536c975a88d1a43281948b69d52e7cb56febf15df23b9dd2fa7a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407982, "uuid": "3ebe73fe-06c5-4f65-8b99-6e5c14e3b261", "comment": "Malware payload (RustyStealer)", "value": "a3023ce7d0dc84c4d34c34f57f0d1e2fba53b9a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765407982, "uuid": "a1f18b0b-2a26-461c-a8a9-a3b30b5d2d1b", "comment": "Malware payload (RustyStealer)", "value": "31b20d4c5db8d4572ed68ca1763333ac388752570b0cde6bcfcd54179032d640b888bd2110415b9279aca79516a89159", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407982, "uuid": "5cb9be58-8c24-4e8a-aae2-dd410f157015", "value": "T16CC58D12B5A819BDDE9BE778869E5335BB783C850233EEBB0635D6301D12A979F1C304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407982, "uuid": "fb5df8fd-47b3-4abe-abdb-41d37c862f60", "value": "5449932bd64c0be4f13867fb3067b103", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407982, "uuid": "be109040-041f-4b37-8fc9-13874b4e61a6", "value": "49152:lqBvxzFrmDli2Plk2cSNF1AmiAi8FRLoIxJSIM8Pt:lqBvlFykHIAAnRLtM8Pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765407982, "uuid": "034fe238-3088-4ca4-a703-223be2fdf7b3", "value": 2611645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765407982, "uuid": "2dda3202-d279-49cd-98d1-40674c6f0f32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765407982, "uuid": "7f30129c-4b57-4bcc-9fe1-8bc8cbaffe72", "value": "windows_implant.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35b319d-d61f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765409262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409262, "uuid": "ce3dbb6b-75f6-44cb-be17-480a32226a4d", "comment": "Malware payload", "value": "4b47f9e3006465216e4c2978ce8fc526", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409262, "uuid": "c4e07e5d-ffe2-4b0e-bef5-1ea0f1c22035", "comment": "Malware payload", "value": "e5298272185479e31eb34bc5501987e8a4490965c2e1aaddc8f8f6b6d74976ae", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409262, "uuid": "7aeb8d24-9cf1-453a-8872-16d8de4546b7", "comment": "Malware payload", "value": "4b471007ce7c1ac8ef7b34afd8749defc23746af", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765409262, "uuid": "d448777a-2b89-49e3-a613-7a05f0f57135", "comment": "Malware payload", "value": "a51ecf56271a6c8b638d9fd0689d8eb5e995b0b93904eae7b618e6c9612fc631e41fd8559efeb4f0a5faf4fe5823dc88", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765409262, "uuid": "3305a227-2d09-4c94-9c80-2884d57c1844", "value": "T15EB30277711493D5F2F8B7976AA6720D29C12DC34ADADAE42997C38090177A204ECFCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765409262, "uuid": "b10d16df-1daf-4141-8d03-4dbac6f586ea", "value": "1536:pBAmdS2ygGN73Qbz/6rVqeuqM5+Uy5Yckfq+mjmkuzmEBipV+i+7y4Zom5zmhYwL:wRJNbmi4vUUM1GqBSHmEB8+u4ZopdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765409262, "uuid": "3f719aa5-f68b-44e1-bdd1-d4536a3ebf2f", "value": 112859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765409262, "uuid": "1e6f7ec1-a4e3-4e65-be22-8cbab6371aab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765409262, "uuid": "ae80c1f2-fbd0-458b-a62a-e5fcef83e100", "value": "Offerta_NasalviA_09-12-25.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68a8a6cb-d5fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765394910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765394910, "uuid": "db831c3c-7328-4307-9a40-48349b252c7e", "comment": "Malware payload", "value": "9ebe4840f422937f255293d6a7384067", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765394910, "uuid": "109381c4-78ee-4a20-a5ea-d490ec7feff6", "comment": "Malware payload", "value": "e60e8a3c26554d6e7f4f04ed27a7be41f458ea2b8ec3b606e90c334c6a6b6a28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765394910, "uuid": "6e4c850e-78ee-4822-b137-11588fcfdc6d", "comment": "Malware payload", "value": "4722ea2935b5f333cd929ef4ae8e7c1bb2c5e3df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765394910, "uuid": "7c47f2bd-7991-4adb-9cb3-6fbe6947bcc7", "comment": "Malware payload", "value": "45039cdde70f81cb71a4948d3469b4aeedef641022092bf6d522b9e1d96e4e1e638e60b602489e9fa911054b3572fe6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765394910, "uuid": "f4881b52-7cdb-45c7-8a89-3d2343b6188d", "value": "T1F6272322BBA1C877C46923389C7B9BEC2B207F115D18558737F47E8E2E7A7403C1959A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765394910, "uuid": "e46919b1-24d3-4e37-8bcb-a9da0d1383a5", "value": "6dca972567276861aed011a4d7c495de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765394910, "uuid": "d5743998-139c-4a0c-8912-50ef885d7bd1", "value": "49152:ykimFoKaU6Gppayos/OQWFeA9b/ZHsWPWYiYyZ7NOk6ne00ZfILhv7+0yGtpJit5:ym2KauLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765394910, "uuid": "a4147c5c-bab8-40a6-aa57-3561fcef0d08", "value": 20929536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765394910, "uuid": "da95ff63-c15d-4463-9857-9b07c3a8e546", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765394910, "uuid": "15a47a92-cec8-4f94-b99f-7b8fffd2eaa5", "value": "Comprobante_Facturacion_66418.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ff803c-d598-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1765350957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350957, "uuid": "077924a6-0bb2-471f-82dd-c3e9cc3ccc7a", "comment": "Malware payload (PureLogsStealer)", "value": "5ace12cc32079f63a50a49957a9523ee", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350957, "uuid": "27048d09-e09c-49f8-83a5-c2a15ab2bcc0", "comment": "Malware payload (PureLogsStealer)", "value": "e63b4ba4acab9a848dfcda1b953793aee8286e924a58e7ae50c80df7264d31a3", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350957, "uuid": "3ea4789e-0feb-4f24-8390-cb2497c25e50", "comment": "Malware payload (PureLogsStealer)", "value": "436a18f960109564206204f354fc2f696bac532c", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350957, "uuid": "73e755f1-e9d3-44ba-ab9d-3045e3d92b07", "comment": "Malware payload (PureLogsStealer)", "value": "10447553732ebd1de5a72dce5fc444cf6e8677941c800fbdf8b7fba50d4a99065b74c94c3c672483467e0ad3cb0b0910", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350957, "uuid": "7065fa72-2b73-471c-a923-c698a4a29498", "value": "T1B235332260D14D2BD21779B768B3FB751BBB0BF36B77C322612EE90854F149E144CA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350957, "uuid": "b1000fba-3ce4-48c0-8db3-02b2d9485a8f", "value": "24576:sYGaKseflhY6XFJKNeP5Ea4M5xjBYRG3Xfwmd5+9nczGfWEm+jLZi/82dw0V/S:lDClnEaZTNYRGHfz5+mqfWEzjvW3VK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350957, "uuid": "31bebc96-696d-46c2-ae4e-480cb28a1766", "value": 1094970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350957, "uuid": "bbbf2a1e-d032-4137-9ebd-171f70b72478", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350957, "uuid": "719597b5-1da3-4804-922b-1974af679551", "value": "PO-07162209904.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd857887-d610-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765402810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765402810, "uuid": "882908d0-c9b9-45a0-83e8-db2da94749fe", "comment": "Malware payload (XWorm)", "value": "11aea671dcc0c999b2f40239cacd5f19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765402810, "uuid": "6e5e244b-9d66-4d8d-bcc6-21e612a14493", "comment": "Malware payload (XWorm)", "value": "e76b4f6b4666de9d6306d46321fc517fabfaf33db0383caece052170a3d90d05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765402810, "uuid": "85185555-7a1c-4657-841d-73cf52937417", "comment": "Malware payload (XWorm)", "value": "7d3d9f78634124e72eaece9d4e56981c407a525d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765402810, "uuid": "7f4bdeed-7e44-4820-b369-2ab9682e3e8b", "comment": "Malware payload (XWorm)", "value": "9bd6effedaf319658df670d30e164d3d3b5dd9c120d83e93a57b38ad18bb8cdef215429676766ffcaa777b14492257b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765402810, "uuid": "341dee94-0844-4c25-8b07-25683cd0d746", "value": "T125F3024930E0FAF1DE674F33D196E530006AD52CEAB27A7B2366362651C1DCA8C27CD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765402810, "uuid": "a3c7ad5e-9b36-4c20-9a69-934375a45cc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765402810, "uuid": "bf4adc19-1ed2-457f-99da-fcc5753aa541", "value": "3072:bLWb1b/Em7BizUOAvnFwj7XLMHJM3xc4oSw4Vpldi6vkpvXmSy:bibP1OW6jbLMpAxcKxdimWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765402810, "uuid": "72f4375b-e36c-4ea4-8a7d-ede5e73e597f", "value": 166912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765402810, "uuid": "8ae0e070-277b-4182-a0c6-37a83e2bbafb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765402810, "uuid": "d7dc327d-a7ed-46b8-9262-14931beaa83e", "value": "11aea671dcc0c999b2f40239cacd5f19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642257e4-d605-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765397909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397909, "uuid": "69932d74-8c40-41e0-8524-69917d499275", "comment": "Malware payload (Mirai)", "value": "fa03d431caccf6ee97c535bce286531a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397909, "uuid": "3a34b4ae-a02d-40eb-a400-eba35d68596e", "comment": "Malware payload (Mirai)", "value": "e7fc58702e5d3c20e362541f7b42d0e70c5cda840b33b358bee32d0aac623e17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397909, "uuid": "a22c5d07-349d-4428-a9d6-8173ee32c787", "comment": "Malware payload (Mirai)", "value": "17dfe332a37a4fe28c04eb558e33969ad39138fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397909, "uuid": "2184d312-bf40-4acb-b69f-c5c973ee3a59", "comment": "Malware payload (Mirai)", "value": "345c2f69a06190eeb7767b7bfbbb4db2ca0e247877f4134c813fa8fcd862f19fa922c4c98257e39cfcec8c17bcf0ca47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397909, "uuid": "09908f66-38ce-4f04-bdcb-749a59afc91c", "value": "T1D503E17254FA4B855AED057E8BFE3F87383017158D89436223C9E2BA85C2F143E05BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397909, "uuid": "cb8db609-ca26-4a28-9d3c-316d804236c2", "value": "768:dk8SXZQoydUh9jhdWvkhfyq4jwgI9R0A1B/i3eTtWlYQ70zS6mPBxunbcuyD7UHc:pSPy0dhdma07uo7GbWBxunouy8Hyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397909, "uuid": "82941932-19ed-4c79-afd9-422ceeef1290", "value": 40544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397909, "uuid": "09d8e10d-dfb3-4efb-b54e-1dd75e11d487", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397909, "uuid": "df5a5fee-8a85-42c3-a76a-1a28acadc288", "value": "Labelloperc80.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f48f351-d5f6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765391404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391404, "uuid": "037c1536-16d6-4e57-80b9-529558becc1b", "comment": "Malware payload", "value": "023b1a1167c9be6ebf0ba5a21a008c28", "object_relation": "md5", "Tag": [ { "name": "jmpbowl-space", "colour": "#8E4207", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391404, "uuid": "a1090cf8-d82b-4a66-9e8d-6578f679b032", "comment": "Malware payload", "value": "e81ab165e65d11f4c5188a27d29ee54a5688b42da38e878c0b7b76638b1f82e5", "object_relation": "sha256", "Tag": [ { "name": "jmpbowl-space", "colour": "#8E4207", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391404, "uuid": "89482c29-6b91-4141-95c0-ebeb1dcca88d", "comment": "Malware payload", "value": "befe03db54d61e7956650cdee080b0cfa6e6f8b0", "object_relation": "sha1", "Tag": [ { "name": "jmpbowl-space", "colour": "#8E4207", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391404, "uuid": "5e431332-2fe5-49b6-890c-f0411fc7f174", "comment": "Malware payload", "value": "fee458262fd53337a2c9c753ebbf0f000c1a6c1eec080004b0b70b4f29310ba81c6a3cfc8b752f0bbaf9ac0d165354f0", "object_relation": "sha3-384", "Tag": [ { "name": "jmpbowl-space", "colour": "#8E4207", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765391404, "uuid": "b1ce02f1-7cc6-40fe-8f4a-c6da7d4cecbc", "value": "T1B61188636FFF089FF1620DB111DC055D8B809671464F63671461B02AD0E7C8854011FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765391404, "uuid": "48312e03-d4b4-4fd0-b21d-835cdf655a2c", "value": "24:906cOWn5B5oREtVaEtOY/g7dW0/BsUi2RcOe+5n:906XWquCEE7AYFiuXeWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765391404, "uuid": "03f924cd-2c84-427e-82a6-c967c6f8a927", "value": 936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765391404, "uuid": "37ac28c9-f3ce-4f4a-a1a5-922de5575294", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765391404, "uuid": "76810786-d4b6-4168-a800-279a7455c702", "value": "691718fedbe6d30904ebb786c8740f725f1b7ef4d980f748bcd9de119160e4d2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c564366-d5c8-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1765371589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371589, "uuid": "0b280d7d-3768-4622-9b41-8564b1989903", "comment": "Malware payload (RemcosRAT)", "value": "bf1e2a8988fdf8e71eefb7ef4a3e876f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371589, "uuid": "a8386cc5-5bde-4b28-9fa2-7f4d9821f0a4", "comment": "Malware payload (RemcosRAT)", "value": "e8551dd43a0e961e75bfe1ee46bab0c822f181d901da89744e745dc1e66b507c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371589, "uuid": "f76b7300-938c-4040-995d-ad1dda609da3", "comment": "Malware payload (RemcosRAT)", "value": "aea4f76661f96aec50acaef5f6b84fe322ae0ca9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765371589, "uuid": "4244e4a2-de29-4ecc-aea9-353dba879139", "comment": "Malware payload (RemcosRAT)", "value": "c832780ac489933a6db7efe2af622cec4a53eb31d1245403d1fac2a2ae2776bbc591cdab9575d62805049b18fdc549d8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371589, "uuid": "2cc7afee-1252-4c94-a752-70e1fbb0daff", "value": "T1E146B55D66E96027D801BAFC5F2D57A1AF4A1D1B2AD6380E33753ECB327CC849422F64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371589, "uuid": "9f716a0b-aac2-4dd4-9f45-a1db37a1fff6", "value": "49152:Q33v/4rKl3FvKW5FgyZzn/xgX+sBMQn8xEyhymOCEQy8bEnqXL8PYtsAYpG:SFvKW5Fzt/xgusBMQUEKyKm8LOosdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765371589, "uuid": "ec2fe5d8-980e-4e1d-8e41-7e8e32721324", "value": 5774791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765371589, "uuid": "8c209d2e-211e-496f-bc03-ea2c4c9c9a80", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765371589, "uuid": "64bd46a7-9170-478b-9115-860a37e9b919", "value": "Avviso di Pagamento Banca_MPS.pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c671cc-d605-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765397910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397910, "uuid": "f57b5dab-daee-494d-90e2-51441ecd148a", "comment": "Malware payload (Mirai)", "value": "fdd416a130396f3f69e4acc44ba9abd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397910, "uuid": "919e4fee-8996-4728-a2ff-37e3a541f099", "comment": "Malware payload (Mirai)", "value": "e89efbbf11161b974c87724f649921e6c7a883f967cb96fc21ecb8530aa5832c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397910, "uuid": "921a465e-867f-4a2d-a06b-bcd8a14d088f", "comment": "Malware payload (Mirai)", "value": "3ce9480f635eb3cee06fb1ff520976a323e58176", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397910, "uuid": "74d653de-9cf8-4b44-9e9e-ea8b6119698f", "comment": "Malware payload (Mirai)", "value": "9fa06c60b11ce47bb0d116909a40fe1e6fcc8f85eec05ea04653beab00aa1192c4f985cefcfe82015ef008294fd1b719", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397910, "uuid": "4add3b03-c1a6-4312-b06c-9b9ccad82df9", "value": "T1D8B2CFA416B4E270C5614839E46B8AC37AE712F0B8FD213D22680DE93692D5471BEFD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397910, "uuid": "2bb1da43-f209-492f-a070-aa3cbe404358", "value": "384:cDEC/BlbaF5EsH3YjiAXIKvXBSrBMkBldw1ukRlSdmqhymdGUop5hVIV:WN/BlbI5EsXi/mrBMyld72lSvs3UozA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397910, "uuid": "73c3e76a-5e63-4153-b07d-a054acd24a84", "value": 24032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397910, "uuid": "cfe14c8d-94d0-4ff3-b90c-b54664e4c6cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397910, "uuid": "fc16b1a4-7a2e-485a-bcba-723b9c33b7f4", "value": "Labelloperc80.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5bf953c-d623-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765411011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411011, "uuid": "029abc84-5109-4bbd-b8fb-7760bdb79246", "comment": "Malware payload", "value": "0e9f543ef49d981df7a7e4874048e284", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411011, "uuid": "f7856506-d0b5-47c3-9c0f-87896f4611bd", "comment": "Malware payload", "value": "e8bb8d83dc62c7b4830d5a8a797175435f6182a9afad0f33d4ef780a8def60f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411011, "uuid": "93d4d3e9-d237-43c8-aa98-511f9edd6e19", "comment": "Malware payload", "value": "4c537c17f269d895e6b85aaf2ec35fdbc13c841a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411011, "uuid": "fce1c882-4bff-485f-9e5a-c63657fc0e19", "comment": "Malware payload", "value": "ca644bb2a547c2428b57d200d1d23d55004834f4bc8c15343b690847a969d97e871e95b132f127a55d5559bf6a892cc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411011, "uuid": "d4d58893-d8ea-4690-8cab-011f1ded3361", "value": "T10283184794A25FB7D0466AB92DB745B0075BAE510F4F1A8B726CB6B4033F8CDB40E724", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411011, "uuid": "0cada26e-2767-4739-9a13-1f6db4baf82a", "value": "1536:xJqbrLmfCOmVWwflPHaNDU1GGSMKZ5DDbP2cuXrYCKA35HUJa:SbXnlWS9H7STZVP2cQY5Ax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765411011, "uuid": "f99f63c4-3900-4e45-acbc-a05edacb3b0a", "value": 82844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765411011, "uuid": "a506f0c9-9809-4086-98d8-50efe700487e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411011, "uuid": "4d8b5b43-62bf-4029-b797-608edbe3d33f", "value": "openssh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e5d731-d5b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765363575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363575, "uuid": "e6f4bca5-c610-453a-a41d-7df568f650ca", "comment": "Malware payload (Mirai)", "value": "5a187060249a1b00c4ee3d4ebb10105e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363575, "uuid": "352b9cb4-db2e-46a9-a3d6-93f17b69f649", "comment": "Malware payload (Mirai)", "value": "e9b58b2dad6fb776f552531315be6262e62c58e9892e4b62d82a1ee0dbe3d815", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363575, "uuid": "ac150937-1807-484c-99c2-7214f1337bf6", "comment": "Malware payload (Mirai)", "value": "84ca63d76c45d610297f15ba4865aa1afa7e30b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765363575, "uuid": "c7a05196-63e4-4a67-b346-a7c84b7d70bc", "comment": "Malware payload (Mirai)", "value": "3bc2b438e796af1c02e0613c513943ae3c255505780cfaadc271aee77c882c503f02ec766aa76fcdb4e13375faa98083", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363575, "uuid": "b72d09d4-d354-4275-97be-d5f7e9bfed14", "value": "T10E246C85FA83E2F5D8860574505BEF760E72E6367039DE86E7ADD636EC01201C11F6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363575, "uuid": "83f3b771-5b36-45f8-a320-37aa7aa99085", "value": "6144:f1NP+ITm798/wcmt1Mtd0o10EOM3FyB/r/lWPT:f1NGITm795Mtd0o106", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765363575, "uuid": "c2dc4d5c-faf1-4065-ad37-d982d6140897", "value": 219968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765363575, "uuid": "233d65a4-e0ad-4be5-b97c-ecc7924b4ec0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765363575, "uuid": "ec1f1fcd-f10b-403d-8f28-94ab42059a38", "value": "ecco.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5d2fad-d5a0-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765354575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354575, "uuid": "b4ea2ebf-0400-4403-8276-7ed0405b1796", "comment": "Malware payload (AgentTesla)", "value": "60e6cd2f8be392d293af69658648b76a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354575, "uuid": "c6b90397-095b-4492-b871-f0148dd25b0c", "comment": "Malware payload (AgentTesla)", "value": "ea8167c61681db5a133270595a261ea3f0a8f9f2cdb2b8b1b31b9911dcd601ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354575, "uuid": "8b21d3e8-9c9a-4b52-95e8-2765e302c726", "comment": "Malware payload (AgentTesla)", "value": "83b3b84bfc7f630d6fe78a0083ca6b95519c38f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354575, "uuid": "c46f0b57-9bdf-47f5-952c-e50b7f2d1c87", "comment": "Malware payload (AgentTesla)", "value": "d90e22f71afe12f4973d8d71f48f3933f6bb1d0edac15a72f11cccda7159bc5ff744ff2ab309d7d9dcbbd801d4a061b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354575, "uuid": "a18b0204-6996-488f-979e-65c2ada149ae", "value": "T15945BF027391D062FFAB92334B56F6115BBC79260123A62F13981DBAFD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354575, "uuid": "845b7462-f371-45e9-87a3-bd1267ade075", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354575, "uuid": "ae971c44-a2ed-4077-b1c2-ee03686b66da", "value": "24576:L5EmXFtKaL4/oFe5T9yyXYfP1ijXda0NXIHvrT74JPT:LPVt/LZeJbInQRa0BIXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765354575, "uuid": "78266f30-f85b-4d59-8b40-c7794cc72b9f", "value": 1242624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765354575, "uuid": "b74f49bf-d7c8-4e9c-be55-6c2f21234f7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354575, "uuid": "f3e59764-6af3-4483-8fb9-6c25826ad858", "value": "Sunprint order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476f571e-d5b1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765361783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765361783, "uuid": "e6e866fa-ee84-4a4f-aad0-72272d96dbbf", "comment": "Malware payload", "value": "e2b28de29d553f50637635087b960b48", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765361783, "uuid": "b87942d7-da2b-4242-a686-6b5dfb395a45", "comment": "Malware payload", "value": "ea9685fd76cd94eb322a9dfb31519a60c8e0f67b2ff7b200381684c6c9301c17", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765361783, "uuid": "d9968e2a-541a-4bfe-8492-79d737fc40fa", "comment": "Malware payload", "value": "6b1ed2952026561835b2837b9a57ee52b338af64", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765361783, "uuid": "3d00937d-6478-4fa3-b0ce-e0f209497f45", "comment": "Malware payload", "value": "4c27860015d8a2141e62e9ff13f026507c95c8ce1470f0fcdc95268d7a9ad7854c95c3b0327e4fa91b345493040a296c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765361783, "uuid": "615752ba-f5e8-43d4-9946-140858e73a00", "value": "T10BD012DE1060A8408405AC7E713254E6A523D2DA259B0FF5EEDD457D8458A5CB025F08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765361783, "uuid": "f5acfecd-6763-40d8-8d3d-a6c641950264", "value": "3:TKH4vGBwV6FRSXQX4gHKiFDKzSHOFSOFg6FrjXQX4gHKSSH7FzWMqFj6FqDCo:hD6FRSXQIgq8xWFg6FrjXQIgq9kaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765361783, "uuid": "301a39d7-1ad0-433b-8cda-0eea3ddaefa5", "value": 199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765361783, "uuid": "73ba0ed0-8e89-4ba7-9904-3ac109e2da02", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765361783, "uuid": "10d75a1d-8767-4198-8089-ee778c4fdcf4", "value": "lnksys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9e460e-d597-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765350918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350918, "uuid": "a42583c4-8d54-4c0f-aab9-01cde382672f", "comment": "Malware payload", "value": "07a394474f53ebe6ae517a71598c582d", "object_relation": "md5", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350918, "uuid": "4e34348a-bd14-41c9-9795-e7d7a1238b6a", "comment": "Malware payload", "value": "eb0c01c312d770c976391c812d04745f84a4d0475931052fe560f55234caaeec", "object_relation": "sha256", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350918, "uuid": "134898e4-8f16-4e1a-a4e9-88acbdd9c551", "comment": "Malware payload", "value": "ae221d3033a3e9091b729f2795716d7c6838ffda", "object_relation": "sha1", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350918, "uuid": "2c4d7030-92f1-4d63-9e6e-84eed5e6157a", "comment": "Malware payload", "value": "57163f2e2245631493ca132199484e7aad3ecd739119848fc3d30c123f8dbb1e63bbb6da41d5ca2a63d0d1bfc798ff01", "object_relation": "sha3-384", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350918, "uuid": "018031d7-47cb-4818-8a4a-c0e737daf2fc", "value": "T188F2F156FAF56C26FD0E46340C514936334058F696E5763BC49A0BFA062104296FBEF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350918, "uuid": "746d26bf-193f-46a0-9b5e-fd27125d93bd", "value": "768:2X4g73wYIV9SoU+1zHgNQx4FXO3cMEtLmiacJn3OdVdBGzS81esu:a57gYkZU+Rgu4w3cztLVacJ+Vhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350918, "uuid": "8595f146-a107-4503-9397-203cda1cee85", "value": 35046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350918, "uuid": "08479b78-7420-4765-a9c7-6fd412042f25", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350918, "uuid": "57f090d5-07a0-406b-8750-da2259a0afc2", "value": "eb0c01c312d770c976391c812d04745f84a4d0475931052fe560f55234caaeec.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa4bc2f-d5d6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765377948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765377948, "uuid": "9cff2abf-d3b1-45eb-b919-ae5bf306bdc3", "comment": "Malware payload", "value": "36d3d32d69d5745939583d12f5a28445", "object_relation": "md5", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false }, { "name": "MaksStealer", "colour": "#D16C03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765377948, "uuid": "c3c10e7a-816b-4836-bde4-71427bc55a1e", "comment": "Malware payload", "value": "ec1a4674c22e88038a5dc21bcf8e9b7a1718f00df711a6cd13ba3eb021017a7d", "object_relation": "sha256", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false }, { "name": "MaksStealer", "colour": "#D16C03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765377948, "uuid": "8e2d3f8f-2d3d-4ae2-9788-613ea2d17d60", "comment": "Malware payload", "value": "1ed261233dbb9484a6589b420bcb7b5b588b115b", "object_relation": "sha1", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false }, { "name": "MaksStealer", "colour": "#D16C03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765377948, "uuid": "e3dc1e80-2040-41ed-97ed-7b5482df70c5", "comment": "Malware payload", "value": "4a77eca47b52f01a17eac833e1fe4e6787a5f09714adcf750c4bdb58af2335213e0ffc7081264c343e013cf140a2b695", "object_relation": "sha3-384", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false }, { "name": "MaksStealer", "colour": "#D16C03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765377948, "uuid": "dfdef460-547b-4fc2-8040-f3f12be866d5", "value": "T1C3F22A16676F01E8D176827CC4871E46E7B2BC4A47A253CF13A1926E1F323D07D3BA92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765377948, "uuid": "edf455bf-7780-45a0-af93-d570ea14dabf", "value": "fc5e69aff961b48df61be5c723083926", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765377948, "uuid": "a4b7ad42-cc01-4e07-b25a-48e846a266e7", "value": "768:MEXRIrKClhXeN7J+MiF6wJSNluMMfzsygsx:TBGKClhBUegFMfzcsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765377948, "uuid": "5e0cfc73-aaf4-4456-8567-5474d2817d8d", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765377948, "uuid": "5416ec73-14c4-438c-bc27-949cf0bc8aae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765377948, "uuid": "b634c945-46e6-4dd3-9ebb-752db8ce77f3", "value": "moddll1478999704550705476.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4768cb0f-d61d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765408168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408168, "uuid": "631217cb-3a25-454b-8678-7e4c04854324", "comment": "Malware payload (Mirai)", "value": "27b94e9ccf949a5f751979734590de68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408168, "uuid": "f32dc177-5bda-458d-9177-119d7889df11", "comment": "Malware payload (Mirai)", "value": "ecb2da020f1d88151b186208d3cf0bb2d11bc581baad28a64aa18e213f5114e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408168, "uuid": "7f24dfb6-f81d-4d7d-ba9e-eb4d632dfbdc", "comment": "Malware payload (Mirai)", "value": "6e6f9a6e059243a9ac2ec55de0a3d517befac3f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408168, "uuid": "1a9da6bb-a9bb-4eb6-a3a2-6c355bc53896", "comment": "Malware payload (Mirai)", "value": "7e831ac41de03ee95c830c522b88ac74c56e55dfe9032c041927ced03e5b57695280ec4de2a3e4736442b63d9d76f026", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408168, "uuid": "de375d60-6407-4953-ad08-6f30b1410e26", "value": "T1B083D909BB654FF7DC6FCD3B45BD5B04288C960A22A87B757930D418F25B24F1AE38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408168, "uuid": "b22ed013-b250-45ff-8775-9024c2941387", "value": "1536:lYJMCHimmjccThGLD7Y6rQDLgv4GsJFZYZVT3bsRO:l8himycPzKsVT3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765408168, "uuid": "b650245f-24ea-4f29-ab70-5d2cf43aa444", "value": 88396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765408168, "uuid": "1e7370fb-b32e-46a8-80ef-b58554f71225", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408168, "uuid": "bd3780ed-a8c3-468d-9598-c1310597d000", "value": "jklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc126277-d5dd-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1765380876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380876, "uuid": "ec0e17f1-5ce5-4197-a1d8-b8acc082bee8", "comment": "Malware payload (CoinMiner)", "value": "8ea1846c9bb78f058941b4c5aa52671e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380876, "uuid": "4506d62e-eb15-4ed4-8c99-fc11cea73996", "comment": "Malware payload (CoinMiner)", "value": "eccb81440eb3aa2940c53c582bb0f6156ac0b697bf1312b6e7b0d145331d36dc", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380876, "uuid": "862da792-d327-43ac-9724-e512e3cde41d", "comment": "Malware payload (CoinMiner)", "value": "fa90a5775f7ccd42687d95bbf386813e6d0ee35c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765380876, "uuid": "8069cc16-b162-4a30-8b3f-610f2f2ca98d", "comment": "Malware payload (CoinMiner)", "value": "22735761be2b75a96018ffaae55c640683529e4079f91522d4112291dce5e21da44b23f23ff1898015c734cb0a8eba75", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380876, "uuid": "5fd1e904-9283-41a2-bc5c-46c39c789c30", "value": "T112314212E6E054F46E4F4178ADAA3300383A604B9D49FB5530FC21615FF85134737EB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380876, "uuid": "12bf818b-a222-43b3-a975-77229573f421", "value": "48:rycTBQfio8SqH3g6uCO8R+nTNbt8S8gEapvnL:QqHQ68MwT1t8SdPpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765380876, "uuid": "34919cc9-2f18-44a8-9f60-27f49ad1d4f2", "value": 1621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765380876, "uuid": "df6aa5f3-0dd5-471c-8ae2-99794978fc56", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765380876, "uuid": "b91ff4a8-8af8-41fc-bb23-bdd301fac702", "value": "sex.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b786a5-d5a0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765354510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354510, "uuid": "66a6c91c-c8ca-493b-9610-63a9487a962e", "comment": "Malware payload", "value": "4e6b05463fb7831deaf5dfb47bf22194", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354510, "uuid": "c7a0ece4-f0a0-4310-9ffd-422e12e68f65", "comment": "Malware payload", "value": "ed04963fb0be269ce89ce73ac5cd91a5c4b06e3999cfbda45e9d43e8beb63628", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354510, "uuid": "a46479d8-316c-4462-8c52-6d2423d3d67d", "comment": "Malware payload", "value": "a2db242a6e83360178269a64fccc9bacb9f3d892", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354510, "uuid": "6d64bd1d-2703-40d1-835c-0907113914f6", "comment": "Malware payload", "value": "94bad5e8f4ec3cdc3d976d57e2cf59f3c4ff72617960cd849ba16f3a2d8c4cf1cc4c2c370f71499abbcaa6ee2d45db0e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354510, "uuid": "a8527ea7-5792-4fff-8638-f1320cb9751f", "value": "T1C5A1E3CD395033B3CE949D3DF2B5992B6082D0D081258FA4E659B0FD76ABD48F610FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354510, "uuid": "285a4d7f-fd6c-4fb4-87e6-af52dec6840b", "value": "96:1xBo8gwscOgXCg1wAMIQgeMXp8SXAFfYfu:nfXCg1wAMITeMXp7XAFfYfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765354510, "uuid": "60bdd95a-a172-4d12-bf18-a854b8effab8", "value": 4954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765354510, "uuid": "fe767859-2479-4f0d-8ac7-3d72e08d3375", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354510, "uuid": "20b3d0f7-2a7a-4393-8aca-d00744e3cc7f", "value": "e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a369ffe-d5ca-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765372552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765372552, "uuid": "1abcc9a4-6e42-42c0-9471-48b6d32f29bd", "comment": "Malware payload", "value": "658c4c121d942d940da15f4ec8d4f930", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765372552, "uuid": "373176f3-d386-4f4f-8cc9-e4e66827958e", "comment": "Malware payload", "value": "ed1aa2813bb7e717028acc6f58be015c70a42cef2f9061e84e883a4e6c30cd78", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765372552, "uuid": "b4096ad8-5f6d-4168-82f0-3575a5bf4feb", "comment": "Malware payload", "value": "2e91655e5b51880efffa3ca48920aeaf480f0f19", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765372552, "uuid": "3ddf0625-bab0-4550-a422-90ce2965845d", "comment": "Malware payload", "value": "0ed40c03c08611b5048ac2ca84d707373c7c6a010a5989b6eaa88870333910b307f7479e31dfc68908942850ab4cdd7c", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765372552, "uuid": "4ff38eca-e686-4ea5-8516-989dce346af2", "value": "T1589733BC4BA131C8FF43DA5D574CF4DAFAF5A381E125944A2C51CF86A088EE359B48B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765372552, "uuid": "9ce61e8a-528f-44ac-8833-e2f1dcc24723", "value": "786432:epYhcUkZGloUyfbl2lYLxsSCBf/8yl3W/1PdUa3fn4SY502I/F1oHuTNDEEHOHm:e2h8GSUyW20dWNPr2ePoHupQEim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765372552, "uuid": "71a37071-7c01-4b87-af99-eb71fa87fa36", "value": 43356856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765372552, "uuid": "e86f0831-816d-480f-abde-f790d4b6ad5b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765372552, "uuid": "8e354f24-a94b-4b94-a3ba-18b6ca069bcf", "value": "DungeonWarriorDemo.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4549555c-d61a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765406876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406876, "uuid": "a1f856c6-cdaf-4eab-9f07-47bfc8f31104", "comment": "Malware payload", "value": "f51b438e3d0a07c406c65b9979e577da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406876, "uuid": "96ab6f25-3563-4164-ac4f-e2456f110b8b", "comment": "Malware payload", "value": "ed304a0279737815048eae7f26e6ba1892a21b35cca30a6a1bd0372ffaa68ced", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406876, "uuid": "c61e9f63-aa79-430b-b789-60aef20c4019", "comment": "Malware payload", "value": "9bee00243de92d77cbd850e89520e203a833cd0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765406876, "uuid": "8fa9544b-6259-4dc7-90e8-cec030b4622f", "comment": "Malware payload", "value": "9078c1e1aacf8efaa6860be9c71f3f5ea9285cf4565f3a97b9d03985db05cb1e30b852e548c5610dd092b01e30e47a24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765406876, "uuid": "a4bacc00-38c3-47a0-838f-377708d2823e", "value": "T198235C41721C8943E1971EB07D3F2BE1E79A8EA021A4B287750FBA8D42B7D729507DDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765406876, "uuid": "44059188-29f4-4204-a1cd-eefc0547869a", "value": "768:DLoSnbm3BeNgh2xuhpPmNXmEnwKTdedwVT3bsRaf:HoSq3Bltp+0E5TodsT3bsRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765406876, "uuid": "34eb4299-6177-43cc-a755-42977b0171ae", "value": 46032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765406876, "uuid": "4de82aeb-2c64-43f8-945e-1004fd50bf38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765406876, "uuid": "df919015-56d1-4c8e-9fa5-b2f7c123f3fa", "value": "nabppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e70b7f2-d604-11f0-a129-42010a9c0007", "comment": "Malware payload (EternalRocks)", "timestamp": 1765397496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397496, "uuid": "76285f5e-d213-430a-a3b4-376ede956521", "comment": "Malware payload (EternalRocks)", "value": "be1a38232acbb1f5294d2d72f45a79a2", "object_relation": "md5", "Tag": [ { "name": "78-40-193-126", "colour": "#23F4EA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397496, "uuid": "646a80bc-f741-4ec5-a488-a98a7358486f", "comment": "Malware payload (EternalRocks)", "value": "edb7270ef47a630256e963b7b490fc2802ebb6fe99ac5a017d35300e107c331e", "object_relation": "sha256", "Tag": [ { "name": "78-40-193-126", "colour": "#23F4EA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397496, "uuid": "9d605a9a-fcd8-44d1-b08e-b8b7aaa06e6b", "comment": "Malware payload (EternalRocks)", "value": "54e4f96c00f1073fc18f7db7d6c3d6fe820d1a7d", "object_relation": "sha1", "Tag": [ { "name": "78-40-193-126", "colour": "#23F4EA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397496, "uuid": "a8057111-9ff7-41a5-9d73-53001248590c", "comment": "Malware payload (EternalRocks)", "value": "4b018e82a09d633bf32f01eb682f1c1188de4a82f43f2cdb03b158634e0a7b78b44e87d9bfec787724223ac5f0191337", "object_relation": "sha3-384", "Tag": [ { "name": "78-40-193-126", "colour": "#23F4EA", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397496, "uuid": "7077ae3a-7636-4192-bf01-3580b2523b5a", "value": "T130A67B10A8C86607FD7ADFBC999E72500F7AB5952901BB398F4149D93ED2B58C8039F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397496, "uuid": "6682f820-d7c6-4e59-9ef3-1f0e8ae793b5", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397496, "uuid": "20a6884a-6f01-4ebc-bdcb-06c930b9aae9", "value": "196608:u7ujFb57j4HBR8k1NmfXaSem6e2MfEdNWuP:Nv4Twf7ktr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397496, "uuid": "21478c00-ae63-45c1-87d7-ad5c7ff46b3e", "value": 9682944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397496, "uuid": "b9594daa-5439-47ee-89fa-83253963c012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397496, "uuid": "3fc34d65-a20a-438a-8086-790be47ffe0f", "value": "CrashRpt1403.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a599b157-d580-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765340895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765340895, "uuid": "b555df6e-f7c5-4a67-bd14-e4f732731fa3", "comment": "Malware payload (Mirai)", "value": "ec9278b3f3914728d36d086b56445b98", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-55182", "colour": "#999986", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765340895, "uuid": "e28b5bf9-ccc8-42d5-a3f7-edc363d39ffe", "comment": "Malware payload (Mirai)", "value": "ee2fe11a7f43aba14f37897b7c69e2c4b26eef20a8854a838353b59866ee4861", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-55182", "colour": "#999986", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765340895, "uuid": "d7a0d9fe-c61b-4fcd-90ae-87f97f43666f", "comment": "Malware payload (Mirai)", "value": "02389995e1ac4dc6bc356fa82b5ee01618ad0550", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-55182", "colour": "#999986", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765340895, "uuid": "3a297590-ad1b-4d37-ac15-c9d7333f2dd0", "comment": "Malware payload (Mirai)", "value": "db0f2c038c4810ea79eb3fb9fbae6281b1d2e3c95694adb6e8e2d6aca93890f2351255279fbc6a67f102fd6db7ba414b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-55182", "colour": "#999986", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765340895, "uuid": "e23adf06-8afc-46f2-a684-d882ab5726e9", "value": "T135632913F58584FDC047C274AB6E9136CA71BDAD42387A6E1B94FF612E36E321A1CB41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765340895, "uuid": "17665d99-1856-4c65-8dad-a346d78d2436", "value": "1536:Y4YBIsukJaNAfEm8oALbvl921YpUBzgsZJL7epZr:YbBBu0aNAf+oA3vlUBMSYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765340895, "uuid": "af64856e-e191-466c-82b1-61244d2669c9", "value": 69648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765340895, "uuid": "806b9870-392d-4db9-876c-bfdb6fd51b73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765340895, "uuid": "2754a87a-8270-4d57-9385-3eeb29bf9eb7", "value": "pew63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040cb212-d5e7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765384863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765384863, "uuid": "118bca3f-b10a-4ffd-87f8-a59a68248adc", "comment": "Malware payload", "value": "611fa2f3a4faf58689cc249e883769ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765384863, "uuid": "48916dae-db95-4aa3-9dc8-49ed0c7a912c", "comment": "Malware payload", "value": "ee55833c7a3eb547c02c0000d41b9ae24846f17d52224501f0caaee55141a03b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765384863, "uuid": "fd9069e3-87d5-426a-89c4-d4fdac8a13e2", "comment": "Malware payload", "value": "654f16567d8c5f362e0afea086c72832fdffc820", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765384863, "uuid": "16b7fbd8-bc66-4bcc-ba3e-922f89e6b457", "comment": "Malware payload", "value": "7f2128ea278a6641b906e1925538cb935b01d596a7a6f4099dec74779a47ede27b518ab15921cc699abee9cff88f588e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765384863, "uuid": "9262ad8b-2d6e-4fa0-9c67-f1b7193e5e04", "value": "T18916335A44913569BA113D31E32BFAD05A263473AAE270B44C0BC9E58377DE3C6E3B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765384863, "uuid": "97e07d97-2452-4452-9a80-b0a0e7792434", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765384863, "uuid": "1157dafc-651a-4922-848e-e8e487acb083", "value": "98304:9pyd3KuO+HhttcPHWasq9EBrdydAqDJu6iqtQ1N8U6q2+Q92sQQ159kCCUdJRTIV:9pq3j33QWyEBQdAUJuOa1yUV2F92sv1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765384863, "uuid": "cbaa577c-6778-41a9-879a-b9976163b7ba", "value": 4134912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765384863, "uuid": "37c62fad-ba8e-4a18-9633-21d07c356e9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765384863, "uuid": "4d8505e4-84e9-426d-880c-6bbc9395f24c", "value": "SecuriteInfo.com.Trojan.Siggen31.32766.20965.27162", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f850caa0-d597-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350913, "uuid": "16bc226d-9414-4c29-9216-a292ee6ef10d", "comment": "Malware payload (MaksRAT)", "value": "eb39c2112694920ff2071890eafa7218", "object_relation": "md5", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350913, "uuid": "d9452653-4ce2-42f8-8ba6-5ee63b6998ba", "comment": "Malware payload (MaksRAT)", "value": "ee7828c5e2873661ab0df2dc03dbf2b7d203b8b852121dc9ee0b9930253112b9", "object_relation": "sha256", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350913, "uuid": "3af2b4fa-e674-42bc-bc70-d503b14e20df", "comment": "Malware payload (MaksRAT)", "value": "a08a99436ef562368239a72e9c9b83d207b8e504", "object_relation": "sha1", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350913, "uuid": "755745c1-fbe2-4e62-a99b-a931d835b816", "comment": "Malware payload (MaksRAT)", "value": "c0c9837fd8f9631cc7e052d8827ae38d469abccf750bd238bb35f38887c9430f1358bbb5e2768e576385c6b22c5b3fb4", "object_relation": "sha3-384", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350913, "uuid": "ee50858d-c507-4d3b-bee7-ecab6fa6cd2b", "value": "T1D9E2E1BD0888FA75EEF5A17104E7299F7E4C532A3404C1236F64D29561652683AF39CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350913, "uuid": "2dfd4278-8d7e-44f3-9175-2c307a3dc9af", "value": "768:BphJ8TanKGBF83JhCXEGZHUELqbp/ZywJP8meyGsMACN5:r8CKNmEsHUEebpzJPe8CD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350913, "uuid": "26535a61-2a76-4c76-8b3c-99e6aec57b62", "value": 34123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350913, "uuid": "3a19c0d8-005a-42ba-980b-29b2319ecfca", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350913, "uuid": "c9302231-8f50-42dc-a072-220bd72a0030", "value": "ee7828c5e2873661ab0df2dc03dbf2b7d203b8b852121dc9ee0b9930253112b9.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12cb3c72-d5b7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765364271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364271, "uuid": "758e8291-6694-4322-9e08-8bc44de3be78", "comment": "Malware payload (Mirai)", "value": "deb186b16c8f9da211d6895ee905504f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364271, "uuid": "d6882c16-8f1b-4dee-b34f-a39f970c6113", "comment": "Malware payload (Mirai)", "value": "ef24158ad8b15653332d0d4da39959653192ada5f87495c213a15d005a84c7e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364271, "uuid": "0e2992e2-4c32-423f-ae39-6aef5a111bd2", "comment": "Malware payload (Mirai)", "value": "ccd1bc0ebcebee0ba4d48b87e5a91d8e4e6e5b77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765364271, "uuid": "06033f13-af59-4ef2-91bd-807ed8e2516a", "comment": "Malware payload (Mirai)", "value": "7b6eb8e5f338533220401aa1a28c3fdb6455d4743028977b92696a0a64cb568212c852d4f265af9b9221f67bce074872", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364271, "uuid": "abb90b38-bf50-415e-a4bb-5daf901d6f60", "value": "T10934C0A6FB8A0291CC8621F44B8BCB6D6E1305491D7FCBE3696E32351E3A4DF15317A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364271, "uuid": "7d41b853-0e7c-4e29-a3dc-436c2e21ae75", "value": "3072:6rfyLBP9buPqnPMBv3Z+h5QCQXt8j9tkOP2eDDRYRvqCsBAgJCItHbX0QOFq:MyB10z+qk9a82M1YoCQTCItHbvOFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765364271, "uuid": "c51ef9c4-8445-40be-9fb6-b9f4e9cba859", "value": 247836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765364271, "uuid": "9e644071-e4cf-4d64-9313-05b02948aedc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765364271, "uuid": "0c5dbe36-071b-4a95-b4e6-62b17ab48b2b", "value": "ecco.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141cc6e6-d5ec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765387037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387037, "uuid": "a629f0b5-090d-4f21-960a-de5f530f6e9b", "comment": "Malware payload (Mirai)", "value": "3a11a3ab12e939e9bffb80446afbec9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387037, "uuid": "6046e0d7-3f81-4218-bfa2-05809294e5ae", "comment": "Malware payload (Mirai)", "value": "f05b323569eea22a77466ad81b2269a088c65afef9dcd3aae7694d1082956c44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387037, "uuid": "a6e5ae8a-1308-47ea-a438-1465f89c3206", "comment": "Malware payload (Mirai)", "value": "940e1fab1bcbeebe8f66929f6a8aefaa8df7ab3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387037, "uuid": "730b3bc2-ce10-4d09-b69c-9b3b559aa357", "comment": "Malware payload (Mirai)", "value": "758522f0805b5b03fa6a4cc9800daefd22e29227cb398d23e2d3998584333aa9aedb3fe353d73711b3c86bb30638a00a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387037, "uuid": "825579a4-ff86-45ce-b9df-ec5f31a7eea2", "value": "T1F193E551BC82562BC5E023BAA67E668D336477E4C2CF722BC8214B257BC561F0C63F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387037, "uuid": "62c77d8d-53ee-45b9-9bc8-4204fed188c5", "value": "1536:Cd+t0rbCuNhS7CVha4m2WiLMBZO+WC27nVDuw8GSr8rn:8+tsCurVDN+ouw8Lin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765387037, "uuid": "eb287abe-88ba-4a4d-98f0-64ebb60c49a6", "value": 95720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765387037, "uuid": "4bfb3058-f6b0-4383-a49c-f0c12f724ec0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387037, "uuid": "c1fc360f-893a-4044-928f-6d308cccb0f6", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb4e8a2-d605-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765397975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397975, "uuid": "fc327c81-77dd-4e27-9ed8-8984456af312", "comment": "Malware payload (Mirai)", "value": "b158ee2e2fd98122b37aead77dcb7a89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397975, "uuid": "e97373ed-31a4-47a9-a487-04ea8ea48a88", "comment": "Malware payload (Mirai)", "value": "f0803100e4c3488f0c5ccdf1f6d19161dc9c9617d390d5fb556698fe6fe2c194", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397975, "uuid": "5881890a-cc68-4218-91f4-f91d70a74bda", "comment": "Malware payload (Mirai)", "value": "2efd6ce55fbd9f72020f0df07bd399161514da38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397975, "uuid": "50125d07-cfee-44ad-a8ea-5c67e03dbaa2", "comment": "Malware payload (Mirai)", "value": "cbde52fc62114da74fee4ca8d60709948d113ac41867cd9b0d15111beede29c2020f75a6de2be5f69372034b86ae1bc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397975, "uuid": "d0df284c-ca8c-4948-9ba5-3133e52dcddd", "value": "T128736CC2B743D0F1E92606322177FB324673E13E0069DA43D7A9D87AEC52A41E6663DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397975, "uuid": "67765a49-ff18-4166-91d8-d1b48e039eec", "value": "1536:YeWiaOh1gL4rLIGYr6OzmU8vk5oG3fs8kZ2rEZsS4W0STALZBA:BNsL4rMj6XTvIoG3ELZKgt8LZBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397975, "uuid": "fa9b60d0-cb9a-42b1-b5ed-02e275b7ed81", "value": 80208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397975, "uuid": "6f057876-8641-4b54-84bb-30dfd6aa58f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397975, "uuid": "5888fbbf-862e-4d65-a53d-f213ec655454", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8896d76c-d605-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765397970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397970, "uuid": "1d2ac2ea-bcd7-4fbb-ab0f-391976eefc0e", "comment": "Malware payload (Mirai)", "value": "40ee4b93cf665b400a8733bffcfb5295", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397970, "uuid": "bc8e720d-4e9c-46d8-9c78-57dc982ac37c", "comment": "Malware payload (Mirai)", "value": "f091ef0c6e462e1ce12cf2ec99ac8fe92f66d51827dfb693fe44f3cae33d3ecd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397970, "uuid": "c5bac9a3-0ab7-485c-aa3d-3cd8d84764ec", "comment": "Malware payload (Mirai)", "value": "3f09549958b122ef1684c871d507e7ebe175fbe4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397970, "uuid": "da59c194-916d-494b-a997-6f1cc38e7e8b", "comment": "Malware payload (Mirai)", "value": "8407b978d2e9ebe6ee574bb761b66a553893fd5ea7730d9871169badcb961f608bdc9e0b381ec0b4b4affad78f8e62b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397970, "uuid": "646570b3-c9a2-44a6-ae96-d9a94c3fcd31", "value": "T125330792FC82859AC5C057B2A72E568A73A263A4D1DF3313DC184F1077CA65F4E7BE81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397970, "uuid": "6f6a807c-56f0-4e6e-bf63-e82433d359d0", "value": "1536:gkPMF4CVgm49b7lJMs3fkPBUpUJushdZ:3MrVgm49oUppUJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397970, "uuid": "1ba524a8-c41b-452a-91c8-a6d31b054346", "value": 53776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397970, "uuid": "a3e4c164-9690-4f0f-9dff-ff9551b168cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397970, "uuid": "bf9ade1f-34d9-4082-b352-af7845af64d1", "value": "Labelloperc80.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924030bd-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1765345158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345158, "uuid": "6167f3a5-48e4-4698-a46d-a561b628d867", "comment": "Malware payload (PhantomStealer)", "value": "aaa395f03d2fa3bb3c77b042f3de84ec", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345158, "uuid": "1486fc93-9d73-4725-95d9-e71e5b23a87a", "comment": "Malware payload (PhantomStealer)", "value": "f1e67eefdc39e66ab74b977bebbec34010476533235fdfc139bce872669b8892", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345158, "uuid": "29dd0b15-546d-4824-a831-3906b2b2439c", "comment": "Malware payload (PhantomStealer)", "value": "45d710114723d53cd265127a677672ea12757ad0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345158, "uuid": "f5009200-e581-44f3-aae3-c0ac450fb801", "comment": "Malware payload (PhantomStealer)", "value": "33ae665c970fbb1486f006eb2f49d3918e6688eb0356d7b7b3790eeb18bb5f22f5a28755d3093214039470d091ab809c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345158, "uuid": "9ec77b21-1879-4661-870e-c00487ca51d1", "value": "T1C81611E612F94AC2547CD37D5FA6D80AB6CF08321B01800635BF54DCBE666C625F3E2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345158, "uuid": "ab716729-437c-49f5-912e-f2a813b3f81f", "value": "12:0oegoegoegoegoegoegoegoegoegoegoegoegoegoegoegoegoegoegoegoegoej:rGsgm09R9LBsz1skryRB5Lccz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345158, "uuid": "34736d51-0656-4fe0-af8a-ed0f7a466909", "value": 4274743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345158, "uuid": "91ebf20a-4826-4142-9d12-8135d40beff5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345158, "uuid": "d5a31dfd-efcd-4492-acb3-6473660a16bf", "value": "Paymnet_Advice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785c6d58-d5de-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765381192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765381192, "uuid": "7c1b60f8-e7c8-48a4-aeed-473321c8eac4", "comment": "Malware payload (AgentTesla)", "value": "74bc597f39fa314106b894f45dc02785", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765381192, "uuid": "9d4dcf8d-0fa4-48e7-95e9-585fec598945", "comment": "Malware payload (AgentTesla)", "value": "f26a3ab2354fb244271dcda251f6141d89ada39ea23f0a1529fa3c9f1d2481b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765381192, "uuid": "2132eb10-1450-4326-b42e-8d4ce4b6e682", "comment": "Malware payload (AgentTesla)", "value": "9c409b8d9d18681983850c3dd816e2eb92cb6cdf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765381192, "uuid": "ae4d45d8-e8e2-4589-ac70-ca7847d88dba", "comment": "Malware payload (AgentTesla)", "value": "7af96109933f08a5c226ca843a6e9be9b5ed0ac4e737e69e69f1ad9128a5b8be91f96f5c2c77f3e054ece6c740462739", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765381192, "uuid": "31901627-5e55-4acd-8d79-d7eb310519b3", "value": "T166F423A499D18A51C6057334C836CC2505783CB16E54A77D8B39EA9FBC30397EAB3B1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765381192, "uuid": "8de142f8-6a43-46e4-ae11-6f3d4d7d3fb9", "value": "12288:8z7hU5I5yuNHIgzSFKxWltRohBfSTso93UWRsDXjs32gzcj9TRqveZYlW9GNqG:8f+iN57Gtene3RoXm2+chTRylvqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765381192, "uuid": "eb7e63c5-1497-4ed0-9aeb-678aa7e6b3e7", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765381192, "uuid": "a8416348-10c0-4b94-9f27-3f3b1dda245e", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765381192, "uuid": "97a0f6e2-ef98-4c64-8183-d1efc7c0e386", "value": "ITT-QT2025DMT029.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd6dbc9-d5fe-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765395002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395002, "uuid": "20cb2c51-decc-426b-b863-2847172023ad", "comment": "Malware payload", "value": "5a1879d98a9e8568d9fe24592fe292d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395002, "uuid": "167731b6-226d-4540-a920-057245c7a197", "comment": "Malware payload", "value": "f2937a4c27177aade4d4df887e17ae115cc3ecb778bb03c6a6ae54b503a00f5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395002, "uuid": "64a45486-9be8-413d-bb50-9b3f904e89ab", "comment": "Malware payload", "value": "4bf03ac87cd8afb36abbaa205f3c1220a67ec712", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395002, "uuid": "bb01c004-1057-4fff-b99f-fa27303e61f1", "comment": "Malware payload", "value": "86dba2ff3347e00678a4b9a00af59261bd299484fa1dfa03635685e766351845d79ad6f31c6cf7dbe6e6997099af590c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395002, "uuid": "07db678f-b363-40a2-88db-5bcdb3cf60f7", "value": "T197D633045A8F4F04F6BE6B356DB992244BF4F90ECA36C24EECD411DE2A21B609F65743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395002, "uuid": "093a6e94-d83d-4850-a7ad-42c0163f1ad6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395002, "uuid": "55c58944-e1b8-4deb-8a4f-2a54cd40a28c", "value": "196608:UrAIGIGFZ/vjkSe1QzVrhmDAxGtHHsIYeOCOWA+MW26fdNZhgoDVZpu7y11l:iGIGFeSG2HCAUsIRLMW26fdbKm3P11l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765395002, "uuid": "20505d87-bbc7-4931-819f-46e57c170058", "value": 13342720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765395002, "uuid": "9c2f9973-5d3d-4e97-aed4-c6225cda4b97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395002, "uuid": "615fa569-3a3c-47d1-a5a7-15c7a3651dd3", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9162477b-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765345156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345156, "uuid": "9a12737b-ceb2-4b95-b2dd-6bfd91972e29", "comment": "Malware payload", "value": "b5afa4af28da313326f7a3c1cae08e71", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345156, "uuid": "13a6446a-954f-4682-b6b8-a0ce29155b9f", "comment": "Malware payload", "value": "f330d13ff2c959420b0bc44743523793def3ca5fef5e10838c6197f36ed11a88", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345156, "uuid": "2586b72f-63ee-497d-bed7-203929f41f90", "comment": "Malware payload", "value": "c9b81af985098977c53401811b64ebf83781d17d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345156, "uuid": "90bb2c9d-f40a-4c9d-85f6-7ecae5b56bbb", "comment": "Malware payload", "value": "14fb1bd7c86ecbc8758b975ba9e2f744f6da1db739f363dc276378d6c45758da41a260c58c65faf978ee816305b3c97f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345156, "uuid": "1527ca6b-6d32-4223-af7c-4faeddead0c3", "value": "T133D44A20DD2416B94F071BA9FD541F61CAFC960A552A90F1F6DE070E61029FCE3FE6A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345156, "uuid": "2fe5686b-741b-4519-89f5-82150c6b6efb", "value": "12288:sKRKvzKlJReKlJgKlJg+IIKlJg+xKlJg+IBKlJg+IdKVKlJg+IuKlJiKlJg+IOKk:sKRKrKlXeKlmKlxIIKlxxKlxIBKlxIdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345156, "uuid": "ff0b61e7-4f9b-46f6-8857-93b1e96f3ab6", "value": 598614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345156, "uuid": "da0d485f-f47b-42dd-bacc-333ea7d174bf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345156, "uuid": "c9f7ed06-3342-4d95-bb93-139511148d20", "value": "Imagen de Pago 2025-12-05.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04bf1c36-d5e7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765384864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765384864, "uuid": "70bef1d5-8ae8-4c96-a261-c55d8023935a", "comment": "Malware payload", "value": "b78f0bc5d4e331ff8a9d5485f3ac6452", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765384864, "uuid": "03b951fa-7141-4fa8-bc1e-8ba1b589a834", "comment": "Malware payload", "value": "f36e368242cbaa100769cadb51b6509a7e25cc34830b5da5dc79c5f7a95ece97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765384864, "uuid": "15cc6e6e-32b9-4711-a23c-f0f7f7cf7a60", "comment": "Malware payload", "value": "c866da21fdd521f3e97979ec3d09b2d6ee4c7f47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765384864, "uuid": "b6fc2f35-5f6d-483d-9bb8-861bcade903c", "comment": "Malware payload", "value": "60dafad225ba298635646c0d94e2498610919c7a531487d5dd49d1a183d1bf032738995c34c5d942c3220625157aa9bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765384864, "uuid": "4dd39ea5-45ce-4dea-b403-05f52eaf8208", "value": "T16AF423BDF5861635F014B93C5C09B669B8DA39831E8DAF511F08E452C63B98BEC86C4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765384864, "uuid": "0bd5b87a-3930-42e4-a5a6-a5be5d746d24", "value": "a70d2c28d7c60386f8351dff21450116", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765384864, "uuid": "84b01fab-41a1-4856-ba7d-3241804ad05e", "value": "12288:zpEKPOW5wGvOyJ1N4UPMKe1/ANC1kwOjEXLIEMMJv3dQkNf+qi21/3jb4ItBDQdQ:ikz/vOW46vqANC+QEEMMTQkV+G/QAATM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765384864, "uuid": "454c1a3c-ba2d-44fa-8009-e8a0f00c4497", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765384864, "uuid": "abe9cfbc-e64e-42e6-9649-d533ceb07c9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765384864, "uuid": "01e51463-496b-482f-ba3b-686a6438cb64", "value": "SecuriteInfo.com.Trojan.KillProc2.38114.17304.2290", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39cf3317-d5c4-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1765369920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765369920, "uuid": "848b9832-3b4d-44de-9507-42dec115cb8f", "comment": "Malware payload (Vidar)", "value": "9fd32a6b19344c2ba6081e5f69ec16be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765369920, "uuid": "48f0da85-5299-4dbf-a105-179ec9098379", "comment": "Malware payload (Vidar)", "value": "f3eb5aeeafc7a2f512bb9e7a39e1612f896193190d10589fd476ae3d67139f7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765369920, "uuid": "d2640760-5b47-48da-b8b4-10ce7eea8891", "comment": "Malware payload (Vidar)", "value": "5a3bdfe3329f6041ffc421ca77426c93b0fa2c4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765369920, "uuid": "152a0dcd-311c-4361-a47c-f18f959186ac", "comment": "Malware payload (Vidar)", "value": "8d0bce4be88d3d403706d7cd1c8454e44e0cd6a57b0fa52427c980c6c92a55660c43575b69e8f421c259e21e335ad762", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765369920, "uuid": "c9aa72f6-c017-4388-81f6-e9f5a82a01a6", "value": "T1F9E623D17DDA6268D4A75B346286078571E2B7CDC1FF0B0E3AC61C0A36B0F07DE89966", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765369920, "uuid": "9f7ac9a7-0ad6-4b85-a95c-cc37904fe930", "value": "860714c41d4908a0b78d349f3d9a82a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765369920, "uuid": "064ba18d-9572-42a4-bbbd-bc54c1b985c8", "value": "393216:hZTJtj6aXBRk3HFcpMqTYBVIUCm5OL6SVky4k:hZ9tjRRRk3lcp9h0ny4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765369920, "uuid": "d93a446b-cce5-4f6a-ae4d-6748fee0f5d3", "value": 15245312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765369920, "uuid": "2ff70c19-27df-431c-b56a-0ebe7ab45750", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765369920, "uuid": "6b85144a-cf10-47f4-9940-783aee4a1872", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10480fdb-d5ec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765387031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387031, "uuid": "c384bb5b-e7d8-4040-b8fd-f1d927b9f970", "comment": "Malware payload (Mirai)", "value": "b5fb3f9a785e26339b2f221f9b017ab3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387031, "uuid": "afa21d95-c4f4-41c0-a998-d13470378521", "comment": "Malware payload (Mirai)", "value": "f40e7ac020e9810f49a0c4ae156de58ced9ee1e65c8cb1d6e2cf39db9de2c77d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387031, "uuid": "88e812c6-ed5c-4c8c-bede-f025d3455b24", "comment": "Malware payload (Mirai)", "value": "4a8788004ca4afad1b21bc66419bf81ef177cb1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387031, "uuid": "96f0b6d4-c2a5-416c-aadd-c5b3e6e3a57e", "comment": "Malware payload (Mirai)", "value": "24ba13e0b3a87131d93403272efd10482fccbf321440179df051b1e34e508a483800b80774c829cd5ddcb68e70211ad3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387031, "uuid": "74957189-5124-484d-8b7a-fd5597966cda", "value": "T186C33906F98180FCC58AC2341B6FB63AA936F1DD1238F2E76BD4AF123D4AE614D1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387031, "uuid": "3b58c436-430f-485b-bd0e-e70384c80b47", "value": "3072:j586guLRkHQo8SsGTHb4p1oB4n2pvi5zlLVPmXnZ9TzQTRN6FpjygNjc:jrguLRkHQo8SsGT74p1oB4n2pvalKPzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765387031, "uuid": "2e4265a8-4e72-4e4a-aeee-ff0da9604d1a", "value": 126272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765387031, "uuid": "99a4661a-b126-4731-9004-d1b0be6780c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387031, "uuid": "89590785-b917-420b-9a18-2b2cf8c11883", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e44c71a6-d623-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765411009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411009, "uuid": "52aa1692-c546-45f6-bd97-6e69820c0779", "comment": "Malware payload", "value": "5bf99f3df37f28a983b9065dbed9af5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411009, "uuid": "97f0ea9a-d2b0-49af-b9e4-b822724db64d", "comment": "Malware payload", "value": "f5ff59e71d104f0a814435f4e72b14db35174c8e0db04ea2c5db740bd7c4e0ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411009, "uuid": "1e756a5d-9589-43ae-a516-f6215a2edf62", "comment": "Malware payload", "value": "36c5b1269e39873a8e620959187c01f6a15ac6fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765411009, "uuid": "90ff9c79-2d60-483c-8f16-fac0668e758b", "comment": "Malware payload", "value": "a0c4b0abcfe65ad3e34959566ffb29b5e3ee0116834f92380cacb5a85cd5051b5cbafdacebf7fc8f403ee355ace4bc6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411009, "uuid": "f7701ca9-c4b4-47c0-9295-7c6b21d25680", "value": "T13B731949E552C6F7C4821BB10397BAEE0766FD394EBA9E48F7083CB49B724D43929311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411009, "uuid": "ba06840c-07a6-4025-bebd-2442d25e11ef", "value": "1536:xhp83lgSLYiPvoVjRWSbXJ0rWlC/kPstVkYFFw2XQW83LZ5:23K0YiPvoVjRWSbLQ/kPstVksw2AN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765411009, "uuid": "37bfcaa3-af1e-4568-aef1-32c8499984ff", "value": 75580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765411009, "uuid": "d5df02df-e300-4042-9deb-e582ec94d76b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765411009, "uuid": "b6909354-3965-44c3-be34-adc2a2132933", "value": "wget", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec49d714-d5fc-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765394272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765394272, "uuid": "af0a970c-5c8b-4ac9-b040-0c18a7648036", "comment": "Malware payload", "value": "c9c606810df49fe7ee4750d7c8b1a587", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765394272, "uuid": "5eaad8ba-5881-4554-a1ee-e35734259099", "comment": "Malware payload", "value": "f6f29d7b2bd66057977548d201b33bca51d70308e0ec3ecb64b91fad0ef79516", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765394272, "uuid": "7b2a82d7-032c-448d-bce0-445d9d117308", "comment": "Malware payload", "value": "c2b7856cb55b4b9fb0fd9e6d8d3f6183cdce45c8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765394272, "uuid": "d06e8dfd-5f31-4c74-a7cf-556c9402fe76", "comment": "Malware payload", "value": "e81f3f6a0ed9bb05515de8ce523dbf1a3d27db22db8de798308c53c985e9d8a2a2e4cd9bfe7b323ede99504538451895", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765394272, "uuid": "dae15c87-0325-4c1e-ac2a-2baa49abb7ce", "value": "T1DF0454890DBF44AF474A6065512FDD875EB92B0B056ED6C03D8FAB882F36D68706B3D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765394272, "uuid": "ca9ceeae-a9ec-4ffc-8cdf-af14c54a1eb1", "value": "3072:gakjUTAyY4WY1RtQiowwr4C/JSMUZ47h4f8XyPV4CMMzKnd/bM8RQIPje6UtBvbJ:yjUTAy9Qiowwr4C/JSMUZ47+NtBvn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765394272, "uuid": "7ffbf492-3643-4bfe-a27e-c7b2ac756077", "value": 186100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765394272, "uuid": "74fb1eae-d229-4137-afbb-fbd183d8ba99", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765394272, "uuid": "94f588fa-da66-44de-b542-94d83d4a6052", "value": "Holiday_Dataset_Clean_88.csv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d507b73e-d597-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765350853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350853, "uuid": "2e20722b-8af6-4893-bc2a-2f9acce6e78b", "comment": "Malware payload", "value": "2c57f7a996b9a67bd60f9a128daa4ad6", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350853, "uuid": "d9932b84-f331-415b-87d0-429077fc78cc", "comment": "Malware payload", "value": "f73b9ec6cd60b9699fa8a4893607a24e3881b33d55b0bf9d6efcb2acb4ae654b", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350853, "uuid": "9ad0eb7b-563d-4e81-ac8a-dc195f7b6442", "comment": "Malware payload", "value": "ff05a46c2637f462f395de7e71dd0690ef09f89c", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350853, "uuid": "a4d738fa-fc45-4b53-9ece-a9c05587cf06", "comment": "Malware payload", "value": "e388caa0d24ad7eafd1d8e12af1566c830a6baba28887205a1f334cc55712a5786966359867b68a28745912e59ccad15", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350853, "uuid": "25e3537a-c9ad-468b-a236-fcb6294135ba", "value": "T164251223DD54A3B5F95032F9B609C1941EFB3D8D2ECDCC676C862C830EC26E6164AB56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350853, "uuid": "0153b5c1-5290-402d-a55f-9c9acd1391e9", "value": "24576:Dx2gdrFt1GhD6baP5EnKCzWF2MPP/Xj58N7sDhRJGZiXO6rD573u:Dtxtok+/Czu2EPPj58BcJTXO6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350853, "uuid": "38de2ae4-e63c-4ce6-892c-d64d9c056cf5", "value": 1023574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350853, "uuid": "9e3b1af3-ab53-4b34-896a-1f5c8f2e978a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350853, "uuid": "25b758a4-0258-45b3-bd24-cc81ab92d210", "value": "ProductsXInquiryXSpec.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f68a9e-d598-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1765350961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350961, "uuid": "672f4f38-d0ea-4867-86f8-a8fa6292d5ec", "comment": "Malware payload (PureLogsStealer)", "value": "dba3554611202e11ba425dc822e5fd94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350961, "uuid": "b41b7f5a-1897-4db8-a3c0-369cff15f3c1", "comment": "Malware payload (PureLogsStealer)", "value": "f73d18e26ab65daf7d47eb8418fc31cf3251de98026fc8bab89fdfe162039412", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350961, "uuid": "8cd39151-435c-476b-b52a-74b6608965b6", "comment": "Malware payload (PureLogsStealer)", "value": "37bc0907ee0b92e1bfb1150cca956be504dd43e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350961, "uuid": "de006ed7-038d-4bad-a483-f5efd0d7c34d", "comment": "Malware payload (PureLogsStealer)", "value": "14a4a05e14b33f7cb08017be1a4987f584cc6b22cda187c65ba2d5f3a33333256defd4b426fd079676c4eecfdc836112", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350961, "uuid": "8ab2191a-84ee-4abb-af39-b090d9c7937e", "value": "T1B53502D03A76771ADE211A31E969EEB506F91E787012BEF259DD3B4B35AC110AD0CF02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350961, "uuid": "29d0c5d5-2c76-4ee1-96cb-2cf8a3766e75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350961, "uuid": "2de31e7f-b9d6-4c24-a4df-c14292703e1d", "value": "24576:9dTRhESXnNs9eTJiS+g7HJNC1Gt9NIWLnkdjMzivUEPcwrl:P9riSRjjC1G7NXnkiOvUEEYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350961, "uuid": "fd5edf75-1be5-4de5-888d-6152b1cceb1f", "value": 1161728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350961, "uuid": "f167bd28-1b6a-401b-92e0-e749d0bcff79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350961, "uuid": "d43a87a6-e2b8-457c-9797-4f9934db608b", "value": "PO-07162209904.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3fa1c58-d563-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765328518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328518, "uuid": "ac7c6487-52f5-46e2-a3cd-b7baa5326a80", "comment": "Malware payload (Mirai)", "value": "ee6a58eb8adf41b71db29ce286ff6ef8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328518, "uuid": "02f7f50a-ef64-4f3c-8e05-6bbc466f8231", "comment": "Malware payload (Mirai)", "value": "f77b1cb222215bd6f6a6adf0957ea27b0c1c9a90999e9047a28b05b959d241e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328518, "uuid": "67071657-bc4c-44c0-822a-d5fd96139f3f", "comment": "Malware payload (Mirai)", "value": "cb74658b49cd5dbcba945ce86779d61319397c97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765328518, "uuid": "78b4b8ae-ee87-461c-b2f9-d1557bbbfa18", "comment": "Malware payload (Mirai)", "value": "a18018afeea04cb910e2080f8afcf1e3ba74ebafbb31eb2f8a0180939eb38f6efa606edc44e5f6096b8a12b3c5bee6b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328518, "uuid": "9446c2af-c91e-4e9c-b2ac-b25389b14886", "value": "T1BFE35D8AF4029E7DFD4FE5BE44670D09E931A39131830B2A53DBFDA3A9311A94D17E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328518, "uuid": "0f6e9430-ae79-47d5-adee-309594f2669f", "value": "3072:7oDlIyA+oy+ZGiTw/lZoEhH5lgLOoe97dlJ8jb4:1Dy+ZGIEFxoe918jb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765328518, "uuid": "02643318-bd58-405c-a00c-4c87a4b5c709", "value": 147336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765328518, "uuid": "72beff06-aacb-4a5d-b283-154ea144e251", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765328518, "uuid": "876c6ab1-c911-49cf-a528-e05a5d95b32d", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a773bfb-d5f6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765391396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391396, "uuid": "e5454936-3c10-47b3-96d5-bc0fbe2c2cd1", "comment": "Malware payload", "value": "ef21207c87363d68de67eb07dc3ed27d", "object_relation": "md5", "Tag": [ { "name": "jmpbowl-space", "colour": "#8E4207", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391396, "uuid": "8baaa77b-f370-421d-af5d-eca3bfa66d26", "comment": "Malware payload", "value": "f7b18a288190b01c993f6fc9b4736a78d61a508bae87f361f48d090d42614caa", "object_relation": "sha256", "Tag": [ { "name": "jmpbowl-space", "colour": "#8E4207", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391396, "uuid": "ec0a443b-8cf1-463e-91e4-ee296e2858dc", "comment": "Malware payload", "value": "77f6d7408130fe5f61625cbdc56f12f261f97c08", "object_relation": "sha1", "Tag": [ { "name": "jmpbowl-space", "colour": "#8E4207", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765391396, "uuid": "3ef4540d-b499-4391-b83c-f186254ef8f8", "comment": "Malware payload", "value": "a8009e174683ef67f8ed5e3461cb468ca095f1b78a191443fa2ccf8ec186d941c3c9ed14d669962c59289869ed7cb2dc", "object_relation": "sha3-384", "Tag": [ { "name": "jmpbowl-space", "colour": "#8E4207", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765391396, "uuid": "273cfd55-14e0-46ff-b3e8-22d6c3047b13", "value": "T10C012086D23695E0CC3B3B7E454A129CD218038C1079CBE6871D367168CBC858FA1697", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765391396, "uuid": "d557cce9-effa-4d07-b3b2-c8adcc27d297", "value": "12:5j6wHSeQ1rjAYgmJLt/rE/EDxd8SPS2RkPgbQBICmp+ti+ni30NC+IKnEkHmdGTo:96BxjAYZHrlDTLL3gAjYjk+IlxdGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765391396, "uuid": "3a89dad8-bf98-4b33-b423-92d1e3657652", "value": 785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765391396, "uuid": "da4ade55-f764-4e5a-96f6-a249986b7b93", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765391396, "uuid": "0e5a3299-b91b-4987-909b-4f124519abae", "value": "964f5d5f02fce99e3eea78d544fd78b843e0e39cb6994e0c77b2255c773f4617.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f32b36-d61d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765408089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408089, "uuid": "3d00b915-e6fb-42dc-a133-84e40c0e6f54", "comment": "Malware payload", "value": "b823129c65e953a84d82682471119a57", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408089, "uuid": "d227f644-5bcf-4811-830a-5242008be358", "comment": "Malware payload", "value": "f843b8f0381b6c318c4ef370b09f1f2793404b1ced049991dfa38776dd47afc0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408089, "uuid": "47cbe693-fbcc-4d57-90e3-d802b55a0de9", "comment": "Malware payload", "value": "08d636e1811eb86effc8852f9496093104ce8d4d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408089, "uuid": "26fbf483-3ff9-427c-ba6c-a947c438895d", "comment": "Malware payload", "value": "bd889aa9d5add54a478d9f63d351352d3c5d1c179ff1c7e8a817f501dbcb2ce9875850742b2aa2fcdaa6015d52d0a031", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408089, "uuid": "c2c7455e-38db-4dcd-9de6-2fdd0a0dd7e8", "value": "T1EF942368614FEBB7D37654B02E6E80F975983C03AFD7A820A43AD77168F0122D90717B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408089, "uuid": "f1f1a2c9-36de-4112-b794-2c124d0a24f1", "value": "6144:oVDEo93GYTrK1gqf70km3BG0bERU4dhKTat789xhugKs7gLPfEsQtyLSD8uW2nej:Bo93GYTrKCKaB2YlbsA+SDljej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765408089, "uuid": "5cbb46c4-49fc-4088-8506-66c90a4b688f", "value": 425168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765408089, "uuid": "6fd953e3-772e-46bd-90a3-45341aea1885", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408089, "uuid": "2f656180-77b6-4a05-8e0d-d86e11b344ae", "value": "November statement.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d31a3bd7-d5cf-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1765374902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374902, "uuid": "bb52fd78-f5df-44b3-a22a-c4e866d29217", "comment": "Malware payload (SnakeKeylogger)", "value": "e0554292d29494e9336f02b9007df5a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374902, "uuid": "ba6b4f0d-1484-4497-b26d-70185cd45ca2", "comment": "Malware payload (SnakeKeylogger)", "value": "f904118eb7e5b47befd7915d3f6daf49ec3890940b1aa25a2444e300507f9c1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374902, "uuid": "c574ab26-76ac-4e33-8561-0eebae40674a", "comment": "Malware payload (SnakeKeylogger)", "value": "7831241f48f793e5b6c711a42c183b7da83d4014", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765374902, "uuid": "5e75ac58-9459-4176-a046-756af13d253c", "comment": "Malware payload (SnakeKeylogger)", "value": "2a5e8a7983d1701b854999a01f0de986bcf5bd0fde650b2a1cd4657a26ffd05565a42867dc331273cf85948d4d982d15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374902, "uuid": "35e97ee2-3dd8-4c7d-8ef8-032333f283a2", "value": "T125958D05E3980569D567D774CAA76B33DB70B8520371D68F12D9DB8E2F33B809A3AB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374902, "uuid": "593df432-a5b7-4ddd-8e64-595805509192", "value": "2ab6a2af9ec34d5a140c67d2e7f07a49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374902, "uuid": "f06a7ed0-06e9-4c06-9154-624983801e08", "value": "49152:9GoJU63q6dOlzI0oy6XTS49YryKXLj0ip:ptdOlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765374902, "uuid": "be362d0e-5f03-4565-a8e7-81e34105d3c0", "value": 1992704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765374902, "uuid": "20b889d3-3842-4521-963f-d6d0d2bbefab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765374902, "uuid": "8bfffe2f-6fb8-467c-8c64-999f32c77143", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661daff9-d605-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765397912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397912, "uuid": "380ba054-feb2-44c3-aadf-dc2a399069b5", "comment": "Malware payload (Mirai)", "value": "a4ce5f138762a0d42f7cbda60e48fe64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397912, "uuid": "56ea7c34-efc2-4e2b-a477-18cfe4dea534", "comment": "Malware payload (Mirai)", "value": "f9a480310942ffb850aa7ada066444b580352da1b0e94a0975ca596bdfd90ebb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397912, "uuid": "79d02e48-82ff-4425-aed4-1554920196bb", "comment": "Malware payload (Mirai)", "value": "6d9244bfa5b4539997e1dd1f58344a81f4e30934", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765397912, "uuid": "e3c0e3c2-d49c-44b1-a617-5afc318bbfa6", "comment": "Malware payload (Mirai)", "value": "97b8a659d21b7a2c8378cbe950dd3739ed6c7181a61cacdcf3af29a49cecc1665cdb5eec4aee8d6a75a137c88a5084c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397912, "uuid": "aac83a0c-660d-4da4-a97b-4989e638df8a", "value": "T125A339D7F801DDBDF84EDBB744530506F171E3A219831F36626BB9A7AD351A81822EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397912, "uuid": "ee5200a2-33d6-421d-8505-79d33c65745c", "value": "1536:U3kppk4+eRKbBCtc2Y1L0vsMm8IxzaKWelHs2xbfXiUov+qlQZ7uq:DZKlI4L0vsMOPHtxL5qlQZyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765397912, "uuid": "26ea364a-d955-4774-a4af-b7a9d9ed656b", "value": 98632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765397912, "uuid": "97cc1936-5c92-473b-bd2b-1313dab4baa8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765397912, "uuid": "3591097d-49a1-47a0-be57-2c3bf9020f19", "value": "Labelloperc80.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de667d0-d5ec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765387027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387027, "uuid": "934b3cc9-a250-42e0-9f66-53ca5425a87d", "comment": "Malware payload (Mirai)", "value": "a53ba879c557bdc3a14805a201a18ccd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387027, "uuid": "4b063a26-94e0-49cf-b664-83ea497c57fd", "comment": "Malware payload (Mirai)", "value": "f9f248474004bdcb9dd077f59e01df30250af3df79caf217aee330cb8b6c8618", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387027, "uuid": "3904e146-b409-4799-888f-f9c2331acd51", "comment": "Malware payload (Mirai)", "value": "40f83b5797520d81fbdb65ebd0d49b42d30cd3cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387027, "uuid": "10d339b6-2360-4a17-abd4-bf80a3948da8", "comment": "Malware payload (Mirai)", "value": "fe03c18585c778a4b9e3fef52a4d1dde122afa165269a0d9e345cfdd7c63999723f842f6b8521961124a6330207a017b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387027, "uuid": "ce857865-c67b-4659-b69d-8ff555a0a3fb", "value": "T1B5C3AE73D42A7EC4D1514034B8B5FEB51B61A5C041935EBB26E9C87A00CBEA4FA0AFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387027, "uuid": "48150ee4-8edb-4319-9196-953fe4f83c6e", "value": "3072:hfpZykqkt436I+9eIHEmNOkSMPXeC4GnHD:hRZ0F3BcfNOkvZhnHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765387027, "uuid": "bba2e95e-dea1-43e4-bd35-01df1b50d4d8", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765387027, "uuid": "7fa55025-fb90-4417-b593-c073f67769f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387027, "uuid": "c56fc601-8ca1-437b-bbde-81ca04990ae0", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fa8f29a-d608-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765399216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765399216, "uuid": "8599bad7-27c6-4da1-83a5-ee5bae83374a", "comment": "Malware payload", "value": "855927fe650255e429b467473299887a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765399216, "uuid": "eb21ec72-dc85-45bc-ae79-6bfd1afe54f9", "comment": "Malware payload", "value": "fa265a7c24244f3583859da8445288c8c6c913b53922d342983147df6e9becca", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765399216, "uuid": "30dc74be-421a-4a33-869e-270b3a7cce7a", "comment": "Malware payload", "value": "805eca24592919e8e98ddcafaff398f5eebd5ab2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765399216, "uuid": "11dce2a9-1ab4-43e4-bcc1-fb2b5f77a448", "comment": "Malware payload", "value": "11549f4694b6263aaaa2337a305595ca6538b85db7659541e401b50ed54318b3001a87ba8bc770df5b6a0fffd2bf637b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765399216, "uuid": "12990050-2e9e-478c-b747-50af9cb2f260", "value": "T1B856F8273A509D2CCF176332D0AD9B247BB9C6703111BB57CD38E7392C62A899B9DD18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765399216, "uuid": "3c5b5d03-f6e3-491a-9114-5777db2b8bdc", "value": "f894a32abc42993c9901bda32a4ebd3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765399216, "uuid": "483ae28b-4b39-4fbe-a06e-b69fe23d95f8", "value": "24576:1tmQwrEMKfzAIZY2572FWGo8eYdvfWPboZ81Rq8AsZl2eyug3Qm8m4SZbcFmF7tK:GQwe7AIZYNF/H1JK5OBsRKdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765399216, "uuid": "2c098ca1-1768-429c-ab39-c45e477e3a70", "value": 6112152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765399216, "uuid": "37f4b85f-b5b1-4d87-a398-7d226fbccc31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765399216, "uuid": "77e3c4e1-75bd-49b9-98e1-e0bb85ad311e", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a83457-d5a6-11f0-a129-42010a9c0007", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1765357050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357050, "uuid": "e72822b0-e92d-421a-a207-0a15c0ba7020", "comment": "Malware payload (MaskGramStealer)", "value": "a8c024cc0c9ca0d6a84a208c423eb753", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357050, "uuid": "821bea59-f5f0-4914-8a94-fdef5218882e", "comment": "Malware payload (MaskGramStealer)", "value": "fb1b756f092782f4da06167ba050946c5167c49330ce0781946162239932fba5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357050, "uuid": "afe55d4c-e85f-4a3f-a793-f781d582a72e", "comment": "Malware payload (MaskGramStealer)", "value": "dbb8a91f3b0ef0df5ec5540ce1899d9d0969831b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765357050, "uuid": "a772b427-b8b5-42c4-91cd-c3e55f0f789b", "comment": "Malware payload (MaskGramStealer)", "value": "d20cb850f3d019824eaf393d8ddaabdedafc4c225c65d365cc4cb8d792fefc5636315803259362594cea08cb789e2283", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357050, "uuid": "3a4b38bb-c190-44c1-863e-f98074086835", "value": "T1B5C533A87F55A711F6B1DFF379D37450B00E358385EC26343252994E2227CF62E2A36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357050, "uuid": "5821ce94-2542-4108-949e-ab29a45d24ec", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357050, "uuid": "93851f13-c7f9-4c3a-b03a-0fafb2b1c567", "value": "49152:zUS1TWqL1gTq6G3pqa5U8ZiM0IiJbh63VYrCRWCmqwrd:NXZJfx/PiJbQ0Xrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765357050, "uuid": "108e349e-f0ea-43e8-99db-90eda63cb740", "value": 2558464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765357050, "uuid": "e142d59e-ff0f-499a-99b9-c2f97dc3ab47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765357050, "uuid": "b52afc00-fa3f-4531-a531-b4889058ca5a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a7f82a-d597-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350906, "uuid": "0925d142-ce69-4042-bac7-9b1ca8a434d2", "comment": "Malware payload (MaksRAT)", "value": "59e8f5648d69120710baebf1fbce0ca2", "object_relation": "md5", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350906, "uuid": "45b11586-e049-41b1-8261-00f258b27ba8", "comment": "Malware payload (MaksRAT)", "value": "fc2a702ab9ef781b493e419c303abe659657761a5fa5cb938a894aea3ea59aa5", "object_relation": "sha256", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350906, "uuid": "1cba65ad-0ec7-43f5-94da-5747f0cfbf28", "comment": "Malware payload (MaksRAT)", "value": "d6d06172c8e9fb318318a8f24db953bc52416695", "object_relation": "sha1", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350906, "uuid": "73cb3ef0-7d1d-47d1-bb82-e3dbe8f72975", "comment": "Malware payload (MaksRAT)", "value": "9b5a1049cee19dc8595650feff8493204638eea3e7c9bac42f5502f6ea71d265f782294ca1a5724f560015d0015392bf", "object_relation": "sha3-384", "Tag": [ { "name": "35-185-90-35", "colour": "#52B79F", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350906, "uuid": "94f23eb6-fe0a-4662-a215-47c27cb48a4a", "value": "T1A5B2E1B64F946450E57767769FA440DBFB687BA001FB823F2B049C9A0BC7D4DE11248C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350906, "uuid": "d32bd2e8-d4a6-47ab-bbaa-e21e872e71ee", "value": "384:hm5g7EoliPRjgFu7P/agzvmwLR+CD3/4V64O1AseeOPt7C+Rl91QyEJUU+f/dzR7:VIFgaPCkXR+EaPO1AsejPmax/Ear5H1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350906, "uuid": "da18825c-a09a-4d05-9b25-6df97adf88be", "value": 24885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350906, "uuid": "a420af6b-7a7a-4d9c-a880-7349bfc00527", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350906, "uuid": "d505b4bb-2435-43e9-911f-f55b4955405b", "value": "fc2a702ab9ef781b493e419c303abe659657761a5fa5cb938a894aea3ea59aa5.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e50c166-d5fa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765393094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765393094, "uuid": "a3337c8f-8efe-4166-a20c-1c9d701c8cf7", "comment": "Malware payload", "value": "b42065ffb6069fb55eeb5331d83dfa27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765393094, "uuid": "3d42feb9-5b66-4b3c-8a9d-51c118af244e", "comment": "Malware payload", "value": "fc50247f58d72afba698b57caf317197faf277250c68a97297e03a8558bc32b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765393094, "uuid": "df1971e3-8e3d-444f-8cb8-ca4d615187dd", "comment": "Malware payload", "value": "24d80ba50737ad3d1068897d0a2762df64cdd4af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765393094, "uuid": "e6186f21-44c7-40f9-be41-1e357f7a9b42", "comment": "Malware payload", "value": "c2212c9464ca67e58d608cb3e02ffd5f6159c9fe7d8208532fc2d68eb16e10def4c2892b5e5e38792785bc39a44017fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765393094, "uuid": "3d036364-6086-41fd-8a79-ba67daaf9b65", "value": "T156D623D759C822D5C8934E70B24F2BCD75F1B5198EE76A2D37CB0C02BE31E978245962", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765393094, "uuid": "778523ba-78fc-426a-adc6-37766ffc1ea7", "value": "860714c41d4908a0b78d349f3d9a82a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765393094, "uuid": "5ab6d347-0cdf-4557-ad97-bc66199045d4", "value": "196608:rsoTKkjTYXgwFSa0XuoviLUHpfAzhJvz2hEfdfZwPgixiOb7o3cmupmzmoRjmp6f:rvTKgTLwKBS0A3mIfZwPguHEvmyjiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765393094, "uuid": "0f5c2df1-4d69-4fdf-ac54-2f834e00e058", "value": 13696000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765393094, "uuid": "24890e54-4a3c-4c3e-9525-873f5f4561ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765393094, "uuid": "eec5bc9c-7d7c-4e44-8e83-5e38dbfc6755", "value": "Nexora.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59a0ada-d596-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350479, "uuid": "00ef1d44-0d41-45cf-9644-abbeb0112f7c", "comment": "Malware payload (MaksRAT)", "value": "819a26e7d8824f40618baab861305bdc", "object_relation": "md5", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350479, "uuid": "41143724-d66c-407d-a7a9-0f1509ab723d", "comment": "Malware payload (MaksRAT)", "value": "fc6fdaec5a598367a30f3a61d53541ae9fcce404067fe5d269eae1295caeab85", "object_relation": "sha256", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350479, "uuid": "692bdad1-6f4b-4903-acfa-4f260573151f", "comment": "Malware payload (MaksRAT)", "value": "1c8e5f7d1672e0c2a5292939a78c6fcbdff1ea22", "object_relation": "sha1", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350479, "uuid": "eaff22cf-d6df-4fb8-9481-d2d4943e40ce", "comment": "Malware payload (MaksRAT)", "value": "d8679a86ce9f8239dd514fa6e149e8f434ce7b1d9101364863c5c0739502515f5a49036bc3bc7978ff1d917d83819090", "object_relation": "sha3-384", "Tag": [ { "name": "foldacces-online", "colour": "#F1D842", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350479, "uuid": "a322d767-bf9b-431a-983b-6177b7d8f5df", "value": "T134E2E05E7D68147ECDE3DFB2C2C68B780ADBD1C47904E89615A413AB253807B2663F1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350479, "uuid": "46690e7f-6765-45d1-ab86-d810d621e030", "value": "768:Sjyj7O8mzhpFhxjJ9C6+tHFYHLMAwRi92k2W0bv:MOCdFbCjtlYHLMZR2F2bbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350479, "uuid": "539dd021-6217-4d69-82d7-31a7faa0e2c3", "value": 32590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350479, "uuid": "dc69ec74-6ddd-4e06-881d-fb0fdb753e6b", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350479, "uuid": "15ca4344-dfd8-4c8d-a489-76fb01bc4303", "value": "fc6fdaec5a598367a30f3a61d53541ae9fcce404067fe5d269eae1295caeab85.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b28bc11-d607-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765398618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765398618, "uuid": "20f2e349-f616-4070-b91e-1f716c09d054", "comment": "Malware payload", "value": "623ba165ed3514b84b080f9daefe0d63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765398618, "uuid": "5aa107d1-f340-4b26-8f6b-f0bb1f4b6d8e", "comment": "Malware payload", "value": "fc78a50ee3e559188aeacf08d16a65b1ebca60358f4f97cf058c9b7d57cdd07c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765398618, "uuid": "ad772802-4962-4b6d-82e2-ef162b1817df", "comment": "Malware payload", "value": "19ee6bca469eacc691e5170dcf348aebf4559755", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765398618, "uuid": "b0fea9d0-6821-41b9-a82e-1eaaa63b333c", "comment": "Malware payload", "value": "7cb9ddcef240b3079957268c1b95493927a76c138702ff38130c615f14663df1ae11a1ce39129ced8599d2276e8b9f12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765398618, "uuid": "dbda7c1c-bdd9-45dc-895f-b7b27983df66", "value": "T1E1B2C0B6D2AC56E2C4584C76119FB81B5451763C111483E8F74A277FBCD87988F4C3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765398618, "uuid": "022959ca-7110-4c2c-98af-08ce54b15cf5", "value": "51d5f507286fe9a2db75f423fbc06a61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765398618, "uuid": "88eecacf-5229-4511-9b43-6537e0a6c6f8", "value": "384:/pL5jcNeDoqECWR7DW1X0fGXL7tZFPwlJVfBx2KtBwWF9c8YCYs4DxrNq7M96JXn:/pL5jeeDoqEZ74Xug7UnZxfHrQQ6I7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765398618, "uuid": "00e6bbb8-8567-4af4-b62e-b8f3189a8138", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765398618, "uuid": "54263353-9968-4584-818b-5089ff6a793b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765398618, "uuid": "5586d3f0-5c43-4347-9cfe-1e66927e1d24", "value": "ok.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4c5ecf-d588-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1765344428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344428, "uuid": "20dd7f12-b7e5-4678-ab7e-d04f3495aa05", "comment": "Malware payload (CoinMiner)", "value": "d05b2ad7751254a3cd91b76213fecb5d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344428, "uuid": "0cde92b7-84fa-43d0-9c51-84e92701998a", "comment": "Malware payload (CoinMiner)", "value": "fc88724fcd0682658a60ec0e7cebd30e967ddae7bc2bf279fa6e87dae6cf7e36", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344428, "uuid": "c1f5ce38-4938-4e7b-b807-4ec91f1aa36f", "comment": "Malware payload (CoinMiner)", "value": "a9b65cc486ff9eb5e346cf90a0c3e3a7ba100eae", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765344428, "uuid": "b83901be-e246-4a95-9ad7-26843a2d5fe8", "comment": "Malware payload (CoinMiner)", "value": "98d72d7f2a8b5a67d60af99afd17e749e450bcb42945e8cd2d735f6cdf405c337648572e32f7a1e51f0b517b053b599e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344428, "uuid": "6199e3e6-18c4-4591-81d5-9b42eb2f5bac", "value": "T1A7424229A9A091E5F2C320AA498FA702B5F6516B450E1D0479EC43C4EFC573CCFA1CEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344428, "uuid": "ddd3a318-b371-4e34-98bc-f3c6c2d6d167", "value": "192:mnJcM3+BOHia4J2kjiZW8M+glLy1fd7bCbkbUb3bRPH/gPq3oPSCyb6iUPybKKy4:m6h0d9P0edw/Vh48979V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765344428, "uuid": "5a3645e3-dd76-42cb-ae92-461c0119db6d", "value": 12127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765344428, "uuid": "7959614d-0c1e-4733-8cdf-af2bce579cb8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765344428, "uuid": "c1333769-6088-4f32-aa07-b70229604581", "value": "waffle.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5363bece-d5a0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765354501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354501, "uuid": "b5aeeb82-4694-410c-9de7-dae8ccaf6b68", "comment": "Malware payload", "value": "6d07dcef45d60df212a7e587721f253d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354501, "uuid": "b67672a6-f91d-46cf-a24c-5bb080073e9a", "comment": "Malware payload", "value": "fcbc29a95528e635267b568024089c8598123927139dfe15dcf9b1491b107758", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354501, "uuid": "a9b6bb63-d2cd-45a9-b804-ebf31d104ad1", "comment": "Malware payload", "value": "907f9b08c1128024d2ad99ceedb7aed5e59dbb0d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765354501, "uuid": "6e3dfa56-7399-4395-8620-100c167e200c", "comment": "Malware payload", "value": "d5491a4cccbd267b4303232819f83f25ae48d7817cde91fe2468dba882bdd10487d945483061b7b4f628fa9601e532be", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354501, "uuid": "8bc692c7-2253-48d3-9de1-dc4b343fe3b5", "value": "T1DAA1F8C93A513333CD95DD7EE666495B2082E0C042354FE4B68830FC76ABDC4F690EA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354501, "uuid": "ca8dca2b-e40a-43a3-8301-9223e88234fa", "value": "96:1xMf8bHtc5gXzwIsTAjL5g9MXwHz/XNUfDfx:xDXzwIsTAjLu9MXwHLXNUfDfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765354501, "uuid": "1a07eade-d2ca-49d8-9d73-6bc859f1a5aa", "value": 4905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765354501, "uuid": "e44898bd-5b3e-4b09-9136-01c52d73d816", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765354501, "uuid": "7ef4ed85-69a7-4723-ac8b-40e560e2b63a", "value": "t.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efcbc6d-d5ec-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765387028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387028, "uuid": "caa917d8-9d25-469e-8eaf-97df06c905a5", "comment": "Malware payload (Mirai)", "value": "faf60613e22511395467af9842d1914f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387028, "uuid": "db3438f6-cf9f-48a4-9860-a7ac2a60e294", "comment": "Malware payload (Mirai)", "value": "fcde6f5c944b25a7a99e71303163f96337522e75dd3ae4063266f638642971ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387028, "uuid": "e649114a-a316-42ee-9933-45b997c4519d", "comment": "Malware payload (Mirai)", "value": "9dc7704672707b671d49c5fa6953c53d6b146e45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765387028, "uuid": "926b88d5-62ad-4535-a56a-306854968c23", "comment": "Malware payload (Mirai)", "value": "1784c2f78ec1cc8722e34b078be0829ff11341ff1a9a76f3511abab9fb55ee6e06b5800e2cbb8bf3a1ef08c094bed3d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387028, "uuid": "bc868a5e-d7f1-4eda-9da4-d6cbeafdf9b5", "value": "T1CCD33851B8829A27C5E523BFFA6E028D331563E4D2DE72178C215F217BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387028, "uuid": "eacb394f-b3e5-4ba5-baae-fae2edbc2cd8", "value": "3072:JuVeGJFWOgt9ctajH1I7sk41o+YLyXzXgvf:JuVwt9cUH1I7skMeLmLgvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765387028, "uuid": "b0669c4a-7fba-4d8d-ae66-a9ade9b52ce7", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765387028, "uuid": "14fa13b9-1a5b-4626-ae2b-45aa0fd02fd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765387028, "uuid": "4eea77c8-bd1d-4600-9a3b-27ee4f013046", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d53c867-d61e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765408662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408662, "uuid": "563fd5a9-b297-4d36-a96f-9e92471ff77e", "comment": "Malware payload", "value": "8910f876740500287ab569b1881afc77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408662, "uuid": "d39401a6-aa77-4783-801f-058b531fa785", "comment": "Malware payload", "value": "fd0605a458168b0f7a041f88b5a5cd1417e77540922bab5ac582e3d32e25644f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408662, "uuid": "7cc65087-ca2d-4356-b0d7-d4d1b9274cd7", "comment": "Malware payload", "value": "e5bd90e1a2201fb8d4139e141f42f44eca9bb294", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765408662, "uuid": "294883d2-eb38-4b09-812b-ebd20a6166c1", "comment": "Malware payload", "value": "9a6c653aa0e415b22385e2f06f29ab75c08105a357c27ea0a3e3d7e6ad3c542e3a2f488bc5cef165d1608d02090fce44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408662, "uuid": "167121a1-62b8-43ed-b78a-f603d6ee5562", "value": "T164634B96A401CD7DFD4AF77FC4294A08B82A735462620F2BE36AFC935D31094DE6AD42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408662, "uuid": "9f6be18b-71b7-4b0c-b404-e47b8cad11d2", "value": "1536:ufWjsCPfBMAEd1EUJXuJ9HJJJJJFuNxMiW8udG9C2gWtSPk3yPd:ufWjsa1EPfJG9HJJJJJFu3keg4Sse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765408662, "uuid": "c02950af-3b7f-4f51-8aaa-ab3728a3fc36", "value": 67500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765408662, "uuid": "b3cad0e1-e2ee-4637-844c-76a43f638359", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765408662, "uuid": "d9e2eae9-f1b6-4131-b0ed-5c245b4acf0b", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c976ac9-d58a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765345175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345175, "uuid": "8b024580-46c6-46c1-a232-319d1fb25b50", "comment": "Malware payload", "value": "beea68efb20df7d40d57f5a732af7209", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345175, "uuid": "f7e2a3dc-4f69-45aa-b742-ff49e2d4288a", "comment": "Malware payload", "value": "fe11c7bd41b8cd8b39a8e60a120a563600003bda6888160cc8074adcd1da99e3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345175, "uuid": "521dc07d-454d-49e4-aa2d-25411a6c6a5d", "comment": "Malware payload", "value": "c43bb14ad3aa3519b52022c4bf951077078eef95", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765345175, "uuid": "6a62bebc-11ca-4555-b421-ba5959585134", "comment": "Malware payload", "value": "e8af5b68617eaa14c1919f5384277ed9e57fb235770bf2d00a75d1cb3cfed868ceddc3af104db5b4d20dcd349ed7fd4e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345175, "uuid": "07239b37-7a3e-4129-9e6b-bc6bce92f24d", "value": "T174A35345A2C0B8A9238B1F76B72FB0E5F93F0C9D7594489BC111FC90A5B5706DAE1E32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345175, "uuid": "d55df6a5-7384-4da4-aade-4110f10dc66a", "value": "1536:MEdKgoXHbCVWDCVxCeAW/tmVcA5cBtogLfj81F0aN3uqT6Qv4Bj:MGZorsWPqFmUrj81Ft+qT6Qv4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765345175, "uuid": "7c89c673-8a76-4e3b-87b3-43d665e056e7", "value": 101703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765345175, "uuid": "2b212ec9-8bc9-46aa-b107-9b025d31fa6b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765345175, "uuid": "3db6c601-1fcb-4194-8fe7-2fd32c808bf1", "value": "crypted.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c41d31d-d607-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1765398674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765398674, "uuid": "55d570a2-46b2-4211-bb79-f9e8d30c8423", "comment": "Malware payload (GuLoader)", "value": "24fe3a258044540e00eb8fbf252b29e5", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765398674, "uuid": "f8076fe0-cec7-4165-a526-21f205c4d490", "comment": "Malware payload (GuLoader)", "value": "fe5fc9dc66a30fe5f3506749f0aa6ee7326e92dd16d84dca665b896241b6b19a", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765398674, "uuid": "937ad073-cc04-4da6-8383-d890200b8683", "comment": "Malware payload (GuLoader)", "value": "a4000107c82a94b75f1fe695c9a151817125beeb", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765398674, "uuid": "2d70a44f-ab2e-465b-8e06-1673dccb6416", "comment": "Malware payload (GuLoader)", "value": "913e237d8dd9f5eec546248a7d7383e4efe19cac97444730f61b062e7237f3c6bf8791a9e83f8d025dbad1331600cb28", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765398674, "uuid": "9fe0aafe-f285-4a9d-be1d-c91e14bb3e18", "value": "T1F0E42312D9D9B10F47D4E2ADAC09193784CC8FC572A4C57B4B638B585FC239B98C91EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765398674, "uuid": "01b2f256-cb38-4767-be1c-8037ddb75672", "value": "12288:jdxMLBHpXSiRDbsCmECKskw4kC7q20nCEQWT8tCkuX8XPkoL1+3AwiiMsWG:japvtbgzkw4xqfZItCgPkoBEAwvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765398674, "uuid": "30adaa5a-c91e-4693-90c5-78382c85562a", "value": 686733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765398674, "uuid": "1be625da-66e5-4bb3-9ea7-1718f7423da2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765398674, "uuid": "2201ec2b-5527-4c31-abf2-4398ae7354f1", "value": "ndiciembre_2025.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c337c2d-d600-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765395640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395640, "uuid": "9510f69b-462b-4241-8e72-fb75c706cad5", "comment": "Malware payload (AgentTesla)", "value": "80c69db8fa1d38655b9e016cd047621e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395640, "uuid": "8519e9e1-1bf6-4d41-b82c-8e86d7c74e40", "comment": "Malware payload (AgentTesla)", "value": "fedbb15c2b202106c4526b01299a1fe6922b0af8773e7ddd8202e2c99c5e44d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395640, "uuid": "c3902d26-448d-4afd-a2b0-a8571ac5193d", "comment": "Malware payload (AgentTesla)", "value": "e990775bceabda21731c1e119603f5f3be98469a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765395640, "uuid": "01f8319d-d0fb-45ea-8d17-1bf7543697f6", "comment": "Malware payload (AgentTesla)", "value": "2e0ba0588b4b52448aa73e5f573d6909ab053f15df877cdc2993a02410ca208e2df4fcaa14223c73a6563dc5073996da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395640, "uuid": "df033054-c2a0-4cd4-9019-d9da6b73e7ea", "value": "T1FB35E163F46892F5C7F86072F147E63F2A0A9EA156018541B3F13F9E3AB2A755720B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395640, "uuid": "29b1ebb7-4c64-40ba-849f-33dd164923fd", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395640, "uuid": "545b2641-96c5-46a8-8fdc-ebcfcea79089", "value": "12288:xItBqc0MW13Ky5aq+smuRkohN+L+exvGhTFsZoPdTuRtGn1O8+X08Nfx64nomb:6yc0MW9K+a1+Rkoe+p+GPdTu21OtdNf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765395640, "uuid": "089c190a-3a22-476f-86b7-bc61cd79c06f", "value": 1117672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765395640, "uuid": "d4e761c7-6da1-4c65-85a2-3f8beb0c1c0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765395640, "uuid": "38d7a9bb-ee49-4636-a0e9-f52c4ebb758b", "value": "New-order736363637364674.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2dc7d2-d5ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765365740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765365740, "uuid": "565abd0e-426c-4d19-ba05-ce04084d56fd", "comment": "Malware payload (Mirai)", "value": "dd4d1ab3f34f57761abc3c0f623dc628", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765365740, "uuid": "600238b3-3265-4a49-aea1-d0eea292a97a", "comment": "Malware payload (Mirai)", "value": "ffe41676c31d809406c3858f854972e31cdaddca6f8ebb3a9c48a4b2ed604a5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765365740, "uuid": "9c672fc7-3757-4504-94a8-e64ec37b583c", "comment": "Malware payload (Mirai)", "value": "1124493281360a92c9eb1266cc65b0ab89ce8c46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765365740, "uuid": "1f9a514f-3e15-49db-9e8a-b52bad5c498c", "comment": "Malware payload (Mirai)", "value": "86ec787d3da2d4fa7467edb435390284dff15037418d50588a02efb61595e93ea19a072d8d33f466494d0b85f19a50d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765365740, "uuid": "f1fc0008-36e5-499b-bb71-e4247300efe4", "value": "T1AE247D85E243E6F1EC510934502BBF361D72E93A613ADE82E79CD632EC12642D51A7FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765365740, "uuid": "8530676c-98ae-4b72-8861-a056d49a9124", "value": "6144:RRRecbIxWpnbXYN/8Oq53bmkrGWpxonKL6:RRRecbIxWuN/8Z4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765365740, "uuid": "b3d87871-1750-47b3-a01a-b1604cb8cca7", "value": 228256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765365740, "uuid": "628f936a-72ca-45e7-a036-c922e666652e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765365740, "uuid": "532efef9-7118-449a-a23c-d56dcdc95316", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed52ef4-d595-11f0-a129-42010a9c0007", "comment": "Malware payload (MaksRAT)", "timestamp": 1765350065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350065, "uuid": "65a23de3-28be-4421-955a-31b91c6194e2", "comment": "Malware payload (MaksRAT)", "value": "46d05fdaa78f76e0c4cb99f11edc55eb", "object_relation": "md5", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350065, "uuid": "afa9db03-4d0d-47ef-b143-8672ac9b12fd", "comment": "Malware payload (MaksRAT)", "value": "fff48b44c7afcf52fd59afdad027262fbed0d95597b0dfd25eaf518bd4ea929a", "object_relation": "sha256", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350065, "uuid": "064925de-216c-4392-9763-d3d300322f64", "comment": "Malware payload (MaksRAT)", "value": "c8de4b1aa279ac024c15af0b8807ae17901540dd", "object_relation": "sha1", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765350065, "uuid": "aba4e4d2-d910-4a1b-8474-6f6a4f280e25", "comment": "Malware payload (MaksRAT)", "value": "ead048b9dcd5d85a960a7b26239d6ea363258f8c3c0da4dc91058beab43ccedbd1602e66aa31cb52d3e6487a1a7cd1a3", "object_relation": "sha3-384", "Tag": [ { "name": "avocado-gay", "colour": "#BF0540", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350065, "uuid": "b643ea9d-61d8-4c6a-9e65-800bdb1e4d6f", "value": "T14D371217BEE4D02AED134E7AA0D5C592942D10D8D48BD01F0BA449E98A64DCB07FBFED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350065, "uuid": "2f04e7bc-10c9-4d09-bc2d-857c248b0159", "value": "393216:QC459yivP7z2sxqGZMW2iLmvepm4YzkLW6apagpN0aA+Z3X57+ym8Wex4wv:viflxqGZh7CfdMQVA+pa7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765350065, "uuid": "7001b7a4-3af5-40a2-bc3a-fd923dc9842f", "value": 22621794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765350065, "uuid": "52435736-64d5-4b13-9216-7577fa83d07c", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765350065, "uuid": "90f0c886-616f-48e8-a268-cafb442ff539", "value": "fff48b44c7afcf52fd59afdad027262fbed0d95597b0dfd25eaf518bd4ea929a.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }